August 13, 2008

Doctor Web reveals a new Trojan that encrypts files on a user machine. The malware has entered the Dr.Web database as Trojan.Encoder.19. The Trojan places the crypted.txt file on a hard drive of an infected system offering a user to pay 10$ for decryption of his files.

Your files have been encrypted!
The decryption utility costs 10$!
More:
http://decryptor.******
E-mail: decryptor2008@******
ICQ: *******
S/N BF_3-pUChT$+bm5
Do not delete or modify the file!!!

This version of Trojan.Encoder.19 checks all drives available (excluding removable) and encrypts files with the following extensions:
.jpg, .jpeg, .psd, .cdr, .dwg, .max, .mov, .m2v, .3gp, .asf, .doc, .docx, .xls, .xlsx, .ppt, .pptx,
.rar, .zip, .db, .mdb, .dbf, .dbx, .h, .c, .pas, .php, .mp3, .cer, .p12, .pfx, .kwm, .pwm, .sol, .jbc, .txt, .p

Analysts from Doctor Web have created a decryption utility so any user can download it for free and cure his machine.

How to use.
Start the decryption process for the entire C: drive. Launch the program as follows:
te19decrypt.exe [path]
e.g.:
te19decrypt.exe c:\

Files on the C drive modified by the Trojan will be decrypted. When the decryption process is completed, decrypted copies of encrypted files without the .crypt extension will appear next to encrypted ones. Do not delete encrypted files because incorrect decryption is still possible.

If you are unable to decrypt a certain file, please send cryted.txt found in the root directory of your C drive and several samples of encrypted files at vms@drweb.com.

Due to the huge influx of requests from users of other anti-virus products, effective June 19, 2013, Doctor Web's support service is providing its free decryption service only to users of Dr.Web products.