How to Fix Windows 10 Error Code 0x80070032

New Windows brings new keyboard shortcuts, most of them are tied to new features and we are presenting you some new ones that are worth remembering. ⊞ WINDOWS + N - notification panel ⊞ WINDOWS + W - News and Interests feed With the News and Interests feed, Windows 11 offers users the ability to check the latest news, the weather, and more without opening a browser window. ⊞ WINDOWS + Z - Snap Layout Instead of the usual two windows snapping capability, Windows 11 allow users to snap their windows in a three-column layout. Users can access this by pressing Windows Key and Z to access the Snap layout. ⊞ WINDOWS + PRT SCN - taking screenshots This one isn’t exactly new, but pressing the Windows Key and Print Screen will automatically capture the entire screen and save a copy of the image on your PC. Once the screen flashes, you will know that the screenshot has been taken, after which you can find the file saved under your Pictures folder in a subfolder called Screenshot. ⊞ WINDOWS + C - Microsoft Teams chat Microsoft Teams app, the service allows anyone with a Microsoft account to quickly start a chat using the Windows + C shortcut.

If you have received a BSOD error message that says, “Tcpip.sys”, read on as this post will show you how you can fix the problem. The “Tcpip.sys” means Transmission Control Protocol over Internet Protocol. It is a library of a set of rules that are used to interconnect different devices all over the internet. The Tcpip.sys file is a driver and if a BSOD error message includes this one, it could only mean that the driver file is corrupted or incompatible with your system or there are some conflicting programs installed in your computer. To fix this error, you can try the following workarounds. Make sure to carefully follow each one of them.

Option 1 – Check for conflicting or incompatible programs by putting your PC in a Clean Boot state

As mentioned, the “tcpip.sys” BSOD error might be caused by some problematic programs that clash with your existing operating system. Several users reported that numerous programs that are supposedly designed to enhance computer performance are causing conflict in the system instead. To identify which program is causing the problem, you need to put your computer in a Clean Boot State. To do so, follow the steps below.

• Log onto your PC as an administrator.
• Type in MSConfig in the Start Search to open the System Configuration utility.
• From there, go to the General tab and click “Selective startup”.
• Clear the “Load Startup items” checkbox and make sure that the “Load System Services” and “Use Original boot configuration” options are checked.
• Next, click the Services tab and select the “Hide All Microsoft Services” checkbox.
• Click Disable all.
• Click on Apply/OK and restart your PC. (This will put your PC into a Clean Boot State. And configure Windows to use the usual startup, just simply undo the changes.)

After putting your PC in a Clean Boot State, try creating a system restore point and see if the problem still occurs. Clean Boot troubleshooting is designed to help you isolate the problem. For you to execute a clean boot troubleshooting, you must do a couple of actions (the steps are given above) and then restart your PC after every action. You might have to disable one third-party app after the other to really isolate the issue. And once you’ve narrowed down the problem, you can either disable the third-party app that’s causing the problem or remove it. Note that you must switch your PC back into the Normal Startup mode after you’re done troubleshooting the problem. Here’s how you can do it:

• From the “Start” menu, go to System Configuration.
• After that, switch to the General tab and click the option for “Normal Startup”.
• Next, go to the Services tab and clear the checkbox for “Hide all Microsoft services”.
• Then find and click “Enable all” and if prompted, you have to confirm.
• Afterward, go to the Task Manager and enable all the Startup programs and confirm the action.
• Restart your PC when prompted.

Option 2 – Disabling Antivirus Software

There are cases when the “tcpip.sys” BSOD error is caused by the antivirus program installed in your computer that’s blocking some essential operations. Because of this, the operating system fails which throws up the BSOD error. As you know, the antivirus program is designed to protect the computer and monitor every action in the system. However, there are instances when the antivirus program gives false positives and shuts down some modules even if it’s harmless. So this could be the case for the “tcpip.sys” error. To verify if the problem is indeed caused by the antivirus program in your computer, you need to temporarily disable it. After you’ve disabled it, restart your PC and then check if the problem’s fixed or not.

Option 3 – Try to update all your Drivers

From time to time, drivers get corrupted or outdated so it’s no surprise that they conflict with the operating system and cause errors like the “tcpip.sys” BSOD error. To fix the problem, you need to update all your drivers especially the network driver since the “tcpip.sys” error is closely related to this driver. Follow the steps below to update your drivers.

