Task Manager is blank & not showing processes

For a while now, Microsoft has been working hard to add various built-in troubleshooters in Windows 10. In fact, there is a troubleshooter for almost every standard or common error in Windows 10. And now with the newly released Windows 10 v1903, Microsoft has added the Recommended Troubleshooting which allows Windows 10 to automatically fix a lot of critical issues on your computer, and in this post, you will be guided on how you can turn on or off the Recommended Troubleshooting in Windows 10. The Microsoft Diagnostic & Feedback data only provides two settings – Basic and Full. So if you want to turn off the Recommended Troubleshooting for some reason, the only way to do so is to stop it from collecting complete data from your PC. And to turn it on or off, you can choose to switch between them. To do that, navigate to Settings > Privacy > Diagnostics & feedback and from there, select Basic under the Diagnostic Data section. After that, go back to Settings and go to Update & security > Troubleshoot. Once you’re there, you should see a warning message saying, “Share Full Diagnostic data to get additional troubleshooting recommendations”. Based on the message, Microsoft will only offer the recommended troubleshooting based on the Full Diagnostic data which it collects from your computer. On the other hand, if you know how to navigate and use the Windows Registry, then you can enable or disable the Recommended Troubleshooting via Registry Editor but before you proceed, make sure that you create a System Restore point. Once that’s covered, follow these steps:

• Tap the Win + R keys to open the Run dialog box and type “regedit” in the field and tap Enter to open the Registry Editor.
• Next, navigate to this registry path: HKEY_LOCAL_MACHINESOFTWAREMicrosoft
• From there, look for the key named “WindowsMigration”. If you can’t find it, just right-click on the left pane and create a new key and then name it “WindowsMigration”.
• After that, create a DWORD “UserPreference” and double click on it to set its value to “0” if you want to turn it off or “1” if you want to turn it on.
• Exit the Registry Editor and restart your computer to apply the changes made.

Note: The Recommended Troubleshooting functionality can look into the error logs sent back to the Microsoft team and use an algorithm to set up a solution for you and they’re nothing but Diagnostics and Feedback data that Windows collects and sends back to Microsoft. Moreover, the recommendations are only visible if you are connected to the internet, else it will show the same message.

When you get an igfxem.exe error in Windows, it is not really clear what does this means, usually, Windows throw us some code or we get a DLL error, rarely we get an EXE error. So what does this error means? Intel Graphics Executable Main Module, shortly called as IgfxEM module is a part of the Windows operating system. When you run Microsoft .NET Framework applications that use the AS/400 Data Queue ActiveX control (Mseigdq.dll) to read from and to write to IBM iSeries (AS/400) data queues, you may experience this error. In order to overcome this error and cope with it try the following things:

1. Increase Virtual Memory

   Go to the Start Menu and click on Settings. Type performance. Choose Adjust the appearance and performance of Windows. In the new window, go to the Advanced tab and under the Virtual memory section, click on Change. At the bottom of the new window, check what the Recommended value is and how it compares to Currently allocated. If the current setting is significantly less than the recommended, uncheck the Automatically manage paging file size for all drives box at the top of the same windows and then click on Custom size. Enter the Recommended value in the Initial Size box, and a larger figure in the Maximum size box. Click OK to save the new settings.

2. Download and update .NET framework

   Go to the Microsoft website and download the latest .NET framework. Once the download is complete, install the package following onscreen instructions.

3. Reinstall INTEL graphic drivers

   Go to the intel website and download the latest graphic drivers for your graphic card model. Once the download is complete, install the package following onscreen instructions.

4. Run SCF scan

   If all else fails, run command prompt and inside type sfc /scannow

If you got an error message saying, “Folder Redirection Failed, Failed to build the list of regular subfolders, Access is Denied” after you configured a new Group Policy Object or GPO which redirects User folders to a new network share or when you click on Reset default location under the Windows File Explorer or Folder Options, then you’ve come to the right place as this post will show you how to resolve this kind of error on your Windows 10 computer. Follow the given options below carefully to fix the “Folder Redirection Failed” error.

Option 1 – Take Ownership of the folder

If you are not able to access the folder could be one of the reasons why you’re getting the “Folder Redirection Failed” error and so you need to take ownership of the folder to resolve the problem. Before you proceed, make sure that your account is an admin account.

