My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets


Files have been encrypted by an Encoder Trojan

Encoder Trojans are notorious for encrypting data on compromised computers. Such data can be recovered. If you are a Dr.Web user, contact Doctor Web's technical support service as soon as possible.


  • Do not use the infected computer until you receive instructions from Doctor Web's technicians, even if you need it for your business.
  • Do not attempt to reinstall the operating system!
  • Do not attempt to remove any files or programs from the disk!
  • If you have started a virus scan, do not take any irreversible actions including curing/removing the malware. Consult Doctor Web's specialists before you do anything with the found viruses/Trojans, or at least keep back-up copies of all the discovered malware; they may be necessary to determine the key to decrypting the data.

How to submit a request to Doctor Web's support service

  1. Doctor Web’s technical support service provides free decryption only to owners of valid Dr.Web commercial licenses for Dr.Web Security Space and Dr.Web Anti-virus 9-11, Dr.Web KATANA (with terms of 12 months or longer) and Dr.Web Enterprise Security Suite (with terms of 6 months or longer) as well as to Dr.Web anti-virus service subscribers (Dr.Web Classic and Dr.Web premium subscription packages) if the compromised system had Dr.Web installed in it at the moment of infection.
  2. Fill out the request form at
  3. Provide as much information about the incident as possible, including the demands of the intruders. If you have an idea as to which file you opened to launch the Trojan, please attach the corresponding file(s) or link(s) to your support request.
  4. Use the comment field of the request form to attach several encrypted files (if possible, different file types and sizes: JPG, ZIP, DOC, PDF, etc.) and the ransom demand text.
  5. If the Trojan penetrated the system via email (such Trojans often arrive with ostensible notices from banks) and you have not removed the email, save it into an EML file and attach the file to your request.

We strongly recommend that you file a report with the police.

A criminal offence has been committed against you. Law enforcement authorities need your formal complaint (i.e., a legal reason) to initiate a criminal case against the perpetrators.

Be prepared to have your computer temporarily removed for examination.

If your request for assistance is refused, obtain a written waiver and forward your complaint to a higher police authority—the chief of police in your place of residence..

Dr.Web © Doctor Web
2003 — 2022

Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies