Turn On/Off and Clear Windows Clipboard

There are times when we delete a system files without meaning to on your Windows 10 computer. This happens a lot for users sometimes mistake a system file for a malware-laden file or junk file when it’s actually a system file from the System32 or SysWOW64 folder. In such cases, it could affect your computer. For instance, you might not be able to reboot your PC or open Settings. If you have removed system files from any of these folders by accident and you desperately want to restore them, read on, as this post will guide you in resolving the problem. Restoring them isn’t actually hard, just make sure that you have system admin access. The good thing is that there exists Windows Resource Protection which protects registry keys and folders and even critical system files. So if there are any detected changes to a protected system file, the modified file is restored from a cached copy located in the Windows folder. However, if the Windows Resource Protection program fails to restore these files, you need to check out the given fixes below.

Option 1 – Run System File Checker scan

To restore the system files you deleted, you can try running System File Checker or SFC scan. System File Checker is a command utility built into your computer that helps restore corrupted files and missing files. Refer to the following steps to run it:

• Boot your PC into Safe Mode.
• Hit the Win + R keys to launch Run.
• Type in cmd in the field and tap Enter.
• After opening Command Prompt, type in sfc /scannow

The command will start a system scan which will take a few while before it finishes. Once it’s done, you could get the following results:

1. Windows Resource Protection did not find any integrity violations.
2. Windows Resource Protection found corrupt files and successfully repaired them.
3. Windows Resource Protection found corrupt files but was unable to fix some of them.

• Reboot your computer.

Option 2 – Try to run the DISM tool

Aside from System File Checker, you can also run the DISM or Deployment Imaging and Servicing Management Tool as it could help in restoring the system files on your Windows 10 computer. Using this built-in tool, you have various options such as the “/ScanHealth”, “/CheckHealth”, and “/RestoreHealth” which could help you resolve the problem.

• Open the Command Prompt with admin privileges.
• Then type in the following commands and make sure to hit Enter right after you type each one of them:
  • Dism /Online /Cleanup-Image /CheckHealth
  • Dism /Online /Cleanup-Image /ScanHealth
  • exe /Online /Cleanup-image /Restorehealth
• Do not close the window if the process takes a while as it will probably take a few minutes to finish.

Option 3 – Try performing a System Restore

Running System Restore can also help you bring back the system files. You can do this option either by booting into Safe Mode or in System Restore. If you are already in the Advanced Startup Options, just directly select System Restore and proceed with the next steps. And if you have just booted your PC into Safe Mode, refer to the steps below.

• Tap the Win + R keys to open the Run dialog box.
• After that, type in “sysdm.cpl” in the field and tap Enter.
• Next, go to the System Protection tab then click the System Restore button. This will open a new window where you have to select your preferred System Restore point.
• After that, follow the on-screen instructions to finish the process and then restart your computer and check if the problem is fixed or not.

Option 4 – Try to run Automatic or Startup Repair

Startup Repair, previously known as Automatic Repair, is an advanced tool in Windows that can help you diagnose various system issues, including this one. This tool will scan system files, configuration settings, registry settings, and so on in order to fix the problem on its own. To run Startup Repair, all you have to do is boot into the Advanced Startup Options and then go to Troubleshoot > Advanced option > Startup Repair and then run it. This will resolve the problem if you have deleted any system file that’s essential to your Windows 10 PC.

Option 5 – Reset your computer

• Tap the Win key or click on the Start button located in the Taskbar.
• Then click on the Power button at the bottom right portion of the screen.
• Next, press and hold the Shift key on your keyboard and then click on Restart. This will restart your Pc into the Advanced Startup options.

Note: Once you have access to the Advanced Startup options, you have to go to the setting which allows you to Reset your Windows 10 PC. All you have to do is select Troubleshoot > Reset this PC to reach the following screen Afterward, select either the “Keep my files” option and then proceed to the next on-screen instructions that follow to reset your Windows 10 computer without losing your files.

What is 0x0000007E?

 Error 0x0000007E is a Windows Stop error message that is displayed on a blue screen. This may appear when browsing the internet, listening to music on some media player application or while working on an important document on MS Word or Excel.  This message strikes terror as the screen goes blue without any warning.