• First, locate the concerned folder and right-click on it then select Properties.
• Next, click on the Edit button in the Properties window and click OK to confirm if you got a User Account Control elevation request.
• After that, select user/group from the permission windows or click on the Add button to add another user or group. It would be best if you add “Everyone” to give permission.
• Then check “Full Control” under the “Allow” column to assign full access rights control permissions.
• Now edit the permission to Full Control for “Everyone”.
• Click OK to save the changes made and then exit.

Option 2 – Try to add Authenticated Users or Domain Computers

Make sure that the Folder Redirection group policy removal option is set to “Redirect the folder back to the user profile location when the policy is removed” when using the Folder Redirection. After that, you have to add Authenticated Users group with the “Read” permissions on the Group Policy Objects or GPOs. And if the Domain computers are part of the group of “Authenticated Users”. Note that by default, the “Authenticated Users” have these permissions on any new Group Policy Objects or GPOs. Once again, you have to add just “Read” permissions and not “Apply Group Policy” for “Authenticated Users”. Furthermore, to fix the “Failed to build the list of regular subfolders” errors, here are some options that could help.

Option a – Try to clear disk space

You might have to check if your disk is running out of space because if it is, then it will fail to create a list abruptly. And so you need to free up some disk space. You can either check on the files manually especially if you tend to keep your files at random places in your disk drive.

Option b – Find the Target route

You need to find the target route of the folder and then restore it if you are getting the “Failed to build the list of regular subdirectories” when you try to relocate the folder to the original location.

Option c – Try to change Ownership/Reset Defaults for all the User folders

If the “Failed to build the list of regular subdirectories” error pops up when you are trying to move a large number of files from one location to another, then you need to change the ownership of the folders as pointed out earlier.

Code 41 - What is it?

Poor PC maintenance can lead to error message pop-ups like error code 41. Code 41 is one of the several Device Manager Error codes.

This error indicates 2 things: issues with the device driver for the hardware you wish to use, or the hardware device is not properly attached to your system.

The error code 41 is usually displayed in the following format:

“Windows successfully loaded the device driver for this hardware but cannot find the hardware device.” Code 41

Solution

Error Causes

For successful installation of a new hardware piece, it is imperative to follow the installation routine correctly and allow it to complete properly, especially with USB devices.

This is important largely because if installation is not followed and executed properly, code 41 can pop up.

Code 41 is also related to device driver problems. It can occur if your system device drivers are outdated. Also, if the device is a CD/DVD drive, code 41 can occur due to conflicts with 3rd party disc burning software.

Although Device Manager Error code 41 is not detrimental, it is still advisable to repair it as quickly as you can. Code 41 can negatively affect your PC. It can:

• Lower your PC’s Performance
• Limit your ability to use your desired piece of hardware device

Further Information and Manual Repair

As compared to the blue screen of death errors, Device Manager Error codes are much easier to resolve.

Here are some of the best, effective and easy-to-resolve methods to help you fix code 41 on your PC, in a few minutes.

To work around these methods, you don’t have to be a technical whiz or a computer programmer. Simply follow these steps to resolve:

Method 1 - Uninstall Faulty Drivers and then Reinstall

To repair code 41 on your system, try uninstalling problematic drivers and then reinstalling new drivers. To do this, follow these instructions:

• Click the start button
• Then type Device Manager in the search bar and press enter
• Once the Device Manager opens, look for problematic devices
• Click on the device whose driver you wish to uninstall
• Double click to uninstall
• Windows will prompt you to confirm the device removal
• Accept changes and confirm by clicking on OK
• Now reboot your PC to activate changes
• The next step is to reinstall the driver properly. To do this, simply follow the same steps. Once you access the Device Manager,
• Click on the Action tab in the toolbar
• After that select the option ‘Scan for Hardware Changes’

This will hopefully resolve error code 41 on your system and you will be able to use your desired hardware device without any hassle. Nonetheless, if the error code continues to persist, try other methods illustrated below.

Method 2 - Replace the Hardware or Try Reattaching it to your System

Sometimes the error may pop up due to poorly configured devices. This is common if it is a plug-and-play device. The best way to resolve is to remove the device, reattach it properly, and then try using it again.

However, if the problem is with the hardware, then it is advisable to replace the hardware with a new device compatible with your Windows version.

