Virus demands a ransom using NZ Police logo

Friday 25 October 2013, 10:59AM
By Jonas Banabaka


The New Zealand Police Virus, also called "Nga Pirihimana O Aotearoa", is focusing on user IPs located in New Zealand, and does target those in a rather evil way. This malware induces operating system to display a fearsome lock screen every time computer is being started. Scareware tries to frighten its preys by accusing them of storing child porn, pirated content of software, etc. An ordinary computer user cannot get around this fake page in any normal way.

To refrain from prosecution and get the ‘hostage’ system unbolted, gangsters are clamoring for the money charged by Ukash, a widely spread payment system, which utilizes vouchers sold in retail stores throughout the country. Unfortunately, there are a lot of obvious downsides of paying the fee.  The whole blocking scheme is in no way connected with the New Zealand Police. Government authorities never ask to pay fees with strange vouchers. And do you really think you can get yourself free from child porn accusations for just 300 dollars?

In the basis of this attack lays so called W32/Reveton Trojan, a very dangerous piece of code dispersed by highly effective exploits kits, particularly Blackhole. The main methods of infection take advantage of old versions of Java and PDF software. Nasty payloads typically happen in the background, even a geek will not notice anything.

Buying Ukash card and providing money to criminals, cannot remove the virus from your PC. After paying, even if you do not see the harmful page with a lock, your machine is still infected and can afflict you in a funny way someday.

Because of the nature of virus, traditional treatment with the help of antimalware products is hardly suitable. In addition, manual removal is complicated by the fact that access to system directory is blocked by the cunning guys.

After careful examination of this malware, computer experts put together several tips on how to utterly eradicate the New Zealand Police virus.