Troj/Ransom-NY

Posted: March 6, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	9

First Seen:	March 6, 2013
Last Seen:	March 22, 2021
OS(es) Affected:	Windows

Troj/Ransom-NY is a ransomware Trojan that encrypts a broad range of files on your PC (according to their file types) to make them unreadable, afterward demanding a ransom fee before Troj/Ransom-NY will reverse the encryption. SpywareRemove.com malware researchers discourage paying Troj/Ransom-NY's ransom, which isn't required to restore your files to normal and doesn't have a guarantee of working in the first place. Because Troj/Ransom-NY targets Russian victims specifically, residents of Russia (or frequenters of Russian websites) should consider preemptive security steps to avoid a Troj/Ransom-NY infection, but any competent anti-malware product should be able to delete Troj/Ransom-NY if it's necessary.

Troj/Ransom-NY: Why Being 'Unique' isn't Always a Good Thing for Ransomware

Troj/Ransom-NY generally is installed via misleading file attachments on e-mail-based spam attacks. Trojan droppers for Troj/Ransom-NY tend to use the HTA file format a (an HTML form of an executable file), but they may be disguised to look like other file types such as JPG or MP3. Once Troj/Ransom-NY is launched, Troj/Ransom-NY performs two major attacks of its own:

Encrypting various file types on your computer, such as MP3, DOC, JPG, ISO, WAV and TXT. This encryption will scramble the data of the affected files, making them unusable, but in an organized fashion that can be reversed with the appropriate algorithm. Your files are not permanently damaged by Troj/Ransom-NY's encryption attack.
Troj/Ransom-NY also displays a Russian warning message that requests that you pay an equivalent of over three hundred dollars USD before the criminals behind Troj/Ransom-NY will decrypt your files.

So far, these functions are typical for any ransomware Trojan. Troj/Ransom-NY distinguishes itself from similar ransomware Trojans in its usage of Windows PowerShell: a Windows-specific network-management language. Ironically, this unusual feature allows Troj/Ransom-NY's victims to use the very same PowerShell tool that Troj/Ransom-NY installed for recovering the relevant decryption keys. This is demonstrative of how innovative design features in malware are capable of backfiring – explaining why SpywareRemove.com malware researchers examine so many derivative PC threats that use old-but-reliable techniques.

Unraveling Troj/Ransom-NY's Overly-Achieving Ransom Scam

Inputting the appropriate commands will allow you to 'unlock' your files without the heavy payment that Troj/Ransom-NY would like to receive. However, even after you've reversed Troj/Ransom-NY's file-encrypting attack, you also should be ready to remove Troj/Ransom-NY, which still is a danger to your computer as long as Troj/Ransom-NY is installed. SpywareRemove.com malware researchers recommend that you use anti-malware software to delete Troj/Ransom-NY and similar ransomware Trojans.

Troj/Ransom-NY and similar ransomware Trojans often try to block the security applications that could remove them. If you believe that you need to find a way to disable Troj/Ransom-NY before you can disinfect your PC, SpywareRemove.com malware experts suggest booting into Safe Mode or, if all else fails, booting from a peripheral device (such as a common USB drive).

Troj/Ransom-NY

Threat Metric

Troj/Ransom-NY: Why Being 'Unique' isn't Always a Good Thing for Ransomware

Unraveling Troj/Ransom-NY's Overly-Achieving Ransom Scam

Leave a Reply