• Tap the Win + R keys to launch Run.
• Type in devmgmt.msc into the box and tap Enter or click OK to open the Device Manager.
• After that, a list of device drivers will be displayed. If you see a red or yellow sign that shows up against the driver, right-click on the driver’s name and select “Update Driver Software” or “Uninstall”. And if you find any “Unknown device”, you need to update it as well.
• Select the “Search automatically for updated driver software” option and then follow the instructions to complete the process.
• Restart your PC.

Note: You also have the option to go directly to the website of your graphics card manufacturer and check if there’s a new update – if there is, download it. After that, you could also check if there’s a new update of the game you’re getting the issue of the black bar.

Google Docs has cemented itself as a great free alternative to Microsoft Office Word. Most of the time people just share links to google Docs among themselves but sometimes you need to save and download files.

Luckily Google docs let you download easily files in various formats including PDF as well. In this short tutorial we will explain how can you download your Google document as a PDF file.

Saving Google Docs as a PDF

Open the Google document inside the browser and click on the File drop-down menu. In the file drop-down menu go to Download and choose PDF document. Next, choose the location where you would like your file to be saved and click on SAVE.

And that's all that needs to be done. Also, you can edit PDF files as well in google docs if you need to.

Error Code 0x80060100

Error Code 0x80060100 is an error that relates to the Windows Update process. It most commonly occurs when the Update process runs and cannot be completed, as the system appears to have necessary files corrupted or absent.

Common symptoms include:

• Inability to begin the Windows Update process
• Inability to complete the Windows Update process

While it can be frustrating when users are not able to complete their necessary updates for Windows 10, there are several solutions that are available to fix the problem at hand. Some of the methods that can be used are simple and accessible, even for beginners, while advanced methods of resolution are also available for users who are more confident in their abilities.

Error Code 0x80060100 appears on Windows 10 and earlier versions of the Windows operating systems. In most cases, the steps to resolve the problem remain the same, regardless of the system on which the error appears. This error code is also related to Error Code 0x800b0100, which appears in similar circumstances.

If the solutions below are not successful in resolving Error Code 0x80060100 on your machine, you may need to get in touch with a qualified repair technician who can assist you in the resolution of the issue at hand. Any repair technician used should be familiar with the needs of the Windows 10 update process.

Solution

Error Causes

The primary cause for the appearance of Error Code 0x80060100 on a Windows machine is that the Update files have had damage to them or are found to have elements missing that are necessary for the completion of the Update process.

Further Information and Manual Repair

If Error Code 0x80060100 has appeared on your Windows operating system as you are attempting to download, install, or run Windows Update, there are several steps that you can take to attempt to resolve the error. Some of these methods require advanced knowledge or skills, so if you are not confident in your ability to undertake the steps below, contact a qualified Windows repair technician to assist you in the process.

Here are the best ways to resolve Error Code 0x80060100:

Method One: Run the Troubleshooter for Windows Update

As you attempt to run the Windows Update process and experience difficulty, there is a tool that will usually appear on the screen called the Windows Update Troubleshooter. This process can scan the files being used for the update process and attempt to fix the errors on its own, retrieving or repairing any damaged files as it comes across them.

In most cases, this step on its own will resolve Error Code 0x80060100 on a computer. However, if you are still unable to run Windows Update after using the Troubleshooter, you may need to run a disk repair tool before proceeding.

Method Two: Restart Your Computer

In some cases, Error Code 0x80060100 can be resolved simply by restarting the computer that is affected by the error. Even if this step is not successful on its own, restarting after each of the other methods can allow necessary changes to take place and refresh the progress of the Windows Update process.

Method Three: Use the DISM Tool

This method requires some skill and knowledge of your operating system. To use this tool, follow the steps below:

• Step One: From the right side of the screen, use your mouse to swipe inward and select the “Search” option.
• Step Two: When the search box appears, enter in the words “command prompt".
• Step Three: From the results that appear, right-click on the “Command Prompt” option, then choose the option to “Run as Administrator.” An administrator password may be required at this point.
• Step Four: In the window that comes up, enter in the following words, hitting the “Enter” key after each:
  • Dism.exe /online /cleanup-image /scanhealth
  • Dism.exe /online /cleanup-image /restorehealth
• Step Five: Type in “exit” to close the prompt window and hit the Enter key.
• Step Six: Attempt to run the Windows 10 Update process again, restarting your computer as needed beforehand.

