Türk Polisi Virus Ransomware

Posted: October 30, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	99

First Seen:	October 30, 2012
OS(es) Affected:	Windows

The Türk Polisi Virus marks the first foray of Reveton Trojan-based ransomware attacks into the Middle East. Keeping true to the same tactics and aesthetics that have been used in similar attacks throughout Europe, the Türk Polisi Virus infects your PC through dishonest means, displays a fake legal alert (supposedly sent by the Turkish police) and warns you that your online crimes will result in imprisonment if you don't pay its fine. Naturally, the real Turkish police aren't in the habit of using Trojans to lock people's computers for random Internet-related crimes, nor do they request legal fees through Ukash or Paysafecard. SpywareRemove.com malware researchers recommend that you treat the Türk Polisi Virus the same as any other ransomware Trojan and use tried-and-true methods of disabling and deleting the Türk Polisi Virus infection with reliable anti-malware products.

The Türk Polisi Virus: a Bad Moon Rises Over Turkey's Cyberspace

The Türk Polisi Virus, while not an actual virus and not equipped with self-distributive functions, is hardly less fright-mongering than a virus when the Türk Polisi Virus strikes. The Türk Polisi Virus is loaded by one of many potential variants of Trojans from the Reveton family, which detect the infected computer's IP address and launch a ransomware Trojan attack that matches the IP address's country. Identical attacks to Türk Polisi Virus's that SpywareRemove.com malware experts have observed include Polizia Slovena Ransomware in Slovenia, the France Ministère de l'Intérieur Virus in France, the Poliisi Tietoverkkorikos Tutkinnan Yksikkö Ransomware in Finland and the Polizei Control Department Virus in Austria.

After the Türk Polisi Virus is launched, the Türk Polisi Virus displays a fake alert that claims to have been sent by Turkey's police 'cybercrime department,' complete with the symbol of the Turkish National Police on display. This alert warns you about illegal activities (such as viewing forbidden types of pornography) that have been associated with your computer and will recommend that you pay a fine before you face other legal penalties. SpywareRemove.com malware research team has taken particular pains to emphasis the usage of Paysafecard and Ukash for payment, both of which are often used by ransomware Trojans (especially ones from the same family as the Türk Polisi Virus).

The fine leveraged by the Türk Polisi Virus is illegal and never should be paid, regardless of how difficult the Türk Polisi Virus may make it for you to use your PC. Probable Türk Polisi Virus-related issues, as noted by SpywareRemove.com malware researchers, are listed further in this article.

The Real Dangers Waiting Their Turn Behind the Türk Polisi Virus's Fake Warnings

A Türk Polisi Virus may not be able to call the police or throw you into jail, but any Türk Polisi Virus infection is still a noticeable security risk that should be removed promptly. SpywareRemove.com malware analysts have found that the Türk Polisi Virus and members of its family have been known to use Registry changes and code injection (inserting malicious code into the memory processes of normal programs) to achieve results like these:

Browser changes that cause Internet Explorer to load malicious content automatically.
Blocked Windows tools like Task Manager.
Usage of malicious DLL files with spyware features (features that allow confidential information, such as passwords, to be stolen).
Monitored webcam input.

Without doubt, it may be a hard task to remove the Türk Polisi Virus if the Türk Polisi Virus is blocking any other program you can use, which is why SpywareRemove.com malware experts can recommend the usage of a USB-loaded OS or Safe Mode to disable a Türk Polisi Virus infection. Given the concealed nature of the Türk Polisi Virus's components, anti-malware software should be used to remove the Türk Polisi Virus after that.

Technical Details

Additional Information

The following messages's were detected:

#	Message
1	All transactions on the computer are recorded. The webcam is used to record video and images to identify you. Computer is locked!
2	Bilgisayarda yapilan tum islemler, kaydedilmektedir. Web kamerasini kullandiginiz halde video ve fotograflari tespit icin kaydedilmektedir. Bilgisayarinizi kilitlendi!

‘Bllgisayarinizin Bloke Edilmiştir. Türk Polisi’ Ransomware