CryptoDefense Asks for $500 BitCoin Aiming at Enterprises! Help!

CryptoDefense is another encryption software in the wake of Cryptolocker. It employs almost the same way to encrypt the document and data on a target machine:
CryptoDefense acquires RSA public key from its remote control server when its vicious codes is injected by a supportive worm. A new AES key will be consequently generated to encrypt almost all types of files including .jpg. In other word, the encrypted documents are locked down with two keys. One of them can be deciphered by a private key which can be accessed on its controller and the other is in the hand of CryptoDefense’ author.

If one hands over money, the hacker would ask the victim to download certain browser and get the private key him/herself. Once the key it typed on the locked down computer, the hacker would remotely control the machine and use another key to finally decipher the documents, if the hacker keeps his/her words. Therefore, the decipher means has not yet been mastered. But it is necessary to remove CryptoDefense’ vicious code from the computer to prevent further damage.

Damages by CryptoDefense

Asking for BitCoin is its main goal. To ensure the income, some damages should be made concretely. By preloading its virulent code into boot sector and overwriting concerning drivers, CryptoDefense manages to run right before Windows displays its desktop, making it futile to dodge CryptoDefense by simply rebooting the affected computer or by enabling Task Manager. Drivers regarding security utilities are also disabled by CryptoDefense; plus complex SHA shell, CryptoDefense is capable of hindering any modifications of its core files and data, so that the evil deeds can be guaranteed. When drivers, tools to communicate between hardware and software for a better operation, are disabled or maliciously modified, mechanical problems, dysfunctions and malfunctions would be incurred:

Remove Adware.CoolWebSearch, Is Adware.CoolWebSearch Virus?

Adware.CoolWebSearch Problems

CoolWebSearch is an adware that once ranged in 2005 and detected by AVG. So far according to the observations, Adware.CoolWebSearch attacks Windows platforms only. Though as an adware, CoolWebSearch manages to give rise to the following problems:

1. Computer runs slow in general.
2. Hourglass lingers longer than usual on desktop and Windows explorer.
3. Random pop-ups occur to ruin surfing experience.
4. Additional items are detected after its installation, including "shoppingwizard","offer optimizer", and "CasProg".
5. Adware.CoolWebSearch would sometimes even prevent searching.
6. The adware makes installed anti-virus programs keep sending warnings every couple hours that the computer is at risk.

Is Adware.CoolWebSearch Virus?

HEUR:Worm.Script.Generic, What Is It and How to Remove?

What HEUR:Worm.Script.Generic Does?

1. Disables Automatic update by overwriting relevant drivers.
   HEUR:Worm.Script.Generic can affect any connected device and generate autorun.inf for automatic affection and propagation.
2. The worm would affect system running processes to confuse installed security utilities and escape automatic removal.
3. HEUR:Worm.Script.Generic connects designated web sites to download additional malicious items and generates Root.exe in scripts folder under “web” category (utilized to execute commands remotely), which would finally result in unauthorized access and direct control.
4. The worm utilizes shortcut vulnerability to automatically run virulent items whose extension can be .lnk and.dll.
5. DNS setting will be manipulated because of VBScript technology, leading to browser hijacking(e.g. isearch.babylon.com)or redirecting problem.
6. The worm could cause financial loss by taking advantage of JavaScript technology to steal log-in credentials and identity information.

Isearch.babylon.com, Is It Virus and How to Remove?

Is Isearch.babylon.com Virus?

Isearch.babylon.com is an accessory of Babylon translation tool. It is no more than a traffic exchanging site to intercept traffic and help promote its translation products. Usually speaking, downloading and installing relevant products or third-party programs would result in Isearch.babylon.com hijacking. It is not technically a virus though it employs rogue deeds such as replacing default homepage and search engine without permission and keeping directing people to commercial sites.

Reasons of Isearch.babylon.com Resisting Automatic Removal 

Security utilities are created to detect and remove infections by finding malicious attribute code. Since Isearch.babylon.com is not a virus at all, anti-virus programs are not able to help remove it automatically even though it is hijacking browsers and causing problems:

Help Remove Virus:DOS/Rovnix.W – Easy Fix

Virus:DOS/Rovnix.W Vicious Characters

1. Virus:DOS/Rovnix.W hooks APIs to access DataBase or computer hardware concerning pivotal components such as security service.
2. Virus:DOS/Rovnix.W downloads and executes additional modules from the C&C server (rtttt-windows.com C& C domain has been detected).
3. Virus:DOS/Rovnix.W works in multithreading mode to communicate with the malicious driver and sends an encrypted buffer to the driver to be written in hidden storage and injected into processes.
4. Virus:DOS/Rovnix.W offers botnet for rent to earn money.
5. Virus:DOS/Rovnix.W contains a URL address and uses HTTP protocol in the communication.

Why Anti-virus Program Won’t Remove Virus:DOS/Rovnix.W

Virus:DOS/Rovnix.W is roughly categorized as Trojan; it possesses high secluded performance: