'Reveton' Details

[+] Click Image to Enlarge

• 
• 

Reveton, also detected as Trojan:Win32/Reveton.A is a malicious Trojan that hijacks the victim’s web browser in order to direct the infected computer to specific websites. The Reveton Trojan modifies the Windows Registry that allows Reveton to launch automatically when Windows starts up. Reveton will be disguised as a legitimate file process, making Reveton difficult to remove. Because Reveton makes dangerous changes that must be undone, ESG malware analysts discourage manual removal when dealing with this threat. Instead, Reveton should be removed with a strong anti-malware tool. Since the Reveton Trojan will usually be part of a larger malware attack on your computer, it is also a good idea to scan the infected computer’s hard drives with an updated anti-malware scanner.
 

Why Criminals Use the Reveton Trojan to Control Your Online Activity

The main component of a Reveton Trojan attack involves forcing the victim’s computer to visit malicious websites. Other symptoms may be present due to the effects of other malware components associated with the Reveton Trojan. ESG malware analysts have compiled the following list of common symptoms associated with Reveton Trojan activity in order to allow computer users to detect the presence of this threat on their computers:

1. The Reveton Trojan  has been associated with browser redirects taking computer users to attack websites, phishing websites or websites promoting known scams (such as rogue security programs). Phishing websites and attack websites may not be immediately apparent, so caution should be taken whenever your web browser forces you to visit a website without your authorization.
2. The Reveton Trojan has also been known to block websites dealing with computer security or promoting legitimate anti-virus products. Whenever the victim tries to visit these websites, they will be greeted with an error message claiming that these websites are infected with malware. In some cases, the Reveton Trojan will simply direct the victim to another web page.
3. Malware like the Reveton Trojan seldom plays well with other applications and will often hog your computer’s resources. Because of this, a common symptom of a Reveton Trojan infection is poor system performance, frequent system and application crashes, and poor connection speed.

 
ESG malware analysts have observed that the Reveton Trojan has been present along with rootkit infections as well as with known ransomware attacks. It has also been used to distribute rogue security software from the FakeVimes and VirusDoctor families of malware.

How Can You Detect Malware Files Related to ‘Reveton’?

Reveton Technical Report

As new Reveton details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for Reveton:

The following fake error message(s) appears for Reveton:

ATTENTION!
Location: United States
IPS: GTS Central Europe

Your PC is blocked due to at least one of the specified reasons below.
You have been violating Copyright and Related Right Live (Videos, Music, Software) and illegally using or distributing copyrighted content, thus infringing Article 1, Section B, Clause B, also known as the Criminal Code of United States of America…
To unlock the computer, you must pay the fine through MoneyPak of 100$ […]
When you pay the fine, your PC will get unlocked in 1 to 48 hours after the money is put into the State’s account.
In case an error occurs, you’ll have to send the code by email…

Important Article Disclaimer