Fix 0x80071AC3, Volume is dirty error message

If you are trying to copy a folder or a file but encountered an error that says, “An unexpected error is keeping you from copying the folder. If you continue to receive this error, you can use the error code to search for help with this problem”, read on as this post will guide you on how you can fix this error.

This kind of error is a CHKDSK error. It is the “Volume is dirty” error message with error code 0x80071AC3 which indicates that the CHKDSK operation on your computer did not go through due to some corrupted sector of your hard drive, data corruption, corrupted system files, malware infection, as well as improper installation of an application that left some residual folders and files and many more.

To fix the Error 0x80071AC3, here are some potential fixes you can check out to resolve it:

Option 1 – Run the Check Disk utility

You can also run the Check Disk utility to fix the error when you connect your USB or external device.

  • In the Windows Search box, type “command prompt” and from the search results, right-click on Command Prompt and select “Run as administrator”.
  • After opening Command Prompt, type this command and tap Enter: chkdsk /r /f <PARTITION LETTER>
  • The command you entered will start to check for errors and fix them automatically. Else, it will throw an error message saying, “Chkdsk cannot run because the volume is in use by another process. Would you like the schedule this volume to be checked the next time the system restarts? (Y/N)”.
  • Tap the Y key to schedule Disk Check the next time your computer restarts.

Option 2 – Try to check if a particular volume is dirty and exclude it

The next thing you can do to fix the problem is to check if the particular volume is dirty and exclude it. To do so, follow these steps:

  • In the Start Search, type “command prompt” in the field and right-click on Command Prompt from the search results, and then select the “Run as administrator” option.
  • After opening Command Prompt with admin privileges, execute this command: fsutil dirty query <PARTITION LETTER>
  • After that, you will see either of the following results of the command you just executed:
    • “Volume <PARTITION LETTER> is dirty”
    • “Volume <PARTITION LETTER> is not dirty”
  • If you see the “Volume <PARTITION LETTER> is dirty” message, then you can just skip checking the drive for errors by executing this command: CHKNTFS /X <PARTITION LETTER>

Option 3 – Try to format the destination drive

If the first two options above didn’t work, then you might want to try formatting the drive can also help you resolve the error. To format it, follow these steps:

  • To get started formatting your drive, tap the Win + E keys and then go to the access page of the drive.
  • Next, right-click on the drive and select Format.
  • After that, uncheck the “Quick Format” option and then format your drive properly.
  • Now once the formatting process is finished, unplug the drive and plug it back in afterward.
  • Check if the error is already fixed. If the drive is not initialized, tap the Win + R keys and hit Enter.
  • After opening the Run dialog box, type “diskmgmt.msc” and hit Enter to open Disk Management.
  • From there, right-click on the drive volume and select initialize disk.
  • Next, select the correct partition type and proceed.

Do You Need Help with Your Device?

Our Team of Experts May Help
Troubleshoot.Tech Experts are There for You!
Replace damaged files
Restore performance
Free disk space
Remove Malware
Protects WEB browser
Remove Viruses
Stop PC freezing
GET HELP
Troubleshoot.Tech experts work with all versions of Microsoft Windows including Windows 11, with Android, Mac, and more.

Share this article:

You might also like

Fix An internal error has occurred 0x80070716
If you see the following error message in the File History tab of the File Recovery utility of the Windows Backup module in your Windows 10 computer, read on as this post will guide you in fixing it with the help of two potential fixes.
“An internal error has occurred: The specified resource name cannot be found in the image file. (0x90070716).”
You can also encounter this error when you run the System Image Backup function. As mentioned, you can resolve this error using two potential fixes namely checking the status of the Windows Backup Service and checking the settings in the Windows Registry. For more details, refer to the instructions provided below but before you proceed, it would be better if you create a System Restore point first.

Option 1 – Try checking the status of the Windows Backup Service

  • First, you need to tap the Win + R keys on your keyboard to open the Run dialog box.
  • Next, type “services.msc” in the field and click OK or tap Enter to open the Windows Services Manager.
  • After that, you will see a list of services and from there, look for the Windows Backup Service and double click on it to open its Properties.
  • Then check if its Startup type is set to Disabled. If it is, then change it to “Manual”. Note that this service is essential as it provides backup and restores capabilities.
  • Now click on the Apply and OK buttons to save the changes made and then restart your computer. Check if the error is now gone.

