Norsk Politi Institutt for Cybercrime Ransomware Virus

Posted: October 18, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	70

First Seen:	October 18, 2012
OS(es) Affected:	Windows

The Norsk Politi Institutt for Cybercrime Virus is a rare showing of a ransomware Trojan that attacks the nation of Norway, as an example of the prolific nature of ransomware-based PC threats that are happy to single out the nationalities of victims throughout Europe. While the country that Norsk Politi Institutt for Cybercrime Virus targets is enough to differentiate Norsk Politi Institutt for Cybercrime Virus from its brethren, Norsk Politi Institutt for Cybercrime Virus is consistent with them in the rest of the details of its attacks: displaying fake police alerts, warning you about crimes that you (probably) haven't committed and requesting a transfer of money (to criminal hands, rather than the government) as a payment for your crimes. SpywareRemove.com malware researchers can't consider Norsk Politi Institutt for Cybercrime Virus to be anything more or less than a clone of other recent ransomware Trojans with origins in the Reveton family and recommend keeping your money to yourself as you use anti-malware software to remove the Norsk Politi Institutt for Cybercrime Virus.

Noting All the Fraud in a Norsk Politi Institutt for Cybercrime Virus's Ticketing Procedure

The Norsk Politi Institutt for Cybercrime Virus is installed through methods, such as Blacole-based drive-by-downloads, that either don't require your consent or misrepresent the Norsk Politi Institutt for Cybercrime Virus as something other than what Norsk Politi Institutt for Cybercrime Virus really is. Norsk Politi Institutt for Cybercrime Virus's installation coincides with detecting your computer's country according to its IP address. This allows an appropriate warning message to be selected to match your country. Norsk Politi Institutt for Cybercrime Virus only displays for PCs in Norway, while SpywareRemove.com malware researchers have also noted similar attacks by the Eenheid Voor de Bestrijding Cybercrime Virus (in the Netherlands), the Oficina Virtual de Denuncias Virus (in Spain), the POLIISI Osasto Tietoverkkorikollisuuden Virus (in Finland), the Luxembourg Police Virus and the France Ministère de l'Intérieur Virus (both of the last two in France).

Norsk Politi Institutt for Cybercrime Virus's installation is easily noticed, since the Norsk Politi Institutt for Cybercrime Virus reboots your PC and displays a screen-blocking alert that appears to be from the Norwegian police. This alert uses webcam-monitoring, various icons and a citation of cybercrime-related laws to make you believe that your computer is guilty of being used for common Internet crimes.

The Norsk Politi Institutt for Cybercrime Virus also requests a Paysafecard or Ukash payment to unlock your computer, which SpywareRemove.com malware research team notes should be a dead giveaway to Norsk Politi Institutt for Cybercrime Virus being malware, rather than a legitimate warning from the police. They also stress that you don't need to pay Norsk Politi Institutt for Cybercrime Virus's fine to unlock your computer, and, in fact, are unlikely to restore your PC by paying this illegal fee.

The Magic Lockpick to Undoing Norsk Politi Institutt for Cybercrime Virus's Lockdown

Because Norsk Politi Institutt for Cybercrime Virus can block other programs while Norsk Politi Institutt for Cybercrime Virus is open and may make Registry changes that endanger your PC (particularly with respect to access to Internet Explorer or Task Manager), Norsk Politi Institutt for Cybercrime Virus should be considered a security threat due for hasty deletion. To prevent Norsk Politi Institutt for Cybercrime Virus from launching, all that's necessary is to load your OS from a removable device or use Safe Mode, which will stop Norsk Politi Institutt for Cybercrime Virus and its pop-up warning from displaying themselves.

Adequately competent anti-malware products should be able to remove Norsk Politi Institutt for Cybercrime Virus without harm coming to your PC. Regardless of the threats that Norsk Politi Institutt for Cybercrime Virus's pop-up uses, SpywareRemove.com malware researchers haven't found signs of Norsk Politi Institutt for Cybercrime Virus causing further penalties if you fail to pay its fine, attempt to remove Norsk Politi Institutt for Cybercrime Virus or ignore Norsk Politi Institutt for Cybercrime Virus's three-day time limit.

Technical Details

Additional Information

The following messages's were detected:

