CryptoService

Posted: December 30, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	16,751
Threat Level:	8/10
Infected PCs:	237

First Seen:	December 30, 2011
Last Seen:	July 25, 2023
OS(es) Affected:	Windows

CryptoService is a cryptographic tool that obfuscates scripts, allowing criminals to make drive-by-downloads or code injection-based attacks from their own sites or sites that they've hijacked. Because CryptoService attacks can only occur through your web browser, the two top methods to protect yourself from CryptoService are to keep strong security settings for your browser and to have anti-malware software that can detect browser-based attacks as they happen. Since obfuscation functions by CryptoService can conceal otherwise obviously-harmful code, you should also keep all relevant software up-to-date to maximize accurate detection of scripts that are concealed with CryptoService.

CryptoService – the Latest PC Threat from Eastern Europe

CryptoService, like many utilities that are made by pirates and for pirates, is marketed strictly in Russian, making CryptoService more likely to be used on Russia-based sites (which are distinguishable by their .ru domain name) than non-Russian sites. However, CryptoService attacks may also be used to obfuscate code for non-Russian sites or for code injection attacks on normally-harmless websites, and SpywareRemove.com malware experts recommend that you keep generally-secure browser settings to defend against all avenues of attack by CryptoService.

The obfuscation or encryption of code that CryptoService performs allows CryptoService to change the appearance of code while preserving its functionality, and, as a result, can confuse security and anti-malware software into being unable to detect script-based attacks. Means of protecting yourself from CryptoService and related PC threats include:

Using browser settings that disable scripts (including Flash and Java) for unfamiliar sites.
Disabling advertisements from third parties by way of an advertisement-blocker utility.
Keeping your browser up-to-date with respect to patches to reduce the presence of known exploits and security holes.
Keeping anti-malware software open and running to detect attacks by CryptoService-related PC threats.

A Service That's Happy to Serve Any Amount of Payloads

Since CryptoService's features can be adapted to many different types of malicious scripts, there's no single foolproof method for detecting or removing a CryptoService-delivered PC threat. However, potential risks which SpywareRemove.com malware analysts have perceived to be particularly-likely include:

Browser redirect attacks to hostile websites. Redirects may be used by BHO-based PC threats that are specific to individual browsers or by Trojans and rootkits that can affect all browsers in equal measure.
Loss of private information due to the presence of spyware, including keyloggers that monitor, record and transmit keyboard input.
Exposure to fake warnings and other types of fraudulent pop-ups by rogue security programs.
Unauthorized changes to your network or firewall settings that allow remote access to your PC by criminals.
Blocked access to anti-malware, anti-virus and other security programs.

In all instances, after suspected contact with CryptoService and anything that CryptoService may have installed on your PC, you should scan your computer with suitable anti-malware programs. If access to such programs is prevented, you can disable the blocking PC threat by using Command Prompt, Safe Mode or similar techniques that are considered baseline for Windows security.

CryptoService

Threat Metric

CryptoService – the Latest PC Threat from Eastern Europe

A Service That's Happy to Serve Any Amount of Payloads

Leave a Reply