‘Cyber Command of Nevada’ Ransomware

Posted: October 25, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	4

First Seen:	October 16, 2013
OS(es) Affected:	Windows

The 'Cyber Command of Nevada' Ransomware is a member of the relatively new the 'Cyber Command of [State Name]' Ransomware branch of the Urausy family, which specializes in displaying fake legal warnings, blocking your desktop and demanding fraudulent ransoms. While the 'Cyber Command of Nevada' Ransomware's warning message claims to have locked your computer as a punishment for various crimes, the 'Cyber Command of Nevada' Ransomware actually attacks any PC that the 'Cyber Command of Nevada' Ransomware may infect successfully and isn't under the authority of the Nevada state government. SpywareRemove.com malware researchers still encourage using appropriate anti-malware applications for removing the 'Cyber Command of Nevada' Ransomware and other members of its family – since they're fraudulent programs that endanger your PC as long as they're installed.

When Police Ransomware Trojans Starts Casing a Country State-by-State

Although fake Police Trojans like the 'Cyber Command of Nevada' Ransomware and its relatives have been seen throughout the world, the 'Cyber Command of Nevada' Ransomware is one example of recent ransomware campaigns centering on the United States specifically. Other members of the 'Cyber Command of Nevada' Ransomware's family, such as the 'USA Cyber Crime Investigations' Ransomware, the 'Cyber Command of New York' Ransomware, the 'Cyber Command of California' Ransomware and the 'Cyber Command of South Texas' Ransomware, are effectively identical to each except for the states referenced in their pop-up alerts. These pop-up alerts are displayed automatically to convince their victims that they've been caught red-handed committing crimes such as downloading protected content or viewing underage pornography.

In reality, there's no evidence that the 'Cyber Command of Nevada' Ransomware can detect the crimes 'Cyber Command of Nevada' Ransomware claims to thwart, and 'Cyber Command of Nevada' Ransomware certainly doesn't have the authority of any genuine agency of the Nevada state government. Despite its lack of legitimacy, the 'Cyber Command of Nevada' Ransomware does use its pop-up alert to block your desktop and, with it, your ability to use most other Windows applications. This attack shouldn't be resolved by paying the ransom money that the 'Cyber Command of Nevada' Ransomware demands; instead, using basic security strategies like booting from a peripheral device can help you disable the 'Cyber Command of Nevada' Ransomware.

Keeping the Ransomware Police outside of the Borders of Your Desktop

While the 'Cyber Command of Nevada' Ransomware doesn't need to be paid, and there is, in fact, absolutely no benefit in doing so, its removal always should use specialized anti-malware tools that can delete all of its components safely. Since the 'Cyber Command of Nevada' Ransomware is an especially new member of an already new branch of the Urausy family, SpywareRemove.com malware researchers also place emphasis on the need to update your security software so that all new threats can be detected with as little trouble as possible. Doing so can make the difference between getting the 'Cyber Command of Nevada' Ransomware off your PC or even preventing the 'Cyber Command of Nevada' Ransomware from being installed at all.

Based on similar attacks from this same family, the 'Cyber Command of Nevada' Ransomware most likely incorporates exploits kits like the Blackhole Exploit Kit into its drive-by-download attacks that distribute 'Cyber Command of Nevada' Ransomware to new computers. Besides the obvious usefulness in updating your security software, updating your software in general can reduce the vulnerabilities that these exploit kits require to infect your computer. SpywareRemove.com malware researchers also recommend avoiding any potential contact with unsafe or compromised websites that may be hosting exploits for installing the 'Cyber Command of Nevada' Ransomware.

Technical Details

Additional Information

The following messages's were detected:

#	Message
1	U.S.A. Cyber Crime Investigations Cyber Command of Nevada Attention! Your computer has been blocked up for safety reasons listed below. You are accused of viewing/storage and/or dissemination of banned pornography (child pornography/zoophilia/rape etc). You have violated World Declaration on non-proliferation of child pornography. You are accused of committing the crime envisaged by Article 161 of United States of America criminal law. Article 161 of United States Of America criminal law provides for the punishment of deprivation of liberty for terms from 5 to 11 years. Also, you are suspected of violation of “Copyright and Related rights Law” (downloading of pirated music, video, warez) and of use use and/or dissemination of copyrighted content. Thus, you are suspected of violation of Article 148 of United States of America Criminal Law. Article 148 of United States of America criminal law provides for the punishment of deprivation of liberty for terms from 3 to 7 years or 150 to 550 basic amounts fine. It was from your computer, that unauthorized access had been stolen to information of State importance and to data closed for public Internet access. <…>

Message

U.S.A. Cyber Crime Investigations
Cyber Command of Nevada
Attention! Your computer has been blocked up for safety reasons listed below.
You are accused of viewing/storage and/or dissemination of banned pornography (child pornography/zoophilia/rape etc). You have violated World Declaration on non-proliferation of child pornography. You are accused of committing the crime envisaged by Article 161 of United States of America criminal law.
Article 161 of United States Of America criminal law provides for the punishment of deprivation of liberty for terms from 5 to 11 years. Also, you are suspected of violation of “Copyright and Related rights Law” (downloading of pirated music, video, warez) and of use use and/or dissemination of copyrighted content. Thus, you are suspected of violation of Article 148 of United States of America Criminal Law.
Article 148 of United States of America criminal law provides for the punishment of deprivation of liberty for terms from 3 to 7 years or 150 to 550 basic amounts fine.
It was from your computer, that unauthorized access had been stolen to information of State importance and to data closed for public Internet access.
<…>