Solution

Error Causes

The error code 0x0000007E is triggered because of:

• Faulty hard drive
• When the hard drive is full and there is no storage space
• When you need to update your BIOS (Basis Input Output System)

Further Information and Manual Repair

If you experience this error on your PC, you don’t have to panic and call a professional. This error is rated as an easy fix. And you can easily resolve the issue even if you don’t have a piece of strong technical knowledge about computers. Here are some quick fixes to repair the error 0x0000007E on your PC in the shortest time and without any hassle:

• Cause: Faulty Hard Drive

Solution: In the event of a faulty hard drive, it is best to create a backup of all your data and get a new hard drive. However, first, it is advisable to use the Windows tool called Chkdsk (Check Disk) to identify and determine if the hard drive is faulty or not. To do so, click on the start menu and type CMD into the search box. Click on it to run. Now a black box will be displayed on the screen, simply type the command Chkdsk and run it to find out if your hard drive is faulty and damaged. If so, then get a new hard drive.

• Cause: Hard Drive is full

Solution: Error 0x0000007E may also occur if the hard drive is full. To check the storage space on your hard drive, go to My Computer. If the space is full, then it is advisable to delete some files or uninstall heavy and recently installed programs to free up some space.

• Cause:  BIOS not updated

Solution: You may come across this blue screen error if your BIOS is not updated. To update your BIOS, restart your computer and press F2 to enter setup.  Now go to SATA Operation and change RAID AHCI to RAID ATA. Save changes and then exit. By doing so, you can update your BIOS and fix the error 0x0000007E immediately. It’s that easy!

Microsoft Designer, a new application developed by Microsoft will bring design backed with DALL-E 2, an AI image creation open-source software. The new app is shown as a dedicated graphic design tool that will help you in the creation of stunning social media posts, invitations, digital postcards, graphics, and more, all in a flash.

Use of the application will be by typing headings and then typing text into the prompt to generate a background image. Since Microsoft uses DALL-E 2 for image creation output should be fairly good but if you wish you will be able to use your own images instead of using AI to generate one.

The designer will be a free application once it is ready and it already has a web preview version, also free but with a waitlist. There will be premium features inside the app once it is released that will be available to Microsoft 365 Personal and Family subscribers. Microsoft also wants to add a version of a designer directly to the Edge browser as well.

As you know, the Office Language Packs need to be installed right after installing Office. It also has to be on the correct version of Office so if any of these conditions are not met, you will most likely get error codes 30053-4 or 30053-39 when you install a language pack in Microsoft Office. If you are currently facing this error, read on as this post will help you fix the problem. Here’s the full context of the error message:

“Something went wrong, Sorry, installation cannot continue because no compatible office products are detected.”

When you have to work on two different languages, that’s where the language packs come in handy. You might have to work on one language but when it comes to proofreading or help, you need another language. Note that some language accessory packs offer partial localization which is why some parts of the Office might show the default language. If you are using Office 365 or Office 2019, 2016, 2013, or 2010, you need to go to the language accessory pack page from office.com and select your language. Once you see the download link, click on it to start downloading the pack. It includes the display in the chosen language, proofing tools for the selected language, as well as the Help in the selected language. Once the installation is complete, follow each one of the given options below to configure the language accessory pack properly.

Option 1 – Select Editing and Proofing language

• You need to open any Office program and navigate to File > Options > Language.
• From there, you need to make sure that the language you want to use is in the list under the Choose Editing Languages section.
• After that, you can add or remove the language that Office uses for editing and proofing tools.

Option 2 – Configure the Display and Help languages

In this option, you can change the default display and help languages for all the Office applications so whatever you choose will be used for all the buttons, menus, and support of all the programs. After you select the language, restart all the Office applications to apply the changes made successfully. On the other hand, if you are using Office volume license versions, note that only an administrator account can install this if you are using the Volume License version of Microsoft Office 2016. You have to download the ISO image of the language packs, language interface packs, and the proofing tools from the VLSC or Volume Licensing Service Center. This process can be quite complicated so you might have to go to the docs.microsoft.com page to be guided accordingly. After you installed everything correctly, the error code 30053-4 or 30053-39 should now be fixed.

