Survey Warning Ransomware

Posted: March 12, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	2,526
Threat Level:	2/10
Infected PCs:	23,456

First Seen:	March 12, 2013
Last Seen:	October 16, 2023
OS(es) Affected:	Windows

Survey Warning Ransomware is a semi-innovative form of ransomware Trojan that asks you to fill out a survey at an indicated site to receive an unlocking code for your PC. Until this is done, Survey Warning Ransomware will refuse to let you use your desktop or other programs – even though the 'survey' site that Survey Warning Ransomware indicates actually is a verified hotbed for malware distribution and phishing attacks. If you see Survey Warning Ransomware's pop-up attack, SpywareRemove.com malware experts suggest disabling Survey Warning Ransomware without trying to unlock Survey Warning Ransomware, and then using a suitable anti-malware product for deleting Survey Warning Ransomware appropriately.

The Real Question: What Happens When You Try the Survey Warning Ransomware's Survey

The majority of ransomware-based PC threats, including Reveton Trojans, Urausy Trojans, Ukash Viruses and 'Piracy Ransomware' Trojans, prefer to lock your computer with fake legal warnings that include requests for money. Instead, Survey Warning Ransomware employs a different strategy that SpywareRemove.com malware researchers have noted in the following divergences:

Survey Warning Ransomware's pop-up warning doesn't try to pass itself off as anything other than an attack from malicious software. However, Survey Warning Ransomware does include a vague threat in case you fail to give in to its ransom demand.
Instead of requesting money, Survey Warning Ransomware requests that you fill out a survey at fileice.net. Supposedly, doing this you will be provided an unlock code in order to disable Survey Warning Ransomware and be allowed to get back to using your PC as per usual.

Fileice.net is a malware-distribution and phishing site that uses its surveys as excuses to gather personal information about its victims. Besides the potential of losing confidential information, your computer also may be exposed to other types of malware that are installed with or without your permission.

A Real Warning About What Survey Warning Ransomware Can Do if Left to Itself

Survey Warning Ransomware, like other types of ransomware, is designed to block you from using many other programs, including torrent clients, system-maintenance utilities, web browsers and Microsoft Office software. Naturally, stopping Survey Warning Ransomware's attacks without exposing your PC to further attacks should be your first step towards disinfecting your computer, and SpywareRemove.com malware experts recommend Safe Mode for the purpose.

After you've prevented Survey Warning Ransomware from blocking your other applications, you should run suitable anti-malware tools to remove Survey Warning Ransomware efficiently. SpywareRemove.com malware analysts recommend using particularly thorough anti-malware scans if you've attempted to fulfill Survey Warning Ransomware's ransom conditions or exposed your PC to other sites promoted by Survey Warning Ransomware.

Besides Survey Warning Ransomware, SpywareRemove.com malware experts also note that fileice.net has been known to distribute worms. Worms can be spread through peripheral devices (such as flash drives) and local networks. You should avoid sharing such resources until you've verified that all malware related to Survey Warning Ransomware has been removed.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\CommandPrompt.exe

File name: %AppData%\CommandPrompt.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%AppData%\sd.bat

File name: %AppData%\sd.bat
File type: Batch file
Mime Type: unknown/bat
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run!CommandPrompt %AppData%\CommandPrompt.exe

Additional Information

The following URL's were detected:

maxy-tax.com