#	Message
1	Institutt for Cybercrime Politiet Alle dine handlinger på denne datamaskinen blir registrert. Hvis du bruker et videokamera, ble en video og bilder bevart for identifisering. Datamaskinen har blitt last! Datamaskinen din er midlertidig list på grunn av uautorisert datavirksomhet. Det er mulige brudd du har begått: Art. 274 – Opphavsrettsbrudd t Straffes med bot eller fengsel i inntil 4 ar (Bruk eller distribusjon av filer beskyttet med opphavsrett – filmer, programvare) Art. 183 – Pornografisk produksjon t Straffes med bot eller fengsel i inntil 2 ar (Bruk eller distribusjon av pornografiske filer) Art. 184 – Pornografisk produksjon hvor barn deltar (under 18 år) Straffes med fengsel i inntil 15 ar (Bruk eller distribusjon av pornografiske filer) Art. 104 – Popularisering av ter/orisme Straffes med fengsel i inntil 25 ar (Du har besøkt hjemmesider til terroristiske organisasjoner) Art. 297 – Skjødesløs bruk av datamaskin som resulterte i alvorlige konsekvenser Straffes med bot eller fengsel i inntil 2 ar (Datamaskinen din er infisert med et virus, som i sin tur infisere andre datamaskiner) Art. 108 – Gambling Straffes med bot el er fengsel i inntil 2 ar (Du har deltatt i gamling som er forbudt ifølge lovgivning i landet ditt) i hjemmel med regjerings vedtak av den 22. august, kunne alle disse lovbrudd anses som betinget ved betaling av bot. Botens beløp er 100 euro. Boten skal betales innen 48 timer etter oppdagelsen av et brudd. Hvis boten ikke blir betalt, blir det automatisk anlagt en straffesak mot deg. Etter betaling av boten blir datamaskinen din last opp.
2	Norwegian Police Department of Cybercrime police All your actions on this computer is registered. If you use a video camera, all video and pictures will be preserved for identification. The computer has become locked! Your computer is temporary locked because of unauthorized computer activity. It's possible breach by you: Art. 274 - Copyright Violation Punishable by fine or imprisonment of up to 4 years (Use or distribution of copyright-protected files - movies, software) Art. 183 - Pornographic production punished by fine or imprisonment of up to two years (Use or distribution of pornographic files) Art. 184 - Pornographic production where children participate (under 18 years) Punished by imprisonment for up to 15 years (The use or distribution of pornographic files) Art. 104 - Popularization of terrorism Punished by imprisonment of up to 25 years (You have visited websites to terrorist organizations) Art. 297 - Careless use of a computer that resulted in serious consequences punished by fine or imprisonment of up to two years (The computer is infected with a virus, which in turn infect other computers) Art. 108 - Gambling Punishable by fine or imprisonment is for up to 2 years (You have participated in gambling which is prohibited by law in your country) Pursuant to the Government's adoption of the 22 august, all of these offenses are considered conditional upon payment of a fine. PENALTY amount is 100 Euros. The fine must be paid within 48 hours after discovery of a breach. If the fine is not paid, it is automatically filed a criminal case against you. After the payment of the fine, your computer is unlocked.

Message

Institutt for Cybercrime
Politiet
Alle dine handlinger på denne datamaskinen blir registrert. Hvis du bruker et videokamera, ble en video og bilder bevart for identifisering.
Datamaskinen har blitt last!
Datamaskinen din er midlertidig list på grunn av uautorisert datavirksomhet. Det er mulige brudd du har begått:
Art. 274 – Opphavsrettsbrudd t
Straffes med bot eller fengsel i inntil 4 ar
(Bruk eller distribusjon av filer beskyttet med opphavsrett – filmer, programvare)
Art. 183 – Pornografisk produksjon t Straffes med bot eller fengsel i inntil 2 ar (Bruk eller distribusjon av pornografiske filer)
Art. 184 – Pornografisk produksjon hvor barn deltar (under 18 år)
Straffes med fengsel i inntil 15 ar
(Bruk eller distribusjon av pornografiske filer)
Art. 104 – Popularisering av ter/orisme Straffes med fengsel i inntil 25 ar
(Du har besøkt hjemmesider til terroristiske organisasjoner)
Art. 297 – Skjødesløs bruk av datamaskin som resulterte i alvorlige konsekvenser Straffes med bot eller fengsel i inntil 2 ar
(Datamaskinen din er infisert med et virus, som i sin tur infisere andre datamaskiner)
Art. 108 – Gambling
Straffes med bot el er fengsel i inntil 2 ar
(Du har deltatt i gamling som er forbudt ifølge lovgivning i landet ditt)
i hjemmel med regjerings vedtak av den 22. august, kunne alle disse lovbrudd anses som betinget ved betaling av bot.
Botens beløp er 100 euro. Boten skal betales innen 48 timer etter oppdagelsen av et brudd.
Hvis boten ikke blir betalt, blir det automatisk anlagt en straffesak mot deg. Etter betaling av boten blir datamaskinen din last opp.

Norwegian Police
Department of Cybercrime police
All your actions on this computer is registered. If you use a video camera, all video and pictures will be preserved for identification.

The computer has become locked!
Your computer is temporary locked because of unauthorized computer activity. It's possible breach by you:
Art. 274 - Copyright Violation
Punishable by fine or imprisonment of up to 4 years
(Use or distribution of copyright-protected files - movies, software)
Art. 183 - Pornographic production punished by fine or imprisonment of up to two years (Use or distribution of pornographic files)
Art. 184 - Pornographic production where children participate (under 18 years)
Punished by imprisonment for up to 15 years
(The use or distribution of pornographic files)
Art. 104 - Popularization of terrorism Punished by imprisonment of up to 25 years
(You have visited websites to terrorist organizations)
Art. 297 - Careless use of a computer that resulted in serious consequences punished by fine or imprisonment of up to two years
(The computer is infected with a virus, which in turn infect other computers)
Art. 108 - Gambling
Punishable by fine or imprisonment is for up to 2 years
(You have participated in gambling which is prohibited by law in your country)
Pursuant to the Government's adoption of the 22 august, all of these offenses are considered conditional upon payment of a fine.
PENALTY amount is 100 Euros. The fine must be paid within 48 hours after discovery of a breach.
If the fine is not paid, it is automatically filed a criminal case against you. After the payment of the fine, your computer is unlocked.