If the methods above are not successful in the resolution of Error Code 0x80060100, a qualified Windows repair technician may be able to assist you.

If you wish to always have at your disposal a utility tool to fix these Windows 10 and other related issues when they do arise, download and install a powerful automated tool.

Recently, a number of users reported an error when they tried to open graphic-intensive apps like video games. According to users, when they tried to open an app, they get the “Display driver failed to start” error instead. Thus, if you encounter the same error, then you’ve come to the right place as this post will guide you on how exactly you can fix it. Here’s the full content of the error message:

“Display driver failed to start; using Microsoft Basic Display Driver instead. Check Windows Update for a newer display driver.”

This kind of error could be due to several factors. It is possible that it could be a result of a corrupted or outdated graphics driver. Aside from that, it could also be due to some issues with the system settings. Worry not though for there are potential fixes that can help you fix the problem. But before you troubleshoot the problem, you need to update your Windows 10 computer first and if it didn’t help fix the problem, then here are the potential fixes that should help resolve the “Display driver failed to start” error.

Option 1 – Try to restart the Graphics driver

Although Windows 10 can recover the graphics driver on its own when it crashes, there are times when it fails to do its job. To restart the graphics driver in your computer, simply tap the Win + Ctrl + Shift + B key combination. After that, the graphics driver will be back in less than a second.

Option 2 – Try running the Hardware and Devices troubleshooter

Running the built-in hardware and devices troubleshooter can also help you in fixing the “Display driver failed to start” error.

• The first thing you need to do is click on Start and then on the gear-like icon to pull up the window for Settings.
• After opening Settings, look for the Update and Security option and select it.
• From there, go to the Troubleshoot option located on the left-hand side of the list.
• Next, select Keyboard from the list and open the Troubleshooter and run it. Once it is doing its job, wait for it to complete the process and then restart the system.
• After the system restarts, check if the problem’s now fixed. If not, refer to the next option given below.

Option 3 – Try to update or rollback the Graphics driver

You can try to update your Graphics card driver using the Device Manager in your computer to resolve the “Display driver failed to start” error or you can also go directly to the website of your graphics card manufacturers like NVIDIA, Intel, or AMD and go to the section called Drivers then check if there’s a new available update – if there is, download and install it. To update your Graphics driver via Device Manager, refer to these steps:

• First, boot your computer into Safe Mode.
• After that, tap the Win + R keys to launch Run.
• Type in devmgmt.msc into the box and tap Enter or click OK to open the Device Manager.
• After that, a list of device drivers will be displayed. From there, look for the Display Adapters and click on them.
• After that, right-click on each entry under the Display Adapters and select the “Uninstall Device” option from the menu.
• Now restart your computer.
• After restarting your computer, go to the Settings app and Check for Updates in the Windows Update section.

Option 4 – Try setting your system for maximum performance

If the first three options didn’t fix the error, you can try setting your computer for maximum performance since Windows 10 allows you to choose the effects you want to activate your system and you can do this by adjusting the performance ratio. Adjusting the performance ratio can be done via a certain setting in your computer – and this setting should be set to “Maximum Performance” to resolve the error.

• In the Windows Search bar, type in “performance” and from the search results that appear, select the “Adjust the appearance and performance of Windows” option.
• Next, a mini window will appear and from there, click on the radio button that says, “Adjust for best performance”.
• Once done, click on the Apply and OK buttons to save the changes made. This should resolve the problem.

A lot of things can go wrong even when you’re only doing some simple operations or tasks on your computer and this is due to the fact that there are various small operations make up in order to perform the larger operations on your computer. So if any of these smaller operations are not properly working, it crashes the operation as a whole and it throws an error code instead. And one of these error codes is Error 0x800701e3. This particular error pops up when an error has occurred in the File Explorer when a transfer is initiated from one disk to another in your Windows 10 computer. When you encounter this error, you will get the following error message:

“Error 0x800701e3: The request failed due to a fatal hardware error.”

There are several methods you can check out to fix this error – you can try to run System Restore or Check Disk or format the destination drive or check the SMART attribute of the drive. For more details, refer to each one of the following options.

Option 1 – Try to run System Restore

Error 0x800701e3 might be due to some adjustments you’ve made in your computer’s settings. Thus, to fix this error, you can try undoing those changes using System Restore. How? Refer to these steps:

• Tap the Win + R keys to open the Run dialog box.
• After that, type in “sysdm.cpl” in the field and tap Enter.
• Next, go to the System Protection tab then click the System Restore button. This will open a new window where you have to select your preferred System Restore point.
• After that, follow the on-screen instructions to finish the process and then restart your computer and then check if your mouse is now back to its normal state.