A new update to popular Microsoft PowerToys has brought a few new features that are aimed at speeding up the workflow. The first new feature that was slid in is Always on top utility. With this cool utility, you can keep the window as the name suggests, always on top of other windows. To enable this cool feature all you have to do is press the key combination of ⊞ WINDOWS + CTRL + T and an active window will be now always on top of all other windows. To reverse and unlock this window from being always on top just press key combination again. A second new feature is a really great one and my favorite thing to happen in power toys. Often we are making the search in our browsers to find stuff, things, maybe some explanations, information, etc. The newest update in power toys brings this to a whole new dimension. While you are on PC you just simply need to type ?? followed by questions like: ?? When doctor strange 2 is coming out and that will launch your default browser with your chosen search engine and provide you with the answer. Third and final thing is G-code support in the file explorer preview pane and thumbnails, meaning that if you work with CNC equipment you can now have a thumbnail preview of the code itself inside File Explorer. And that’s it for now, thank you for coming and reading, Take care and I hope to see you next time.

As you know, both the Windows Update and Windows Store are inter-dependable services in Windows 10 operating system. So when one of these services encounters an error like the “0x80070424, ERROR_SERVICE_DOES_NOT_EXIST”, the other service will most likely get this error as well. Note that this kind of error can occur to both the Windows Update Standalone Installer and to the Windows Update section in the Windows 10 Settings app. Some users also reported getting this error while trying to update Windows Defender as well. You can see the following error message in the Windows Update Standalone Installer:

“Installer encountered an error: 0x80070424, The specified service does not exist as an installed service.”

While you’ll see the following error message in the Windows Store:

“The were some problems installing updates, but we’ll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x80070424).”

To fix this error, you can try to re-register the Background Intelligent Transfer Service DLL file or run the Windows Update and Store apps troubleshooters. You can also reset the Windows Update-related folders or the Microsoft Store or fix the Windows Update files by using the DISM tool. On the other hand, you can also use the Registry Editor or check Windows Services. For more details regarding these potential fixes, refer to each one of the given options below.

Option 1 – Try to re-register the Background Intelligent Transfer Service DLL file

You may have to re-register the Background Intelligent Transfer Service DLL file using the regsvr32.exe before you can successfully install the program and fix ntdll.dll file crash error. The Regsvr32 tool is a command-line utility that can be used to register and un-register OLE controls as DLL and ActiveX (OCX) controls in the Windows operating system. Follow the steps below to use it.

• Open Command Prompt as admin from the WinX menu.
• Next, type the following commands in the elevated Command Prompt and hit Enter to execute the command. This will re-register the affected DLL file using the Windows operating system tool, regsvr32.exe.
  • regsvr32 Qmgr.dll /s
  • regsvr32 Qmgrprxy.dll /s

Note: Replace “[DLL file]” with the name of the DLL file that was pointed out in the error.

• After you execute the given commands, you should see a message saying, “DllRegisterServer in vbscript.dll succeeded” if the Regsvr32 tool was able to run successfully.
• Now restart your computer and check if the error is now fixed.

Option 2 – Try to run the Windows Store or the Windows Update Troubleshooters

The Windows 10 Store Apps Troubleshooter will help you in fixing the Error code 0x80070424. This is a great built-in tool from Microsoft that helps users fix any app installation issues. So this is worth a try to solve the problem. This built-in tool also helps you fix the Windows 10 Store if it isn’t working. To use the Windows Store Troubleshooter, follow the steps below.

• Tap Win + I keys again to open the Windows Settings panel.
• Go to Update & Security and then go to Troubleshoot.
• On your right hand side, scroll down to find the Windows Store Apps and then click on Run the troubleshooter option and see if it fixes the problem.

Note: You can also try running the Windows Update troubleshooter to fix the error. You can run it under the Windows Update section of Update & Security.

Option 3 – Delete the files from Software Distribution Folder & Catroot2 folders

The downloaded Windows Updates are placed in a folder called “SoftwareDistribution”. The files downloaded in this folder are automatically deleted once the installation is completed. However, if the files are not clean up or if the installation is still pending, you can delete all the files in this folder after you pause the Windows Update service. For complete instructions, refer to these steps.

• Open the WinX Menu.
• From there, open Command Prompt as admin.
• Then type in the following command – don’t forget to hit Enter right after typing each one of them.

net stop wuauserv net start cryptSvc net start bits net start msiserver

• After entering these commands, it will stop the Windows Update Service, Background Intelligent Transfer Service (BITS), Cryptographic and the MSI Installer
• Next, got to the C:WindowsSoftwareDistribution folder and get rid of all the folders and files there by tapping the Ctrl + A keys to select them all and then click on Delete. Note that if the files are in use, you won’t be able to delete them.

After resetting the SoftwareDistribution folder, you need to reset the Catroot2 folder to restart the services you just stopped. To do that, follow these steps:

• Type each one of the following commands.

net start wuauserv net start cryptSvc net start bits net start msiserver

• After that, exit Command Prompt and restart your computer and then try to run Windows Update once more.

Option 4 – Try to reset the Microsoft Store cache

Just like browsers, Microsoft Store also caches as you view apps and games so it is most likely that the cache is no longer valid and must be removed. To do so, follow the steps below.

• Right click on the start button and click on Command Prompt (administrator).
• Next, type in the command, “wsreset.exe” and tap Enter. Once you do, the command will clear the cache for the Windows Store app.
• Now restart your PC and afterwards, try opening Microsoft Store again and then see if Error Code 0x80070424 is resolved or not.

Option 5 – Try to check the Windows Update or WU setting in the Registry

• Tap the Win + R keys to open the Run utility and type “regedit” in the field and tap Enter to open the Registry Editor.
• Next, go to this registry path: ComputerHKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
• Here, look for the DWORD named “DisableWindowsUpdateAccess” and double click on it and then set its value data to “0”.
• Exit the Registry Editor once you’re done and restart your computer.

Option 6 – Try to check the status of some Windows Update Services

• Tap the Win + R keys to open the Run dialog box.
• Next, type “services.msc” in the field and hit Enter or click OK to open Services.
• From the list of Services, look for the following services and make sure that their Startup type is as follows:
  • Windows Update Service – Manual (Triggered)
  • Background Intelligent Transfer Service – Manual
  • Workstation Service – Automatic
• After that, check if the Service status of the listed services above are set to Running. If they’re not, click on the Start button to start these services and then check if you can now enable the Windows Update service or not.

Option 7 – Run the DISM tool

You can also run the Deployment Imaging and Servicing Management or DISM tool to fix the error code 0x80070424. Using this built-in tool, you have various options such as the “/ScanHealth”, “/CheckHealth”, and “/RestoreHealth”.

• Open the Command Prompt with admin privileges.
• Then type in the following commands and make sure to hit Enter right after you type each one of them:
  • Dism /Online /Cleanup-Image /CheckHealth
  • Dism /Online /Cleanup-Image /ScanHealth
  • exe /Online /Cleanup-image /Restorehealth
• Do not close the window if the process takes a while as it will probably take a few minutes to finish.
• Once it’s done, reboot your computer and check if it has fixed the error.

Error Fmod.dll - What is it?

This is a type of DLL error code. DLL is the abbreviation of Dynamic Link Library. DLL files contain small programs which are similar to executable files. One DLL file may be used to load and run several programs. Fmod.dll is created by Electronic Arts Inc. and associated with Crysis. This file is developed for the Windows OS. This error code occurs when you are unable to access, run and load programs supported by Crysis on your PC. Fmod.dll error code message is displayed in different formats such as:

• "Fmod_event.dll not found."
• "The file fmod_event.dll is missing."
• "This application failed to start because fmod_event.dll was not found. Re-installing the application may fix this problem."
• "Cannot start Crysis. A required component is missing: fmod_event.dll. Please install Crysis again."
• "Fmod_event.dll Access Violation."
• "Cannot register fmod_event.dll."
• "Cannot find C:\Windows\System32\fmod_event.dll."

Error Fmod.dll may pop up when you start-up or shut down the PC or even during the installation of a program.

Solution

Error Causes

Narrowing down to one cause for Fmod.dll error code is impossible virtually because this error may result due to different reasons on your system. Some of the common causes associated with this error code are:

• Viral Infection
• Hardware failure
• Missing, Corrupt, or Deleted Fmod.dll file
• Improper program installation
• Registry issues

No matter what the underlying cause of the reason may be, it is recommended to resolve the issue immediately to avoid serious PC threats.

Further Information and Manual Repair

To resolve this error on your system, try the methods discussed below:

Method 1 - Check the Recycle Bin

As mentioned above, Fmod.dll is a DLL file that is used to run and load a variety of programs on your system. There is a possibility that you uninstalled a program that was supported by the Fmod.dll file and accidentally deleted it. In such a scenario, the easiest way to resolve the Fmod.dll error code is to re-install the deleted file from the recycle bin. For this, go to the recycle bin and search for the file. If you find it reinstall if you can’t then simply download the Fmod.dll file from a reliable website.

Method 2 - Scan for Malware

Malware usually enters through phishing emails and downloads. These malicious programs then hide in your system disguising as either DLL or EXE files. The occurrence of fmod.dll file error may be due to malicious programs hiding in your system. Therefore scan your entire PC with a powerful anti-virus. An antivirus detects and removes all malicious software programs such as viruses, malware, Trojans, spyware, and adware. Try this, to resolve error code Fmod.dll and see the results.

Method 3 - Fix Hardware Problems

Fmod.dll file error may also pop on your screen due to hardware failure. If this is the reason, then we advise you to use the Device Manager an in-built tool in Windows 7 and 8 to fix hardware failures. For this go to the start menu then control panel. Now click on the ‘hardware and sound link’ and then click on the Device Manager. If you find any devices in red exclamation point, then this means this device is problematic. Uninstall the driver for that hardware device and then update the driver. Install the latest version to resolve. Remember, hardware problems are mostly related to outdated drivers.

Method 4 - Restore Points

Use System Restore, an in-built utility also known as the recovery tool, to restore points and ensure your PC is back to its previous working condition before the error code occurred. Simply put, it helps undo recent changes. You can find the System Restore tool in the System Tools folder.

Method 5 - Clean and Repair the Registry

The registry is that part of your PC that stores all the information, activities performed, and files including the junk files, invalid keys, bad entries, and cookies. When these files accumulate on your PC, they take up all the registry space and corrupt the important system and DLL files also stored in the registry, thereby generating such errors. Now you can clean the registry manually. But this process can be time-consuming and slightly technical, hence we advise you to download Restoro. This is a PC Fixer integrated with a registry cleaner. It is easy to use deployed with an intuitive interface. The registry cleaner scans the entire PC and removes all registry errors. It wipes out all the obsolete files and repairs the damaged DLL and system files. Click here to download Restoro.

Hello and welcome everyone, today we will be talking about dreaded keyloggers, why they are dangerous, and how to know if you might have one in your system. Keylogger is a malicious application placed in your system and hidden with only one goal in mind, to get information about what are you typing and by that means for a person who infected you to get information about your credit card information or other sensitive data. They can be introduced into your systems in various ways and often can not be detected easily. Modern antivirus applications have ways of detecting them and removing but this tutorial aims to teach you how to spot them all by yourself since new keyloggers are produced daily and sometimes relying on antivirus alone is not enough. Unlike viruses and trojans, keyloggers are not heavy on system resources and you will not feel slow down on your computer if you have one which makes them harder to sport with regular work. Some of them can be even tracking you on the website and not even be physically present on your computer. Generally, we could categorize keylogger into 4 categories:

1. Web browser-based keylogger. Some websites would have CSS scripts, input web forms, or so-called man in the middle keylogger. Lucky for us even Windows defenders with the latest update can detect this type of keylogger and successfully deal with it and how keylogger itself is not present on our system we are safe.
2. General spyware keylogger. This keylogger is present in your system, usually, it infected it via email attachment, social media download, torrent download, some malicious so-called fixer application, etc. Most antivirus applications and windows defenders can detect these types as well and remove them successfully.
3. Kernel-level keylogger. This keylogger is a more dangerous type they tend to operate underneath Windows as a rootkit and can go undetected by antivirus and windows defenders.
4. Hypervisor-based keylogger. This is the most dangerous keylogger, they use virtualization techniques to hide and mask themselves as a replica of the operating system and they scan all keystrokes by the user. These are very rare keyloggers but they do exist.

If you suspect that you have a keylogger or just want to check your system for precaution reasons follow these tips and guides and luckily you will solve your issue in no time and your data will be safe.

1. Use Task Manager to find suspicious entries.

   Task manager is a great application implemented in Windows that is constantly monitoring and showing all services, applications, and processes currently running on your system and thus a great tool to monitor your system if you know how to use it. First, open task manager by pressing CTRL + SHIFT + ESC Then take a good look into it, try to find suspicious names, probably duplicate of running application, something like Windows logon application, or keylog or anything similar which seems out of ordinary. If you manage to find a suspicious running application right-click on it and close it. Also while you are in task manager jump into the startup tab and check to see are there some unusual applications starting with your Windows, if you find anything, disable it right away. This is the most simple and quickest way to get some information right away if you suspect to have some simpler keylogger in your system.

