XDocCrypt/Dorifel/Quervar

[FanJ]

Hi ESET,

Siljaline was so kind to post in the other thread a link to David Harley's ESET blog.

I see that ESET has also an article in the Threat Encyclopaedia with a removal tool called ESETQuervarCleaner.exe.

My question is: does this removal tool also fully decrypt and recover the by this malware encrypted Office files?

[FanJ]

PS for David Harley :

You wrote in the blog:

Martijn Grooten, of Virus Bulletin, tells me that it has attracted the attention of telephone support scammers, who are using it to convince potential victims in the Netherlands that they need to let the scammer ‘clean’ or ‘protect’ their systems. For a price, as always…

Yes, the official Dutch "National Cyber Security Centrum" is warning for that in its Dutch article.
See the part following "UPDATE 10 AUGUSTUS 2012 14:45".
(note: it is in Dutch).

[siljaline]

It might be more prudent to pose your query directly to the Blog entry:
http://blog.eset.com/2012/08/11/dori...-secret-weapon, as David Harley does not support ESET via Wilders.

I have asked that the removal tool be included in the other stand-alone removal tools.

[FanJ]

Originally Posted by siljaline

It might be more prudent to pose your query directly to the Blog entry:
http://blog.eset.com/2012/08/11/dori...-secret-weapon, as David Harley does not support ESET via Wilders.

I wasn't asking for support from David Harley here and it wasn't a query (as in: "query" meaning a "question"). It was meant as a tip or extra info: giving the link of the official site where that info is posted. That's all. But you're right, this might not be the right place. Anyway, up to Eset whether to inform David Harley about it or not.

I have asked that the removal tool be included in the other stand-alone removal tools.

That seems fine to me.
I am only asking for a little bit more clarification about the Eset removal tool because I know that at another site, which I already mentioned in the other thread, there is (among other things) discussion about which AV products can detect and clean it and bring infected Office files back to their original status.

[siljaline]

Please see: this reply. Thanks to ESET for the updated removal tool.