Method 3 - Update the Drivers Manually

If the underlying cause for error code 41 is outdated or corrupted drivers, then it is advisable to update the drivers.

However, when updating drivers and ensuring that the newly installed drivers work perfectly, make sure you install versions that are compatible with your device and Windows. Incompatible drivers are no good.

You will continue to face Device Manager Errors if you install incompatible drivers.

To update drivers, here’s what you have to do:

• Identify the problematic drivers
• Go to the Device Manager and locate all drivers with yellow exclamation marks
• Now install new and compatible driver versions from the manufacturers’ site

Method 4 - Download Driver Assist to Update Drivers Automatically

Updating drivers manually will take time, so perform this task when you are free and have nothing else on your mind. However, if you wish to resolve the issue immediately and have the time to invest in manual updates, then consider downloading DriverFIX.

DriverFIX is a feature-rich and an innovative software program deployed with an intelligent programming system and intuitive technology.

It is exclusively designed to resolve PC device driver problems. Once installed on your system, it scans your PC and identifies problematic drivers.

After that it matches latest and compatible driver versions and updates them  immediately within a few seconds. DriverFIX updates drivers both automatically and on a regular basis.

Click here to download DriverFIX to update drivers and repair error code 41.

EasyDocMerge Toolbar is a Browser Hijacker for Google Chrome. Usually, such browser extensions are installed without your knowledge. These types of Browser Hijackers are often the cause of many problems while surfing the Internet. The most common problems are unwanted pop-ups, underlined words, additional ads, sponsored links, to generate web traffic and earn revenue of the advertising networks by gathering the users browsing data and sending it back to the Mindspark ads network.

When installed this extension will hijack your home page setting it to MyWay.com, it will also change your new tab page to EasyDocMerge (Powered by MyWay.com Search).

About Browser Hijackers

Browser hijacking is a form of an unwanted program, commonly a web browser add-on or extension, which then causes modifications in the browser’s settings. Browser hijacker malware is developed for a variety of reasons. It redirects you to the sponsored internet sites and inserts adverts on your browser that assist its creator to generate earnings. A lot of people think that the browser hijacker is only a harmless website but that is not the case. Nearly every browser hijacker poses an existent threat to your online safety and it’s important to classify them under privacy dangers. They don’t just mess up your browsers, but browser hijackers can even modify the computer registry, leaving your computer susceptible to various other types of attacks.

Key symptoms that your web browser has been hijacked

There are various signs of web browser hijacking: the home page of the web browser is changed unexpectedly; new bookmarks pointing to porn websites are added to your favorite pages; the essential web browser settings are modified and unwanted or insecure resources are added to the trusted sites list; you’ll see many toolbars on your web browser; you see a lot of pop-up ads on your computer screen; your web browser has become unstable or starts running sluggishly; Inability to navigate to particular sites, particularly anti-malware and other computer security software sites.

How they infect computers

Browser hijackers infect computer systems by numerous means, including via a file-share, a drive-by download, or an infected e-mail attachment. They can also originate from any BHO, extension, add-on, toolbar, or plug-in with malicious intent. A browser hijacker may also come bundled up with some free software that you unintentionally download to your computer, compromising your internet security. Typical examples of browser hijackers include CoolWebSearch, Conduit, Coupon Server, OneWebSearch, RocketTab, Searchult.com, Snap.do, and Delta Search. Browser hijackers may record user keystrokes to gather potentially important information that leads to privacy issues, cause instability on computers, drastically disrupt user’s browsing experience, and finally slow down the system to a point where it will become unusable.

Removal

Certain browser hijacking could be simply reversed by discovering and eliminating the corresponding malware software from your control panel. In some cases, it can be a difficult job to identify and eliminate the malicious component because the associated file might be running as part of the operating system process. You should consider carrying out manual fixes only if you are a tech-savvy person, as potential risks are associated with tinkering with the system registry and HOSTS file. Installing and running antivirus programs on the affected computer could automatically erase browser hijackers and other malicious applications. Safebytes Anti-Malware contains a state-of-the-art anti-malware engine to help you prevent browser hijacking in the first place, and clean up any pre-existing issues

What you can do if Virus Prevents You From Downloading Or Installing Anything?

