Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Files have been encrypted by an Encoder Trojan

Encoder Trojans are notorious for encrypting data on compromised computers. Such data can be recovered. If you are a Dr.Web user, contact Doctor Web's technical support service as soon as possible.

Caution!

  • Do not use the infected computer until you receive instructions from Doctor Web's technicians, even if you need it for your business.
  • Do not attempt to reinstall the operating system!
  • Do not attempt to remove any files or programs from the disk!
  • If you have started a virus scan, do not take any irreversible actions including curing/removing the malware. Consult Doctor Web's specialists before you do anything with the found viruses/Trojans, or at least keep back-up copies of all the discovered malware; they may be necessary to determine the key to decrypting the data.

How to submit a request to Doctor Web's support service

  1. Doctor Web’s technical support service provides free decryption only to owners of valid Dr.Web commercial licenses for Dr.Web Security Space and Dr.Web Anti-virus 9-11, Dr.Web KATANA (with terms of 12 months or longer) and Dr.Web Enterprise Security Suite (with terms of 6 months or longer) as well as to Dr.Web anti-virus service subscribers (Dr.Web Classic and Dr.Web premium subscription packages) if the compromised system had Dr.Web installed in it at the moment of infection.
  2. Fill out the request form at support.drweb.com/new/free_unlocker.
  3. Provide as much information about the incident as possible, including the demands of the intruders. If you have an idea as to which file you opened to launch the Trojan, please attach the corresponding file(s) or link(s) to your support request.
  4. Use the comment field of the request form to attach several encrypted files (if possible, different file types and sizes: JPG, ZIP, DOC, PDF, etc.) and the ransom demand text.
  5. If the Trojan penetrated the system via email (such Trojans often arrive with ostensible notices from banks) and you have not removed the email, save it into an EML file and attach the file to your request.

We strongly recommend that you file a report with the police.

A criminal offence has been committed against you. Law enforcement authorities need your formal complaint (i.e., a legal reason) to initiate a criminal case against the perpetrators.

Be prepared to have your computer temporarily removed for examination.

If your request for assistance is refused, obtain a written waiver and forward your complaint to a higher police authority—the chief of police in your place of residence..

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124