OREANDA-NEWS. April 26, 2012. The Russian anti-virus vendor Doctor Web warns Western-European users of a spam mailing that spreads Trojan.Encoder ransomware.

The number of requests to Doctor Web's Technical support service from Western European users, who received an e-mail with the subject "Ute Lautensack Vertrag Nr 46972057" has increased in the last 24 hours. The e-mail contains the following text:

Sehr geehrte(r) Ute Lautensack,
 Sie haben sich fur unseren Mail Upgrade eingetragen und wir freuen uns Sie als unseren frischen Teilnehmer zu begrussen Sie konnen jetzt bis zu 500 Mitteilungen pro Monat frei versenden und Ihr Speicherplatz erhoht sich um 5 Gb.

433,29 Euro fur Registration werden Ihnen pro 12 Monate im Vorraus von Ihrem Bankkonto abgeschrieben. Entnehmen Sie die Rechnungsdaten bitte dem Anhang, dort finden Sie auch die Erlauterung fur Ihre 2 Wochen Kundigungsfrist. 

 Mit freudlichen Grussen
 Ihr Kundenservice

An archive file named Abrechnung or Rechnung can be attached to the message. If the attached application is launched, the Trojan encrypts files found on hard disks.

A warning from Doctor Web: do not open attachments in these e-mails! If the Trojan has encrypted files on your computer, follow the guidance below to avoid loss of valuable information:
Notify the police.
Never attempt to solve the problem by reinstallling the operating system.
Do not delete any files from the heard drives.
Do not try to restore the encrypted data on your own.
Contact Doctor Web's virus laboratory When file a request, select Request for curing. This service is provided free of charge.
Attach a file encrypted by the Trojan to the ticket.
Wait for a response from a virus analyst. Due to the large number of requests it may take some time.