Practically all malware is bad, but certain kinds of malware do a lot more damage to your computer than others. Some malware sits in between your computer and the internet connection and blocks a few or all internet sites that you would like to visit. It will also prevent you from adding anything to your PC, especially antivirus software. If you’re reading this now, you might have probably recognized that a malware infection is the real cause of your blocked web connectivity. So how to proceed if you need to install an antivirus application such as Safebytes? Although this kind of problem can be difficult to get around, there are a few steps you can take.

Eliminate viruses in Safe Mode

If any virus is set to run automatically when Microsoft Windows starts, stepping into Safe Mode could block this attempt. Only minimal required programs and services are loaded when you boot your laptop or computer in Safe Mode. You will need to do the following to eliminate malware in Safe mode. 1) At power on/start-up, hit the F8 key in 1-second intervals. This should bring up the Advanced Boot Options menu. 2) Select Safe Mode with Networking using arrow keys and press ENTER. 3) When this mode loads, you should have the internet. Now, utilize your browser normally and navigate to https://safebytes.com/products/anti-malware/ to download and install Safebytes Anti-Malware. 4) Once the software is installed, allow the diagnostic scan to run to eliminate viruses and other threats automatically.

Obtain the security program using an alternate web browser

Some malware might target vulnerabilities of a specific web browser that obstruct the downloading process. The best way to avoid this problem is to pick a web browser that is renowned for its security features. Firefox has built-in Phishing and Malware Protection to help keep you secure online.

Run anti-malware from your USB drive

To effectively get rid of the malware, you need to approach the problem of running antivirus software on the infected computer from a different angle. Abide by these steps to run the anti-virus on the affected computer. 1) On a virus-free PC, download and install Safebytes Anti-Malware. 2) Plug the Flash drive into the clean computer. 3) Double-click the Setup icon of the antivirus program to run the Installation Wizard. 4) Choose the flash drive as the destination for saving the file. Follow the on-screen instructions to finish the installation process. 5) Remove the pen drive. You can now utilize this portable anti-virus on the infected computer system. 6) Double-click the antivirus program EXE file on the USB flash drive. 7) Simply click “Scan Now” to run a complete scan on the affected computer for viruses.

Protect Your Computer Against Viruses and Malware With SafeBytes Security Suite

Today an anti-malware program can protect your laptop or computer from different types of internet threats. But how to select the best one amongst countless malware protection software that is available out there? As you might be aware, there are several anti-malware companies and tools for you to consider. A few are really worth your money, but many aren’t. You need to choose one that is dependable, practical, and has a strong reputation for its malware source protection. Among few good applications, SafeBytes Anti-Malware is the strongly recommended software program for the security-conscious user. SafeBytes anti-malware is a powerful, highly effective protection application made to help end-users of all levels of computer literacy in detecting and removing harmful threats from their computer. After you have installed this software, SafeByte's sophisticated protection system will ensure that no viruses or malicious software can seep through your personal computer.

SafeBytes has fantastic features when compared to various other anti-malware programs. Listed below are some of the great features included in the software.

Real-time Active Protection: SafeBytes gives you round-the-clock protection for your personal computer limiting malware intrusions instantly. It will examine your PC for suspicious activity at all times and safeguards your PC from illegal access. Antimalware Protection: Safebytes is made on the best virus engine in the industry. These engines can identify and get rid of threats even during the initial phases of a malware outbreak. “Fast Scan” Features: SafeBytes’s high-speed malware scanning engine minimizes scanning times and extends the life of the battery. Simultaneously, it will effectively find and get rid of infected files or any internet threat. Web Protection: SafeBytes checks and gives a unique safety rating to every website you visit and block access to webpages known to be phishing sites, thus protecting you against identity theft, or known to contain malicious software. Low CPU Usage: SafeBytes is a lightweight application. It consumes an extremely small amount of processing power as it runs in the background so you are free to use your Windows-based computer the way you want. 24/7 Premium Support: Professional technicians are at your disposal 24/7! They will immediately fix any technical issues you may be encountering with your security software. Simply put, SafeBytes has formulated a meaningful anti-malware solution that is aimed to protect your computer against various malware. Malware trouble will become a thing of the past once you put this software to use. For top protection and the best value for money, you can’t get better than SafeBytes Anti-Malware.

