Issue
- Your personal files became encrypted
- Your files are prefixed by a string “locked-” and an additional file extension is appended to your files
- Your ESET product detects the infection Win32/Trustezeb.A or your third-party security products says “Matsnu”
- Users are told they have pay 50 or 100 Eur via Paysafecard or Ukash payment services
- Decrypt your files using the ESETTrustezebAdecoder.exe tool
- You receive the following message on your computer (for example in German):
“Die von Ihnen verwendete Windows Lizenz ist abgelaufen.”
“Achtung. Schalten Sie in der Zeit Ihren PC nicht aus und halten Sie diet Internetverbindung aufrecht,…”
Click the image to view larger in new window
Details
See also our detailed information about this malware at welivesecurity.com in German:
Solution
- Download the ESETTrustezebAdecoder.exe tool and save the file to your Desktop.
- Double-click ESETTrustezebAdecoder.exe on your Desktop to run the cleaner.
- Click the Decode button.
- When prompted, select your Desktop folder to decrypt all encrypted files in your Desktop and Desktop’s subdirectories. To decrypt a different folder, for example, all in the C drive, select C:.
- The FilecoderAR cleaner tool will run. If an infection is discovered, TrustezebA cleaner will decode the file and display the “Decoded and written: x file(s)” message.
Figure 1-1
Last Updated: Oct 15, 2019
(Visited 55 times, 1 visits today)