.EnCiPhErEd virus?

hello, got a phone call from a friend of mine. he says all his files have .EnCiPhErEd written behind them. any clues?

was a bit short on details, sorry. anyways, found a way to fix this
http://groups.google.com/a/googleproductforums.com/forum/#!topic/gmail/qo0xd0MM1Z8

Found the fix here :
http://forums.majorgeeks.com/showthread.php?t=257283

Heya,
We got this Encoder-trojan infecting some user shares on our file server yesterday.
I sent a request to drweb.com with the trojan-file and a couple .EnCiPhErEd files.

Today i got the answer from drweb with the solution:

Vladimir Martyanov via RT <vms@drweb.com>

Download this program ftp://ftp.drweb.com/pub/drweb/tools/te94decrypt.exe and start it with command line parameters -k 85

It will decrypt files.




We're running the program on our server as we speak, and it is decrypting files very fast, successfully.

So for anyone with this problem, try this to get your files back!

HI all!

Because of the versatility of this trojan.encoder there are many type of encoding scheme, so do the following:

1. Go to https://vms.drweb.com/sendvirus/?lng=en
2. Upload one of your ciphered file
3. At submission category select "request for curing"
4. Fill in your email
5. Write a few words at description if you like
6. Click SEND

In minutes Vladimir Martyanov will personally respond to your request sending you a link to the last version of the "cure" and comand line instructions.

Hello,

Here is a removal guide http://www.anvisoft.com/wiki/how-to-remove-trojan.ransom.hm.html

Hope it helpful