November 25, 2015

Russian anti-virus company Doctor Web is announcing that it is making changes with regards to the conditions under which it renders free technical support services to Dr.Web users whose systems have been compromised by Trojan.Encoder encryption ransomware. Now support will only be rendered if—at the moment of infection—the affected PCs were running Dr.Web Security Space or Dr.Web Anti-virus for Windows 9.0 or later, Dr.Web Enterprise Security Suite (v.6+) and were under the protection of an active commercial Dr.Web license.

Our anti-virus laboratory receives an enormous number of requests for decryption―including those from users who purchased a Dr.Web license after an infection occurred. Meanwhile, starting with Dr.Web for Windows version 9, the anti-virus solution incorporates the Preventive Protection and Data Loss Prevention features which help prevent valuable information from getting damaged by encryption ransomware. Please recall that in most cases, decryption is not possible―even when contacting Doctor Web’s technical support service for assistance.

In accordance with the new rules, a user must have Dr.Web Security Space or Dr.Web Anti-virus for Windows 9.0 (or later), Dr.Web Enterprise Security Suite (v.6+) installed and operating under an active commercial license.

As before, free decryption services are only available for owners of active Dr.Web commercial licenses, the only amendment now being that the license must have been purchased before, not after the infection has been caused by encryption ransomware.

Please note that we strongly recommend that you do not pay attackers a ransom for decryption. For more information about encryption ransomware and the measures that should be taken in the event of infection, read our article "Encryption ransomware—Threat № 1".

You can request decryption here.