Technical Details and Manual Removal (Advanced Users)

If you want to manually remove EasyDocMerge without using an automated tool, it may be possible to do so by removing the application from the Microsoft Windows Add/Remove Programs menu, or in cases of browser plug-ins, going to the browsers AddOn/Extension manager and removing it. You’ll likely also want to totally reset your browser to its default configuration settings. To be certain of complete removal, find the following registry entries on your computer and remove them or reset the values appropriately. However, this is a tricky task and only computer experts can perform it safely. Moreover, some malicious programs are capable to defend against its removal. It is highly recommended that you do the removal process in Windows Safe Mode.

The new upgraded Surface Laptop Go 2 is the new iteration of the affordable original Surface Laptop Go aimed to offer good performance at a lower price of under $1000. The new version is not anything vastly different from the original but it comes with much-needed upgrades.

The biggest and main upgrade is the CPU, the Surface Laptop Go 2 is packing now Intel Core i5 1135G7, an Intels 11th generation CPU that should increase battery life. The laptop is also coming with an improved WEB camera and the cheapest one comes now with 128GB of storage instead of 64GB. Price went up from $550 to $599 which is not a big increase considering what was upgraded.

The bad news of new models is that sadly they are still packing only 4GB of RAM, that's really not enough for most applications released in 2022 and the screen is having a relatively low resolution of 1536 X 1024.

Microsoft is still offering all the color variations as in its first offering but added as well a new Sage color that is muted green in tint.

When we look at hardware it seems a little weak but for this price, there is not much competition in the field, and after all this line of models is aimed to provide good performance for an affordable price. If you really need something better you will go with a standard Surface or MAC book instead.

The new laptops are available to pre-order at Best Buy and Microsoft’s online store, and they’ll start shipping on June 7.

Oh, gamers rejoice, the Steam autumn sale is just around the corner!!!

The sale starts on November 22nd and lasts until November 29th. A great deal for any gamer, especially for ones that have plenty on their wishlist. Speaking of wishlists now would be a good time to place some interesting titles on them so you can be notified about discounts on them.

If you by any chance are unavailable to participate in the Autumn sale, do not worry, Steam winter sale is coming on December 22nd and it will last until January the 5th so you can save for it.

The best tactic for sale is not to jump on the train right away, it is best to wait until a few days, maybe even until the last 2 days since some games can go even lower on discount in the last days of the sale. Also, there might be also some packages that include games you wish to buy but are packed with other ones in a bundle and even with a higher discount.

So get prepared for the upcoming sale and treat yourself to something nice!

Error Code 35 - What is it?

Error Code 35 is a typical Device Manager error. It indicates information missing to properly configure your device.  Error code 35 is usually displayed in the following format:

“Your computer's system firmware does not include enough information to properly configure and use this device. To use this device, contact your computer manufacturer to obtain a firmware or BIOS update. Code 35”

Solution

Error Causes

The 2 common reasons for Device Manager error code 35 are:

• Outdated BIOS
• Mis-configured, corrupted, or outdated Drivers

No matter what the reason may be, it is advisable to resolve the problem immediately without any delay otherwise you will be unable to use your hardware device.

Further Information and Manual Repair

Below is the list of the most effective and easy to perform solutions to resolve error code 35 on your PC. These solutions do not require any technical knowledge or understanding. Simply follow the instructions to resolve this error code.

Method 1 - Update the BIOS

BIOS (Basic Input/Output System) is the embedded software on the computer’s motherboard.

Though not all PCs have the same BIOS manufacturer, but the steps for updating the BIOS are similar for all versions. Before you get started with the updating process, first identify your current BIOS version.

• For this, go to the start menu and type msinfo32, and press enter.
• Now click System Summary to view your BIOS version. Here you will see the version number and date.
• Now check your PC motherboard manufacturer’s website to download the BIOS update for the model you own. Also, download any Read Me Files and documentation. These contain guidelines and precautions that you should know before you update.
• Backup all your data and existing BIOS before you update the BIOS version. This will keep your data protected in case the attempt to update BIOS fails.
• Also, when updating, make sure to use an uninterruptible power supply. Remember power outage or even a small power fluctuation can corrupt the BIOS which is something you don’t want.
• Now it’s time to perform the update. Run the downloaded installer for the BIOS updating software. Double click on the executable file.
• Look for a button names Update, Flash, or Run.
• Click on it to start updating the new version
• After the update is complete, your computer will restart automatically.