Option 2 – Try checking the Registry setting of Windows Backup

  • Tap the Win + R keys to open the Run dialog box.
  • Then type “Regedit” in the field and tap Enter to open the Registry Editor.
  • After opening the Registry Editor, navigate to this registry key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsBackup
  • From there, look for DWORDs named “ValidConfig” and “ValidSystemImageBackup” located in the right-side panel.
  • Once you found them, delete them or set both of their values to “0” and make sure that the base is Hexadecimal and click OK.
  • Now exit the Registry Editor and restart your computer to apply the changes made.
Read More
Free Quake upgrade comes to Steam and more
quake remasterWithout any fanfare, news, or information Bethesda has released a completely free upgrade for legendary Quake 1. Free upgrade is automatically applied to all users who possess the original game and it has already been rolled out.

What has changed for good?

New textures, effects, and resolutions are one thing that will come first into your focus when you start the game. From the moment game is started it feels and looks like a game you remember from a long time ago. Models are also upgraded with a higher polygon count. Another thing that will hit you right away is the legendary OST by Trent Reznor in its full glory. If you have the original Quake and played it you will know that OST was missing from the Steam release and having it fully back is a great feature. I would argue that placing just OST alone in the steam release is enough for people to play it again since it adds so much atmosphere. Deathmatch and other multiplayer goodies are all here as well and there is a completely free new episode in the game with several levels. Yes, you get a free Quake upgrade in HD with an extra episode completely free.

The bad side of Quake coin

So this might come as a purist or obsessive nit-picking but there were two things that I, personally am not a fan of and have noticed during my gameplay. Please know that this is personal preference and by no other chance reflects the quality of the game itself but I just had to talk about it. Quake remake is made in a new engine and as such dynamic and gunplay feel different from the original, granted they have done the best they could to replicate the authentic feeling of the original game but there are parts of the game where I have felt that simply put, it feels different. Another thing is also tied to technology and the overall game is somewhat a little brighter and in some areas little softer in dark areas. Like I said this is purely personal preference and might come as nitpicking but I preferred the darker and grittier look of the original game. Darkplaces, the free custom-made upgrade did this in my opinion better.
Read More
How To Fix The "Referenced Memory At" Error Code

Referenced Memory at - What is it?

0x Referenced Memory at 0x is an error code that occurs when the random memory addresses conflict. This error causes running programs or browsers to crash. Referenced memory at error code is considered as a service violation error. It is displayed as the following:

“The instruction at 0xf77041d24 referenced memory at 0×00000000. The memory could not be read.”

Solution

Restoro box imageError Causes

The ‘referenced memory at’ errors is either triggered by:
  • Hardware failure
  • Problems with the RAM and the registry
Hardware failure may result if the driver is not installed properly. The problems in the RAM indicate registry issues that occur due to data overload in the hard disk and poor PC maintenance. The registry saves all the information and activities you perform on your system on the hard disk. This includes the junk files, temporary files, invalid registry entries, and files of both installed and uninstalled programs.  These files accumulate and take over a lot of RAM space. Also, the referenced memory at error can be considered to be a form of memory leak where unknown third-party software can take up the memory space that has been reserved for a particular program. For example, if you have toolbars and add-ons installed in your browser, it can also lead to invalid registry storage in the registry. If you don’t clean the registry, these unnecessary files can overload your data and lead to hard disk/RAM damage and corruption triggering obscure error messages like referenced memory at error.

Further Information and Manual Repair

Referenced memory is a critical error; if not resolved it can lead to serious PC damages like a system failure. To avoid this, it is advisable to fix it right away. Here are a couple of ways to repair this issue on your system:

Cause: Hardware Failure

Solution: If the referenced memory at error is generated due to hardware failure then to resolve this error you must reinstall the driver that has caused the error to appear. Let’s say if the error pops up because of the printer driver, reinstall it. For re-installation of the driver, simply go to the control panel and click on the Device Manager option. Once you click it you will see a detailed page with a list of devices. Now click on the printer (the problematic driver in this situation) to reinstall the driver software. Double click on it to open the properties dialog box and then click the driver tab and update the driver. Once you have updated the driver, try using the printer. Check if it works. If it works and the referenced memory at the error code does not appear on the screen, this means the problem was with the hardware. However, if the error still pops up then this means the problem is deeper. It’s related to the registry.

