Norton 360

[Quads]

herman1134  is slowly decrypting his files using the decrypt tool, Tons of them

ap123456  Disappeared, maybe has used the decrypt tool and hasd success, as if unhappy they usually come back

Ih   I don't told much hope as you have no password available.

Quads

[lh]

Quads,

I'll keep checking back and hope for the best! 

-lh

[marcel71]

Hello..sorry to intrude like this but I was afflicted with the exact same problem and probably did eveything wrong about handling it and now I have removed the problem but my files are still encrypted too.

Something you just said Quads about the encryption without a password struck me because the text file that it creates everywhere on the computer says that if I wish to test the validity of their solution that I can send one file to them and they will decrypt it, but I must tell them MY ID...which makes me wonder if they have a decrypter that does not need the registry info at all, but only the ID as some kind of parameter in the algorithm, otherwise they would request the actual reg_key to be sent as well.

[Quads]

You have removed all to do with Trojan.Encoder.141 already then there is nothing I can do.    I do not deal with the malware creators so I have no idea what that are up to.

Bye.

Quads

[marcel71]

Please Mr. Quads, I am not impying that you should deal with them at all...I am in agreement with your stance on that particular matter. 

I was only bringing the point up because it seemed odd to me that the solution you were investigating focused on the regsitry keys while the malware creators themselves say they only need the ID to decrypt the files. 

I thought this might mean the solution could be approached from a different angle.

I did not mean to offend!

[ap123456]

Sorry guys, i was away from this forum and browsing for the past week and a half because i was trying to use the testdisk program to try to recover my files. i think i recovered most of my jpgs, but pdfs and docs, that were my primary goal in the recovery process, were not recovered. I will read all the posts I've missed since I was gone. 

One thing I am not sure about is whether the file that caused the crypt problem has been removed or not. I know that I used norton to "clean" but I did not specifically search my computer for the file to remove it. Does this mean its still on my computer?

 So right now, I am rereading all the posts from this topic. Hold on.

[Quads]

".........................because i was trying to use the testdisk program to try to recover my files......................."

Gone off on your own,  even though a program was created (though only quickly tested by myself and another) so there is nothing I can do for you either.  I have no idea what programs you used or what has been removed.

Good luck, if you can't get files back, it's just a matter of OH WELL.

Quads 

[ap123456]

I used the photorec program. i didnt touch the registy or search for any files. I didnt move the crypt files either. I only used that program and I guess it made duplicates of all the files on my computer onto a seperate external drive. Reading this forum, I think I didnt break any of your rules and warnings. I just tried the photorec program and it didnt completely help. I read that you have tested out a program that should solve the problem if the users didnt alter the registry files. I am sure I didnt do that. I tried to look for the program you were talking about but I couldnt find it on this forum and I tried clicking the bleeping computer link and the link doesnt work. 

[Quads]

The site with the download link is down at the moment  there is nothing I can or will do for you seperate as you went off on your own, it's that simple.

Ask for help but then think better of it and go off on your own,  So as I say good luck.

Quads

[ap123456]

Im sorry Quads. I sent you a message.