MayArchive.B

Please note that disinfection of this trojan has to be done AFTER it restores your files. Otherwise you will not be able to restore your files that the trojan put into its EncryptedFiles.als archive. So if you have been infected with this trojan, and it has created the Demo.als and EncryptedFiles.als files on your hard drive, then please follow the below given instructions:

• Open Windows Explorer and locate EncryptedFiles.als
• Doubleclick on the EncryptedFiles.als file
• Click OK in the messagebox that has the 'Read INSTRUCTIONS to get your files back' text
• In the new window click the Extract button
• In the password prompt window input this password exactly as shown: AssociateFileExtension
• Press Enter
• Wait until the trojan extracts all of the files and then close the application window

The trojan should restore files to your\My Documents\ folder. Please verify that your files have been restored. You can then proceed to disinfection. Disinfection of this trojan requires deletion of the trojan's file from you hard drive. You can do it manually or you can follow:

these instructions

F-Secure Anti-Virus should delete or rename the trojan's file after it finds the infection.

Please note that due to bugs in the trojan's code some of your files may become corrupted.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

• Check for the latest database updatesFirst, check if your F-Secure security program is using the latest updates, then try scanning the file again.
• Submit a sampleAfter checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
• Exclude a file from further scanningIf you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.Note: You need administrative rights to change the settings.