Cause: Problems with the RAM and the registry

Solution: If the problem is with the RAM and the registry, then it is advisable to download Restoro. Restoro is a new, next-generation, and highly functional registry cleaner. It detects and removes all the registry issues, unnecessary and obsolete files saved in the hard disk taking up a lot of RAM space. It clears the RAM and cleans up the disk. Furthermore, it repairs the damaged files, fragmented disk, and the corrupt registry in seconds enabling you to resume the program that you were running before the error occurred. Restoro has a user-friendly interface and easy navigation. To run and operate this system you don’t need any kind of technical expertise. In just a few clicks you can resolve the critical referenced memory at error on your PC. It is compatible with all Windows versions Click here to download and install Restoro on your PC and fix the referenced memory error code now.
Read More
Cooler Master's Orb X upcoming gaming chair
The newest piece of hardware for PC or console users is not really what anyone has expected and for sure not from a company like Cooler Master. orb x black and whiteI going to admit right here that I am a big fan of Cooler Master PC cases, I like them and they are always one of the things that I consider when building a new PC, overall I like their ideas and quality so personal for me it was quite a surprise to see that they are one that is making a new generation gaming chair. Now truth to be told Orb X is not your typical gaming chair as you can clearly see from the pictures. The chair itself will come in two colors: white or black and RGB lighting looks to be prominently featured throughout. orb x backThe chair itself is advertised as both meant and aimed for professional and gaming crowds but I believe the gaming crowd is in general more interested in this hardware piece. Hardware is enclosed in a fully motorized shuttle dome which aims to maximize your privacy, it supports a single 49inch display or three 27inch monitors along with surround speakers if you do not wish to use headphones. Orb x sideIt offers an adjustable headrest, lumbar support, and footrest so you can spend some time in it and be comfortable. Controls on the chair itself allow you to raise or lower the dome for easier getting in and out of it. Orb X also has a compartment in its backside, it folds out and has a sliding tray designed to hold your PC or console. Everything is enclosed so wiring is not the issue. Overall Orb X seems really like the computer chair of the future, Cooler Master expects to release the Orb X by December 2021, priced around $12,000-$14,000.
Read More
Windows 11 android apps update

One of the selling points of Windows 11 was the ability to run Android apps natively in it without the need for any third-party software. It is not a big surprise that even after its release Microsoft is evolving and expanding Windows 11 and its features.

Windows 11 Android apps

Microsoft is now rolling out an update for the Windows Subsystem for Android on the Dev Channel of the Windows Insiders program. The new version upgrades the core operating system from Android 11 to Android 12.1 (also known as Android 12L), which means the new system and app features in Android 12 and 12.1 are now available on Windows for the first time. However, not the new features in those updates apply to the modified version that runs on top of Windows. For example, one of the main improvements in 12.1 was a dual-pane notification panel for larger screens, but Android app notifications on Windows just show up in the Windows notification panel.

The upgrade also improves how Android apps integrate into Windows. The Windows taskbar will now show which Android apps are currently using the microphone, location, and other system services — similar to many native Windows applications. Toasts messages (the small popups that some apps use for temporary messages) are now displayed as Windows notifications, and the titlebar on Android apps will use the current activity name for the title.

Full changelog

  • Windows Subsystem for Android updated to Android 12.1
  • Advanced networking on by default for newer x64 Windows builds
  • Updated Windows Subsystem for Android Settings app: redesigned UX and diagnostics data viewer added
  • Simpleperf CPU profiler recording now works with Windows Subsystem for Android
  • Windows taskbar now shows which Android apps are using microphone and location
  • Improvements to Android app notifications appearing as Windows notifications
  • Reduced flicker when apps are restored from minimized state
  • Apps are not restarted when devices come out of connected standby on recent Windows builds
  • New video hardware decoding (VP8 and VP9)
  • Fixes for on-screen keyboard in apps
  • Fixes for full-screen Android apps and auto-hidden Windows taskbar
  • Windows Subsystem for Android updated with Chromium WebView 100
  • Added support for Android NetworkLocationProvider in addition to GpsLocationProvider
  • Improved general stability, performance, and reliability

The new update is limited to Windows Insiders for now, but once Microsoft fixes all the bugs, it should start rolling out to everyone on Windows 11 that has the Android Subsystem enabled.

