Doctor Web against extortion

September 5, 2008

Doctor Web has discovered a new version of an extortion Trojan (Trojan.Encoder.20) with new encryption and key generation mechanisms. Every user whose data has been compromised by the malware can download a free decryption utility from Doctor Web.

On August 13 Doctor Web reported a Trojan leaving a file with the demand to pay USD 10 for a decryption key. The program entered the Dr.Web database as Trojan.Encoder.19.

The beginning of September has seen a new modification of the Trojan. Sometimes a user is demanded to pay UER 30 or USD 89. All users of Dr.Web for Windows were protected from the Trojan even before a corresponding update has been released. It was successfully detected as Trojan.Encoder.origin by Origins Tracing™. As the previous version the new extortionist spreads via compromised web-sites exploiting vulnerabilities of Internet browsers.

Every user that fell victim of Trojan.Encoder.20 can download and use for free a decryption utility. The new version of the decryption program takes advantage of user-friendly GUI.

2008-09-05	Doctor Web against extortion
2008-09-04	One of the key players of Telecom market in Smolensk adopts Dr.Web AV-Desk
2008-09-02	Subscribers of leading ISP in Belgorod shielded by Dr.Web AV-Desk
2008-09-01	August virus activity review from Doctor Web
2008-08-28	Intersvyaz starts public testing of the Dr.Web anti-virus service
2008-08-25	Leading Russian manufacturer of weapons chooses Dr.Web
2008-08-22	Comprehensive protection from Dr.Web for subscribers of Teleos-1
2008-08-19	Improved version of GUI-scanner for Dr.Web for Windows released
2008-08-18	Dr.Web for Windows standard of anti-virus protection for executive bodies of Permskiy Kray
2008-08-13	Doctor Web has released a free decryption utility to counteract the new extortion Trojan.Encoder.19
2008-08-13	Dr.Web AV-Desk anti-virus covering for subscribers of Bashinformsvyaz
2008-08-08	Doctor Web: statement on Virus Bulletin comparative reviews
2008-08-08	Telnet secures its subscribers with Dr.Web anti-virus
2008-08-05	July 2008 virus activity review by Doctor Web
2008-08-01	Dr.Web AV-Desk now in Ulyanovsk region
2008-07-31	Dr.Web AV-Desk deployment summary by Eltel
2008-07-31	Dr.Web AV-Desk moves on in Moscow region
2008-07-24	Three regions of Moscow protected by Dr.Web AV-Desk
2008-07-23	Doctor Web releases new LinkChecker for Mozilla Firefox
2008-07-22	Dr.Web AV-Desk chosen by ISP "Hazynet" in Krasnoyarsk
2008-07-18	Doctor Web, Ltd. releases Active Directory installer for Dr.Web Enterprise Suite 4.44.3
2008-07-16	Dr.Web anti-virus now accessible to subscribers of Infocentre
2008-07-16	Doctor Web launches the beta-testing of Dr.Web for MIMEsweeper
2008-07-15	Anti-virus protection is delivered to subscribers of Lintecs by Dr.Web AV-Desk
2008-07-15	”Nauka-Sviaz” deployed Dr.Web AV-Desk
2008-07-15	Dr.Web AV-Desk adopted by three ISPs in Krasnoyarsk
2008-07-15	Dr.Web will protect Internet users of GlavSET
2008-07-14	Dr.Web anti-virus is the new service for subscribers of SZT
2008-07-14	Dr.Web AV-Desk deployed by MajaNet in Estonia
2008-07-12	Dr.Web AV-Desk will secure networks of Maginfo
2008-07-11	Corrected verson of Dr.Web SpIDer Guard 4.44 released
2008-07-11	Dr.Web for IBM Lotus Domino validated by IBM