Remove ODCODC Ransomware and Restore .odcodc Files - How to, Technology and PC Security Forum |

Remove ODCODC Ransomware and Restore .odcodc Files


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by ODCODC and other threats.
Threats such as ODCODC may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

odcodc-ransomware-skull-art-acsii-master-boot-record-dropbox-uniqueA ransomware that uses one of the most often used ransom messages, encrypting files with a strong cipher has been the reason for several reports of affected victims. The ODCODC ransomware (also known as crypto-virus) sets the .odcodc file extension to the newly encrypted files and leaves a “readthis.txt” ransom note. Users who have been infected with the ODCODC ransomware are advised to remove this ransomware immediately and try one of the file restoration methods illustrated after this article.

UPDATE! There has been a decryptor released for ODCODC Ransomware. You can download it from the following link

Threat Summary

Short DescriptionThe ransomware may encrypt files with the RSA-2048 cipher and asks a ransom payment for decryption.
SymptomsFiles are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a readthis.txt file.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by ODCODC


Malware Removal Tool

User ExperienceJoin our forum to Discuss ODCODC Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

ODCODC Ransomware – How Is It Distributed

In order to be widespread, ODCODC Ransomware may use several different techniques to be spread out, but the main possibilities are:

Malicious files.
Malicious URLs.

Such may be spread in various ways, varying from malicious e-mail attachments to malicious URLs shared on various suspicious websites.

ODCODC Ransomware In Detail

Once activated on the computer, ODCODC ransomware may drop its payload files in one of the several folders:

  • %AppData%
  • %Temp%
  • %Roaming%
  • %User’s Profile Folder%
  • %Windows%
  • %Desktop%

The files may be more than one and may be of the following file formats:

→ .dll, .txt, .exe, .tmp, .vbs, .bat, .cmd

They may contain random names or names that resemble a Windows process, for example, “svchost.exe”. The .tmp files are usually dropped in the %Temp% folder.

After the malicious files have been dropped, the ODCODC ransomware may employ a powerful RSA or AES encryption to files with the following extensions:

After encrypting the files of affected users, ODCODC ransomware may delete the shadow volume copies of the infected computer, eradicating any possibility of files being recovered from backups. This can happen by executing a .vbs script with the following administrative command:


After this is done, the ransomware may create a “readthis.txt” file with the following ransom message:

→ “Your personal files are encrypted!
What happened to your files?
All of your files were protected by a strong encryption with RSA-2048.
What does this mean?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you cant restore them.
What to do?
We can recover your files. You can trust us, for proof of this we can decrypt some your files for free.
How to contact you?
Write us to email: [email protected]
Ваши персональные файлы зашифрованы!
Что случилось с файлами?
Все ваши файлы зашищены криптостойким алгоритмом RSA-2048.
Что это значит?
Это значит, что структура и содержимое ваших файлов потерпили необратиме изменения, вы не можете с ними работать, читать или видеть, это тоже самое, что потерять их бесповоротно, но, с нашей помощью, вы можете их все восстановить.
Что мне делать?
Мы можем полностью восстановить доступ к вашим файлам. Вы можете нам доверять, доказать честность и серьезность наших намерений мы можем бесплатной расшифровкой нескольких файлов.
Как с вами связаться?
Напишите нам на почту: [email protected]Source:Affected Users

ODCODC Ransomware – Conclusion, Removal, and File Restoring

The bottom line for this variant of crypto-malware is that it may be part of the Rakhni or Troldesh variants. Judging by the badly written ransom note in Russian, it has been created for Russian users, but it may not originate from Russia. Such files may be decrypted via Rakhni decryptor by Kaspersky, which we have posted along with other file restoration methods in step “3. Restore files encrypted by ODCODC” below.

However, if you want to try and restore your files, we advise you to either do it on a safe computer or follow the removal instructions below to remove the malware from your PC. They are methodologically arranged to help detect and remove ODCODC ransomware effectively.

Finally, we advise you to follow this article for further updates on ODCODC ransomware and in the meantime to try the methods from step “3” below to attempt and restore your files. They may not be 100 percent successful, but there is a possibility that you might be able to revert at least some of your files.

Note! Your computer system may be affected by ODCODC and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as ODCODC.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove ODCODC follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove ODCODC files and objects
2. Find files created by ODCODC on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by ODCODC

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share