Revoyem

Posted: September 14, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	13,341
Threat Level:	1/10
Infected PCs:	525

First Seen:	September 19, 2013
Last Seen:	October 7, 2023
OS(es) Affected:	Windows

Revoyem is the family name for a group of Police Ransomware Trojans that display different fraudulent alerts for different regions, demand ransom fees while locking your computer and, in some cases, encrypt certain types of files (such as images or documents) to make them unusable. Unlike older families such as Reveton, Revoyem was confined to only two countries of Europe earlier in 2013, but at this time appears to be spreading to other continents and countries around the world. SpywareRemove.com malware researchers suggest the use of standard anti-malware strategies and software for deleting Revoyem, and also place emphasis on browser security for blocking the drive-by-downloads that are responsible for its installation.

Revoyem: a Previously Smalltime Ransomware Scam Beginning to Reverberate Globally

Revoyem, AKA DirtyDecrypt, is a group of multiple Trojans that deliver fake police warnings to their victims. These alerts take advantage of Revoyem's ability to detect your IP address and will display in a language appropriate to your nation, as well as make references to some country-specific legal institutions. However, the basic warning, threat and request wrapped up in Revoyem pop-ups always are the same: Revoyem claims to have been forced to lock your computer due to illegal activities taken on your part, which require the payment of a fine before your PC will be restored to its old self.

SpywareRemove.com malware experts are particularly interested in how seamlessly Revoyem's new alerts merge with its delivery method. The newest Revoyem infection vectors are malicious advertisements hosted on pornographic domains that redirect the victim (briefly) to child pornographic content before delivering a download of Revoyem via the Styx. Since new versions of Revoyem fake Police Trojans theme their warning messages after pornographic violations, victims easily could believe that Revoyem is a real police program – although nothing could be further from the case. Paying the ransom demanded by Revoyem is unlikely to provide any solution for your computer and helps fund criminal activities rather than whatever government your version of Revoyem claims for sponsorship.

Revoyem was first seen concentrating its attacks on Germany and the UK back in March of 2013 but has branched out since then to countries such as Australia, Canada and the United States.

The Safe Way to Deal with a Criminal in Cop's Clothing

Since Revoyem has invested so much in trying to convince victims of its legitimacy, the first step to removing any Revoyem infection is to understand that doing so is your legal right and that Revoyem does not have any police authorization to lock your computer. Booting from a peripheral device usually will be required for disabling Revoyem's system lockdown, but most anti-malware tools should be able to handle removing Revoyem after the lockdown has been resolved. However, it also must be stressed that Revoyem is a recent family of Police Ransomware Trojans that are still being updated, and updated anti-malware tools likewise may be required.

SpywareRemove.com malware experts also encourage the use of remote file backups for dealing with any file encryption attacks on Revoyem's part. Browser security also is important for blocking the advertisements that deliver Revoyem to your computer – although it may be considered a little redundant if you don't visit malicious, suspicious or pornographic sites as a matter of habit.

Technical Details

Additional Information

The following URL's were detected:

://*.newsextensions.com/"

Trojan.Revoyem.A