Files have been encrypted by an Encoder Trojan

Encoder Trojans are notorious for encrypting data on compromised computers. Such data can be recovered. If you are a Dr.Web user, contact Doctor Web's technical support service as soon as possible.

Caution!

Do not use the infected computer until you receive instructions from Doctor Web's technicians, even if you need it for your business.
Do not attempt to reinstall the operating system!
Do not attempt to remove any files or programs from the disk!
If you have started a virus scan, do not take any irreversible actions including curing/removing the malware. Consult Doctor Web's specialists before you do anything with the found viruses/Trojans, or at least keep back-up copies of all the discovered malware; they may be necessary to determine the key to decrypting the data.

How to submit a request to Doctor Web's support service

Doctor Web’s technical support service provides free decryption only to owners of valid Dr.Web commercial licenses for Dr.Web Security Space and Dr.Web Anti-virus 9-11, Dr.Web KATANA (with terms of 12 months or longer) and Dr.Web Enterprise Security Suite (with terms of 6 months or longer) as well as to Dr.Web anti-virus service subscribers (Dr.Web Classic and Dr.Web premium subscription packages) if the compromised system had Dr.Web installed in it at the moment of infection.
Fill out the request form at support.drweb.com/new/free_unlocker.
Provide as much information about the incident as possible, including the demands of the intruders. If you have an idea as to which file you opened to launch the Trojan, please attach the corresponding file(s) or link(s) to your support request.
Use the comment field of the request form to attach several encrypted files (if possible, different file types and sizes: JPG, ZIP, DOC, PDF, etc.) and the ransom demand text.
If the Trojan penetrated the system via email (such Trojans often arrive with ostensible notices from banks) and you have not removed the email, save it into an EML file and attach the file to your request.

We strongly recommend that you file a report with the police.

A criminal offence has been committed against you. Law enforcement authorities need your formal complaint (i.e., a legal reason) to initiate a criminal case against the perpetrators.

Be prepared to have your computer temporarily removed for examination.

If your request for assistance is refused, obtain a written waiver and forward your complaint to a higher police authority—the chief of police in your place of residence..

— 俄罗斯Dr.Web反病毒产品研发厂商

— 研发始自1992年

— Dr.Web产品用户遍布世界200多个国家

— 2007年起提供反病毒服务

— 全天支持

Doctor Web公司是俄罗斯信息安全反病毒保护产品厂商，产品商标为Dr.Web。Dr.Web产品研发始自1992年。

隐私政策

我们在社交媒体

绑定账号

其他Dr.WEB资源

网站导航

Your browser is obsolete!

解密

培训

科普

«反病毒真相！»

法制角

病毒事件鉴定

法制角

紧急措施

品牌保护

法制角