In August last year, the company Dr Web reported the Trojan cryptographer Trojan.ArchiveLock. This malware uses file encryption standard archiver WinRAR. In order to spread malicious threats to use brute force to access the victim's computer via RDP. Once connected to the attacked workstation cybercriminals launch her Trojan. Obtaining control, Trojan.ArchiveLock.20 locates in one of the system folders application coder.
Trojan.ArchiveLock.20 then creates a list of files to be encrypted, and then empties the Recycle Bin, and removes stored on your computer data backups. Using a console application WinRAR coder puts user files to a predefined list in the password-protected archive, and the source data is destroyed using a special tool - recover deleted files then becomes impossible.