Read More
Can't Connect to Blizzard Battle.net App
Blizzard is one of the most beloved game company which brought some of the most and greatest titles in PC gaming. Blizzard has released its own launcher in which you can launch games, sadly sometimes launcher does not want to work and fails to connect. If this happens to you be sure to:
  1. Reset your network devices to make sure your router hasn't become flooded with data.

    Power cycling your modem and router allows them to reset and re-establish a connection to your ISP. Follow these steps to completely power cycle the devices in your network connection:Note: If your modem has a battery backup, you will need to take the battery out or use the reset button on the modem.
    1. Shut down all computers connected to the modem/router.
    2. Power down and unplug the modem and the router if you're using one.
    3. Allow to sit for 60 seconds unplugged.
    4. Plug in and turn on the modem and router, and allow them to completely boot up until the front panel connection lights on the modem show a steady connection.
    5. Start the computer and allow it to completely boot up.
  2. If you're using a wireless connection, optimize your internet connection to rule out a connection issue.

    If you're experiencing issues with your low-speed or wireless internet connection, follow the steps below to troubleshoot the problem.
    1. Try plugging your computer directly into your modem.
    2. Shut down other programs that access the internet, such as other games or download programs.
    3. Satellite, mobile phone, and WiMax internet connections are not stable connections and may cause further connection issues when playing Blizzard games. If possible, consider switching to a more stable connection.
  3. Update your drivers and operating system to resolve any compatibility issues.

    Out-of-date drivers and operating systems can cause a variety of issues and are one of the first things to check when a game is having problems. The instructions below will help you check and update your drivers.
    • Even new computers can have out-of-date drivers and operating systems because updates are released routinely.
    • Some games and programs might run fine on a system with old drivers, but outdated drivers can still create technical issues with specific games or programs.
    • Check our supported video cards articles to make sure your hardware is compatible:
    Refer to the steps below to update drivers and software for your operating system.
  4. Release and renew your IP and flush your DNS to resolve any network conflicts.

    1. While on the desktop, press Windows Key and type CMD.
    2. Right-click Command Prompt and select Run as administrator.
    3. Type ipconfig /release in the command prompt.
    4. Wait a few seconds for a reply that the IP address has been released.
    5. Type ipconfig /renew in the command prompt.
    6. Wait a few seconds for a reply that the IP address has been re-established.
    7. Type ipconfig /flushdns in the command prompt.
    8. Close the command prompt and attempt to make a connection.
  5. Close all other applications to resolve software conflicts and free up resources.

    Before trying the steps below, close unnecessary programs and restart your computer. Identify Problematic Startup Items
    1. Press Ctrl+Shift+Esc to open the Task Manager.
    2. Click More Details.
    3. Select the Startup tab.
    4. Right-click on each item and select Disable.
    5. Restart the computer.
    If this resolves the issue, enable the startup application one at a time to determine which one is causing the problem. You will need to restart between each application you enable. Note: To re-enable startup applications, follow steps 1-4 and select Enable.
  6. Delete the Battle.net Tools folder to automatically rebuild outdated or corrupt files.

    1. Close Blizzard processes.
      1. Press Ctrl + Shift + Esc to bring up the Task Manager.
      2. Click the Processes tab.
      3. Select all Agent, Blizzard Battle.net desktop app, and game processes, and click End Process.
    2. Navigate to the folder containing the Battle.net directory:
      1. Press Windows Key + R to open the Run dialogue.
      2. Type C:\ProgramData\ into the Open field and press Enter.
    3. Delete the Battle.net folder.
    4. Run Battle.net and update the game to see if the issue persists.
    If the error persists after you try these steps, another program may be causing the problem. Restart your computer and delete the Battle.net folder one more time.
    Note: The above steps may cause the Blizzard Battle.net desktop app to forget game install locations. If your games can’t be found, you will see Install on the Blizzard Battle.net desktop app game tab instead of Play. To find your installation, click Locate this game or run the game launcher.
Read More
A Quick Guide to Fixing Error Code 17

Error Code 17 - What is it?