2. Use the command prompt to monitor your network.

   In order to check connections to your computer and find potential suspicious ones start the command prompt in administrator mode, press ⊞ Win + X, and choose command prompt (administrator). type in netstat -b and press ENTER. All website and application connections to your computer are now visible. ignore svchost, edge browser, windows store, etc ad check the IP of the remaining ones using the internet.

3. Use keystroke encryption.

   Install encrypting software and even if you have a keylogger, the application will encrypt each stroke and all that attacker will get is gibberish

Please remember to always download files from trusted sources, do not open unknown emails, and do not share your information publicly. Take common protection steps in order to protect yourself in the digital world.

Windows 10 is undeniably one of the great operating systems and the same thing can be said about a lot of computers that are running it. However, there are instances when things don’t go as you expect them to be. One of the many issues you might face when using Windows 10 is the inability to upload any pictures over the web. If you are facing this issue right now, you are not alone for a lot of users have suffered from the same problem at least once. Even though it might seem like a minor problem, some users find it inconvenient especially the ones who often upload pictures online. Worry not though for this post will guide you on what you can do if you aren’t able to upload any images to websites on your Windows 10 computer. To get started in troubleshooting the problem, here are some suggestions that might help:

Option 1 – Try to clear browser cache and try downloading again

There are times when some data in the browser is conflicting with the loading of the website and triggers some problems like not being able to upload pictures to websites. And so you can try to clear your browser’s data. This might be a very basic solution but oftentimes it works in fixing this kind of odd problem in your browser.

Option 2 – Open your browser in Incognito Mode

The next thing you can do to fix the problem is to try opening the web page in Incognito Mode. When your browser is in this mode, it will work without extensions. This would help in fixing the problem especially if it was caused by some extension or toolbar in your browser. All you have to do is open any web page in Chrome and tap the Ctrl + Shift + N key combination to open a window in Incognito Mode.

Option 3 – Try to disable and get rid of the problematic extension

The next thing you can do after trying the Incognito mode in your browser is to see if a browser extension is the one that’s causing the problem. And if you have installed a lot of browser extensions, then identifying which one is the culprit may take a while but not too long. Once you’ve identified the culprit, you can get rid of that browser extension and see if you can now upload pictures on websites.

Option 4 – Try to reset your browser

You might also want to reset your browser as it could also help in resolving the issue. To reset your browser, here’s what you have to do:

Google Chrome

• Open Google Chrome, then tap the Alt + F keys.
• After that, click on Settings.
• Next, scroll down until you see the Advanced option, once you see it, click on it.
• After clicking the Advanced option, go to the “Restore and clean up option and click on the “Restore settings to their original defaults” option to reset Google Chrome.
• Now restart Google Chrome.

Mozilla Firefox

• Open Mozilla Firefox and tap Ctrl + Shift + A to access the Add-ons Manager.
• In the Extensions, menu Remove the unwanted extension.
• Restart the browser and tap keys Alt + T.
• Select Options and then move to the General menu.
• Overwrite the URL in the Home Page section and then restart the browser.

Internet Explorer

• Launch Internet Explorer.
• Next, click the wrench icon for Settings.
• Then click Internet Options.
• After that, go to the Advanced tab.
• From there, click the Reset button. This will reset Internet Explorer’s settings to their default condition.
• Now click OK to save the changes made.
• Restart your computer.

Option 5 – Update your browser or switch to another one

The last option you can try is to update your browser. You can do it by checking for any available updates from its official site and then install it. However, if updating the browser did not help, you might want to consider switching to another browser.

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities. However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."

What happens when malicious software is installed

"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:

• Stealing instant messenger messages;
• Stealing instant messenger database files (if the root is available);
• Inspecting the default browser's bookmarks and searches;
• Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
• Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
• Inspecting the clipboard data;
• Inspecting the content of the notifications;
• Recording audio;
• Recording phone calls;
• Periodically take pictures (either through the front or back cameras);
• Listing of the installed applications;
• Stealing images and videos;
• Monitoring the GPS location;
• Stealing SMS messages;
• Stealing phone contacts;
• Stealing call logs;
• Exfiltrating device information (e.g., installed applications, device name, storage stats).

How does it work?

Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed. "Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said. "The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."

Camouflage

The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.