Option 2 – Try running the Check Disk utility

You can also run the Check Disk utility in fixing Error 0x800701e3.

• In the Windows Search box, type “command prompt” and from the search results, right-click on Command Prompt and select “Run as administrator”.
• After opening Command Prompt, type this command and tap Enter: chkdsk <Partition Letter>: /f /r /x /b
• The command you entered will start to check for errors and fix them automatically. Else, it will throw an error message saying, “Chkdsk cannot run because the volume is in use by another process. Would you like the schedule this volume to be checked the next time the system restarts? (Y/N)”.
• Tap the Y key to schedule Disk Check the next time your computer restarts.

Option 3 – Try to format the destination drive

Formatting the destination drive could also help you resolve error 0x800701e3. To format your drive, follow these steps:

• First, open File Explorer and then right-click on the drive where you encountered the error.
• Next, select Format from the context menu. This will open a new mini window.
• Then select the NTFS option from the drop-down menu for the File System menu.
• After that, check the box labeled as Quick Format.
• Now click on Start. Keep in mind that doing so will remove all the contents of your storage device.

Option 4 – Verify the hard drive using SMART attributes

In case you don’t know, Windows has a built-in feature of SMART analysis which analyzes the hard drive/SSD and checks all the parameters by performing some minor operations. To use it, follow these steps:

• Tap the Win + S keys and type “command prompt” in the field then right-click on the related search result and select the “Run as administrator” option.
• After opening Command Prompt as admin, type the “wmic diskdrive get status” command and hit Enter.
• You should get a result after that, and if you see that it’s “normal”, proceed to the next option below

Blinking or Flashing Desktop After login - What does it mean?

Upon updating to Windows 10, some users might encounter a blinking or flashing desktop after logging in. This will result in a repetitive restarting of explorer or you won’t be able to make the start menu and shortcut keys work. In addition, the network icon might not appear in your taskbar as well. Other Windows 10 error messages include error code 0xc000021a.

Solution

Error Causes

Your blinking or flashing desktop after logging in might be the result of problems with the bushell.dll shell extension, which is a part of the Norton Security Suite. Another possible cause for this annoying problem is an issue with your display driver since not all systems will use the same display driver and will depend on what graphics card you use.

Further Information and Manual Repair

In fixing the bothersome blinking or flashing desktop after logging in problem, you can do a manual repair method to address the root problem. You need to be familiar with the Windows command line to successfully go through the process. However, if you are not knowledgeable or confident enough to do this on your own, it would be best to seek help from a professional. Or, you might want to consider using an automated tool to solve the issue.

You need to identify first what’s causing the blinking or flashing of your desktop after login to properly address the issue. The following methods can be done if your issue is caused by bushell.dll shell extension issue:

Method One: Forcefully Terminate Process

1. Press on Ctrl+Alt+Del then select Task manager
2. Start a Command Prompt as an administrator by choosing the File menu then Run New Task.
3. Type exe. Make sure to tick the checkbox “Create this task with administrative privileges.”

NOTE: Text input is most probably affected by the explorer restarts so you might need to repeatedly type some letters or to carefully input texts.

4. In the Command Prompt, type taskkill /f /im explorer.exe. This will stop the blinking or flashing.
5. Type cd “Program Files” afterward, type dir /s bushell.dll to locate where the dll is. (For example, purposes, use c:\program files\Norton Security Suite\Engine6422.5.2.15 as the location)
6. If the dll file is not found, you can try repeating step 5 but this time, use “Program Files (x86)” However, you can proceed with the next step if you already located where the bushell.dll is.
7. Type cd ”c:\program files\Norton Security Suite\Engine 6422.5.2.15” to change the name of the directory you found the dll in.
8. Type ren bushell.dll bushell-crash.dll
9. Restart now the system by typing shutdown /r /f /t o in the command line.

