September 5, 2008

Doctor Web has discovered a new version of an extortion Trojan (Trojan.Encoder.20) with new encryption and key generation mechanisms. Every user whose data has been compromised by the malware can download a free decryption utility from Doctor Web.

On August 13 Doctor Web reported a Trojan leaving a file with the demand to pay USD 10 for a decryption key. The program entered the Dr.Web database as Trojan.Encoder.19.

The beginning of September has seen a new modification of the Trojan. Sometimes a user is demanded to pay UER 30 or USD 89. All users of Dr.Web for Windows were protected from the Trojan even before a corresponding update has been released. It was successfully detected as Trojan.Encoder.origin by Origins Tracing™. As the previous version the new extortionist spreads via compromised web-sites exploiting vulnerabilities of Internet browsers.

Every user that fell victim of Trojan.Encoder.20 can download and use for free a decryption utility. The new version of the decryption program takes advantage of user-friendly GUI.