Code 17 is a typical Spotify error code. Spotify is a music streaming service. Through this software, PC users can browse songs and search by artist, album, and playlist. Simply put, it is an audio player available for BlackBerry, iOS, and Microsoft Windows desktop. You may experience error code 17 if the process fails when downloading Spotify from the internet. The error message is displayed in any one of the following formats:
Error 17: Spotify has encountered a problem and needs to close. We are sorry for the inconvenience. Spotify could not be started (Error code 17)
Some of the symptoms of this error code are program crash, slow Windows performance, and periodic system freeze.

Solution

Restoro box imageError Causes

Error 17 may be triggered by several reasons such as:
  • Viral infection
  • Incomplete installation of Spotify software
  • Corrupt download
  • Registry corruption
  • Windows Installer service terminated
To use the audio player Spotify successfully on your PC, it is advisable to fix error 17 right away on your system. Delay may cause inconvenience and limit your access to your desired program.

Further Information and Manual Repair

To repair this error code on your PC, you don’t have to hire a professional or be a technical whiz yourself. The good news is that this error is quite easy to fix. You don’t need to be technically sound to resolve it. Here are some proven methods for you to fix error code 17 on your system. So let’s get started:

Method 1 - Make sure that the Windows Installer is running

Sometimes Spotify error 17 may occur if the Windows Installer service is terminated. Therefore before you download, make sure the Windows Installer is running. This is a good way to ensure the error code 17 messages don’t pop up on your PC again. For this here’s what you need to do, first quit all programs. Now go to the start menu and in the search box type RUN, and press enter. In the Open Box, type msiexec /unregister and then press OK to confirm. After that, perform the same steps again, and now in the Open Box type msiexec /regserver and press OK to save. Reboot your PC and try downloading Spotify again. If the program successfully downloads on your system, then this means error 17 is resolved. However, if the error code still persists, then try other methods given below.

Method 2 - Use System Restore to Undo Recent Changes

Another reason for the cause of error 17 is the improper or incomplete installation of Spotify. Improper installations can configure settings and also leave bad entries in the registries. To resolve, use System Restore utility built-in Windows. By using this system tool, you can undo recent changes and resume your computer to its previous condition as it was before the proper installation was attempted. To do this, go to the start menu, then in the search box type System Restore and press enter. Go to System Restore and choose a restore point. Once you’ve selected the point, reboot your PC to activate changes.

Method 3 - Remove Viruses

Viruses can enter and damage your PC if you download software programs from unknown websites. These not only damage your PC but also hinder your ability to install desired programs successfully in this case audio player Spotify. In such an event, simply use an antivirus to remove all viruses infecting your system. After they are removed, make sure you download and install Spotify software from a trusted website.

Method 4 - Repair the Registry

Another cause of error 17 is registry corruption. This occurs due to bad entries, invalid and junk files saved in the registry. To fix the corrupt registry simply download Restoro. This is a user-friendly PC Fixer embedded with a powerful registry cleaner. This software is compatible with all Windows versions. The registry cleaner detects all registry issues, removes all file corrupting the registry, and cleans it immediately in just a few clicks. Click here to download Restoro on your PC and resolve Error 17.
Read More
Where can you get computer viruses & malware
From their infant stages to modern days, computer viruses were always kind of here. From simple ones that were annoying with playing speaker sounds and throwing messages on screen to more malicious ones capable of deleting and encrypting files. In today's modern world it is very important to protect yourself, modern viruses are not a joke anymore and they are aimed to create serious damage to computer systems. Where can you get computer viruses & malwareThey can encrypt files in order to make you pay for a decrypter, they can straight up delete files or even cause some hardware damage. Like mentioned before protecting yourself is important, but protecting does not mean only having antivirus software installed, information, where are common places in which they lurk and could be picked up, is also very important. That is why we are exploring in this article the most common place where you can pick viruses or other malware.

Downloading Programs

Programs that contain the downloadable files are the commonest source of malware such as freeware, worms, and other executable files. Whether you download an image editing software, a music file, or an e-book, it is important to ensure the reliability of the source of the media. Unknown, new, or less popular sources should be avoided.

Pirated or Cracked Software

Are you aware of software cracking? Well, every time you open cracked software, your antivirus software might flag it as malware as the cracks consist of malicious scripts. Always say “No” to cracks as they can inject malicious script into your PC.

Email Attachments

Anyone can send you an email attachment whether you know them or not. Clicking on unknown links or attachments can harm your device. Think twice before clicking anything and make sure that file type is not ‘.exe’.

Internet

One of the easiest ways to get a virus on your device is through the Internet. Make sure to check the URL before accessing any website. For a secured URL always look for ‘HTTPS in it. For example, when you click videos published on social media websites, they may require you to install a particular type of plug-in to watch that video. But in reality, these plug-ins might be malicious software that can steal your sensitive information.

Booting Data from Unknown CDs

Malicious software can get into your device through an unknown CD. A good practice to be safe from malicious infection is to remove CD when your device is not working at all. Your system could reboot the CD if it is not removed before switching off the computer.

Bluetooth

Bluetooth transfers can also infect your system, so it is crucial to know what type of media file is being sent to your computer whenever a transfer takes place. An effective armor would be to allow Bluetooth connectivity with only known devices and activate it only when required.

Unpatched Software

Often overlooked, unpatched software is also a leading source of virus infection. Security holes in software are exploited by attackers and are unknown to software makers until the attackers release them in the form of zero-day attacks. It is therefore recommended to install software updates as soon as they are available on your PC.
Read More
An Easy Guide to Fixing Internal Error 2503

Internal Error 2503 - What is it?

Internal Error 2503 mostly pops up on Windows 8. It occurs when you try to uninstall or install software on Windows 8. The error code message may vary and displayed in different formats such as:
The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2503. Called RunScript when not marked in progress The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2503. Called Install Finalize when no installation is in progress

Solution

Restoro box imageError Causes

Some of the most common causes for internal error 2503 are:
  • Permission not granted to access the Windows Installer Folder
  • Viruses
  • Problems with Windows Installer

Further Information and Manual Repair

To repair this issue on your PC without any professional assistance, try the DIY methods given below:

Method 1

Internal error 2503 may occur when your account has limited privileges. You don’t have the privilege to use or access the Windows Installer folder. Your inability to access this folder hampers you from successfully install or uninstall the desired program on your PC. To gain access, you need to ensure you have permission.
  • For this navigate to the C:\windows folder. Here find the installer folder and then right-click and choose properties.
  • After that click on the security tab and check if the System and Administrator account has Full access permission.
  • For that make sure the system group option has ‘all’ selected to allow you full permission.

Method 2 - Re-register Windows Installer

Another alternative to resolve internal error 2503 is to re-register Windows Installer.
  • To do this, go to Start and click Run. Now type ‘msiexec /unreg’ in the Run box and then press enter.
  • Follow the same steps and now type ‘msiexec /regserver’ in the box and then press enter. This will resolve the issue.

Method 3 - Remove Viruses

If internal error 2503 is triggered by a viral infection on your PC, then it is advisable to download an antivirus and scan your entire system. Viruses are notorious for system failures and pose data security threats. If not removed timely, these malicious programs can damage your PC. To remove all viruses on your system, run an antivirus. An antivirus detects all malicious software programs including viruses, malware, adware, and spyware. Delete all the malicious files found right away. This will help resolve internal error 2503.
Read More
Android malware spies while posing as a Update
New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities. However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."

What happens when malicious software is installed

"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:
  • Stealing instant messenger messages;
  • Stealing instant messenger database files (if the root is available);
  • Inspecting the default browser's bookmarks and searches;
  • Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
  • Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
  • Inspecting the clipboard data;
  • Inspecting the content of the notifications;
  • Recording audio;
  • Recording phone calls;
  • Periodically take pictures (either through the front or back cameras);
  • Listing of the installed applications;
  • Stealing images and videos;
  • Monitoring the GPS location;
  • Stealing SMS messages;
  • Stealing phone contacts;
  • Stealing call logs;
  • Exfiltrating device information (e.g., installed applications, device name, storage stats).

How does it work?

Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed. "Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said. "The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."

Camouflage

The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.
Read More
1 2 3 171
Logo
Copyright © 2023, ErrorTools. All Rights Reserved
Trademark: Microsoft Windows logos are registered trademarks of Microsoft. Disclaimer: ErrorTools.com is not affiliated with Microsoft, nor claims direct affiliation.
The information on this page is provided for information purposes only.
DMCA.com Protection Status