Method Two: Uninstall Programs

1. Log out then go to the sign in screen
2. Press the Shift key as you simultaneously click on the Power button on the screen.
3. Continue pressing on the Shift key as you click
4. Continue pressing on the Shift key as you wait for the Advanced Recovery Options menu to appear.
5. Once the Advance Recovery Options menu appears, click on Troubleshoot then select Advanced options.
6. Click on the Startup Settings then select
7. Boot on Safe Mode by pressing 4 on your keyboard.
8. Log in then press Windows key + X.
9. Select the Device Manager then expand Display Adapter.
10. On your Display Adapter, right-click then select
11. Exit Device Manager
12. If in case you also have an older Antivirus utility, you should uninstall it as well.
13. Restart

NOTE: You might need to download the latest Video Driver on a working computer. Save it in a thumb drive then copy and install it on your computer. If in case there is no native Windows 10 driver, you can also download the latest Windows 7 or Windows 8.1 video driver. Afterward, install it in compatibility mode.

Method Three: Use Microsoft System Configuration Utility

1. Log out then go to the sign in screen
2. Press the Shift key as you simultaneously click on the Power button on the screen.
3. Continue pressing on the Shift key as you click
4. Continue pressing on the Shift key as you wait for the Advanced Recovery Options menu to appear.
5. Once the Advance Recovery Options menu appears, click on Troubleshoot then select Advanced options.
6. Click on the Startup Settings then select
7. Boot on Safe Mode but this time, choose 5 to start in Safe Mode with networking.
8. Check if your problem is present or not in Safe Mode. If not, then you are on the right track.
9. Press on the Windows key + R then type msconfig to start up your exe file.
10. Click on the Services tab then choose Disable All. Afterward, click on
11. Once you’re prompted to reboot your computer, go ahead and reboot in Normal Mode. Check if the issue is still present.
12. If the blinking or flashing desktop after login is gone, then you can just do a process of elimination.
13. Start-up on your exe again then begin bringing up services a few at a time.
14. You can turn on all other services except for the following which causes the blinking or flashing desktop after login problem: Problem Reports and Solutions Control Panel Support •Windows Error Reporting Service.

Stop C00002lA Fatal System Error- What is it?

C00002lA Fatal System Error is a blue screen of death error that may occur when you start your Windows NT 4.0 based computer. This error causes the screen to turn blue and the system also shuts down. The stop C000021A error message is displayed in the following format:

Stop c000021a {Fatal System Error} The session manager initialization system process terminated unexpectedly with a status of 0xc0000017 (0x00000000, 0x0000000) The system has been shut down.

Error Causes

The stop C000021A error occurs when either Crsrss.exe or Winlogon.exe fails. When the Windows NT kernel identifies that either of these processes has failed, it stops and the error code stop C000021A appears on the computer screen. Here are some of the underlying causes for the stop C0000021A error:

• The incompatible third-party program
• Hard disk issues
• Service pack installation has failed
• Mismatched system files have been installed
• Bad and invalid registry keys

Further Information and Manual Repair

To resolve the stop C000021A Fatal System Error on your PC try the following solutions:

• Remove Incompatible Third Party Programs

If the error occurred after you recently installed a new program, then it is advisable to remove that program. The error occurs due to the incompatibility of the program. To remove the program go to the start menu and click on the control panel. Now click on Add/Remove Program tab and double click on the program name that you recently installed and remove it from the list. Once removed, not reboot your PC. Reinstall a compatible program and run it. It is most likely to resolve the issue. However, if the stop C000021A error still occurs, then it means the problem is critical. It is related to the registry.

• Repair and Restore the Registry

This procedure is slightly long and tricky. To try it, you need to be technically sound. Here’s what you have to do: first create a parallel installation of Windows NT. Start your PC to the parallel installation and then open the Registry Editor. On the Registry Editor’s Windows menu click HKEY_LOCAL_MACHINE on Local Machine and then click Load Hive. Now type the path %systemroot%system32configsystem into the System hive of the prior installation. Then click open. Here you will be prompted to enter the name of the key, type TEST. Note the setting for the current DWord value in the preceding registry key. This is 0x1 and is denoted by CURRENT:Reg_Dword: 0x1. This value indicated that the Current Control Set for your original Windows NT installation corresponds to ControlSet001 in this window. Now if the value is 2, it indicated that the Current Control Set corresponds to ControlSet002. Now locate the following registry key: HKEY_LOCAL_MACHINETESTControlSetXXXControlSession Manager. XXX is the Current Control Set Value. And delete any pending file rename operation entries. Then click TEST hive and then click Unload Hive. After that again repeat the process, open the registry menu and click load hive, here type the path %systemroot%system32configSoftware to the Software hive of the prior installation and then click open. Now you type TEST 2 when you are prompted for the name of the key. Remove any pending file rename operations entries in the following registry keys: HKEY_LOCAL_MACHINETEST2MicrosoftWindowsCurrentVersionRunOnce HKEY_LOCAL_MACHINETEST2MicrosoftWindowsCurrentVersionRunOnceEx Now click TEST2 hive and then click unload hive. Quit the Registry Editor and then restart your original installation. This will resolve the stop C000021A error.