This will hopefully resolve the problem. However, if the error still persists then there is a possibility that the error code is related to outdated drivers. To resolve, try method 2.

Method 2 - Download Driver Assist to Update Drivers Automatically

Update drivers to repair error code 35 on your PC by simply downloading DriverFIX. This is a cutting-edge program deployed with an intelligent programming system.

It is compatible with all Windows versions.

It scans your PC for problematic drivers and updates them with the latest and compatible versions automatically and in a few seconds thereby repairing all Device Manager error codes including error code 35 generated due to outdated/corrupted drivers.

In addition to this, it updates all device drivers on a regular basis, so you don’t have to stress over and keep a track of what drivers on your PC need to be updated and when.

Click here to download DriverFIX to resolve Device Manager error code 35 today!

Ehshell.exe Application Error - What is it?

Ehshell.exe is a type of .exe (executable file). This file functions as an essential component of the Microsoft Media Center.  By default, it is located in a subfolder of C:\Windows. Ehshell.exe application error is an error code that pops up when tasks in the Media Center freezes. The Ehshell.exe application error is usually displayed on the screen in the following format:

“ehshell.exe – Common Language Runtime Debugging Services Application has generated an exception that could not be handled. Process id=0xa18 (2584), Thread id=0xa24 (2596).”

Solution

Error Causes

Ehshell.exe application error is triggered when PC users perform repetitive tasks in Media Center on a Windows XP Media Center Edition. The computer stops to respond and the error message is displayed. This error occurs if users perform one or more of the following repetitive tasks in the Media Center:

• Repeated resize, restore and minimize the Media Center Window
• Schedule TV shows to record
• Repeatedly change the channel while Media Center is in a window
• Ehshell.exe file corruption due to malware infection or registry issues

Though this is not a fatal error, to avoid any kind of inconvenience, it is advisable to fix the error right away.

Further Information and Manual Repair

To fix the ehshell.exe application error on your system, you don’t have to hire a professional and spend hundreds of dollars on repair. Here are some of the best and most effective do-it-yourself methods that you can try to resolve this issue on your PC immediately.

Method 1 - Install the Latest Service Pack for Microsoft Windows

To repair the issue, install the latest Windows service pack. A service pack is basically a Windows update, often combines previously released updates that help make Windows more reliable. These are offered free of charge on Microsoft’s official website.  To get started, simply log on to Microsoft’s official website and download the latest service pack compatible with your Windows version. The installation process may take 30 minutes to install. And you will be prompted to restart your PC about halfway through the installation process. Once the Windows Service Pack is installed, the ehshell.exe application error will be fixed. If the error still persists, then try method 2.

Method 2 - Scan for Malware

Ehshell.exe application error may also appear on your PC due to malware infection. Malware programs like viruses, Trojans, and worms deliberately give their malicious processes similar .exe file names, so it is hard to identify the malware. In such an event, it is advisable to download a powerful antivirus and scan your entire PC. Run it to remove all the hidden malware programs on your system. Once malware is removed, the ehshell.exe application error will be resolved.

Method 3 - Clean Registry

Sometimes .exe files can also get corrupt when the registry gets overloaded with unnecessary and obsolete files. If this is the underlying reason for the error code occurrence then it is advisable to download Restoro. This is a multi-functional and user-friendly PC Fixer deployed with a registry cleaner. It removed all the unnecessary files, cleans and repairs the registry in seconds thereby fixing all registry-related errors. Click here to download Total System Care and resolve the Ehshell.exe application error on your PC.

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities. However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."

What happens when malicious software is installed

"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:

• Stealing instant messenger messages;
• Stealing instant messenger database files (if the root is available);
• Inspecting the default browser's bookmarks and searches;
• Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
• Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
• Inspecting the clipboard data;
• Inspecting the content of the notifications;
• Recording audio;
• Recording phone calls;
• Periodically take pictures (either through the front or back cameras);
• Listing of the installed applications;
• Stealing images and videos;
• Monitoring the GPS location;
• Stealing SMS messages;
• Stealing phone contacts;
• Stealing call logs;
• Exfiltrating device information (e.g., installed applications, device name, storage stats).

How does it work?

Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed. "Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said. "The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."

Camouflage

The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.