Computer security analysts discovered a new kind of “Ransomware” removes any kind of security software on users ‘ computers.This virus carries the name AVCrypt, was first revealed by the company MalwareHunterTeam, and analyzed later.By Bleeping computer.According to the researchers, the AVCrypt not only tries to eliminate any antivirus software before hardware files encryption products, but will also eliminate some of Windows services.They also said it’s unusual malicious software with capabilities similar to insure ransom, despite all this, experts still do not know how the new AVCrypt virus hunts his victims.When you run this malware on the user’s computer, it tries to first remove the security program, locate the Windows Defender or any other antivirus.And ensuring that, this virus remove Attn W services responsible for security services are running correctly and is (MBAMProtection and Schedule and TermService and WPDBusEnum and WinDefend and MBAMWebProtection).
After all the AVCrypt virus checkIf the registered antivirus program in the Windows Security Center and eliminates these details from the command line, which leads to a deterioration of service functions.And later, A malicious program searches for files to encrypted and appears to the user to pay the ransom message under the name HOW_TO_UNLOCK.tx however, there is more information about this virus, and even though there might be an attack on a Japanese University computer from virus with similar properties forAVCrypt, however, there is no evidence that he was responsible for that.For its part, Microsoft said it believed that the malware is still in the process of development, and that in addition, “it is not known whether real or ransom virus cleaner masquerading as one.”