What is OpenCandy?

OpenCandy is an application that downloads and installs software, including other Internet Browsers to a computer system. Used as a bundle, this application installs additional programs that you may knowingly or unknowingly agree to install. Since most users don’t accept the challenge of reading the EULA in its entirety, they tend to download bundled applications unknowingly.

Assessment of OpenCandy PUP

During the initial assessment of OpenCandy, I was a little skeptical about what to look out for or expect. In fact, I had to install the OpenCandy.exe file twice to discern its behavior. I’m not sure how this application got its name but I do believe it has something to do with the fact that it supposedly helps Internet users open a new world of Internet browsing. That conclusion was arrived at after realizing that OpenCandy.exe installed mostly Internet browsers along with a tune-up tool on the test computer. However, as a result of the system requirements, there was a pop-up message indicating that Internet Explorer 8 was not compatible with the computer system in question. In comparison to the malware I’ve encountered since I started researching malware, OpenCandy is everything but malicious. In fact, this application is only categorized as malware because of its’ subtle covert nature of installing bundled programs unsolicited by the user. Additionally, OpenCandy coerces users into changing their Internet Browsers by installing those unrequested by the user. In fact, it’s no shock that OpenCandy chose to install the Internet Browser ‘Opera’ as a part of this bundle since it’s one of the least used browsers according to the Federal Government. Clearly, this was a smoothly disguised advertisement or promotion to force users into using the Opera Browser, along with Internet Explorer 8.0. While these aforementioned browsers in themselves aren’t malicious and are in no way considered malware, they were installed as a promotional tool and without the request of the user. Despite being mentioned within the EULA, advertisers are capitalizing on this since most users do not bother to read the agreements when installing a program. Furthermore, OpenCandy, like most other bundled applications I’ve dealt with, threw in a tune-up tool as a part of the promotion. I found this tune-up application annoying since I had to hassle my way into getting it to close from the computer screen. I can only imagine the hassle users would go through trying to remove this software. Image 7: Depiction of a scan performed by Tuneup Utilities. The scan detected that several areas on the test PC could be optimized/tuned up. Image 8: After a scan was completed using the Tuneup utility program, I was given an option to buy the full version. Nothing is wrong with this marketing strategy. In fact, most utility tools if not all will scan your computer to detect threats or loopholes, but they won't exactly allow you to fix those problems unless you buy the full version. It's not unfair, it's just business. Programs installed during the installation of OpenCandy include:

• Web Companion: Developed by Lavasoft, Web Companion is said to be an application that serves as a security defense for your Internet browsers by preventing unauthorized changes (see image below)
• Tuneup Utilities: Tuneup Utilities does exactly as it says. It cleans up a computer system, whereby preventing unused programs from slowing it down.
• Opera Stable 30.01.1835.88: Opera is a fast, simple, and effective Internet browser that allows users to get around on the web.

All in all, the intent of installing an application such as OpenCandy is to unleash a world of promotion or advertisements on your computer. They are pretty annoying and in some cases difficult to remove. Furthermore, as a user, you want to control what gets installed on your computer without being dictated to or coerced in some EULA that you probably overlook. To completely remove OpenCandy PUP from your computer, click here to download and install Spyhunter.

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities. However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."

What happens when malicious software is installed

"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:

• Stealing instant messenger messages;
• Stealing instant messenger database files (if the root is available);
• Inspecting the default browser's bookmarks and searches;
• Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
• Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
• Inspecting the clipboard data;
• Inspecting the content of the notifications;
• Recording audio;
• Recording phone calls;
• Periodically take pictures (either through the front or back cameras);
• Listing of the installed applications;
• Stealing images and videos;
• Monitoring the GPS location;
• Stealing SMS messages;
• Stealing phone contacts;
• Stealing call logs;
• Exfiltrating device information (e.g., installed applications, device name, storage stats).

How does it work?

Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed. "Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said. "The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."

Camouflage

The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.