05-19-2012 04:10 AM
Hi my laptop was infected with the west yorkshire police virus. I have managed to get rid of it off my computer but my files are still locked. I have used the matsnu1 Decryptor but it doesn't work for me .
Grateful for any help
05-20-2012 01:06 AM
I had the same thing yesterday my norton has expired, got it while i was installin my new norton 360 got rid of the virus now have locked files to ive started to delete them even some of my games were locked.
some of the files ive found are YWMY,TJOO,XJQF,NXDQ,ZRZS,BBIH.
ive no idea what these file types are but sales locked-then file name so ive deleted them.
05-20-2012 01:19 AM
You have deleted files including the Ransomware codes there quite possibly nothing someone can do due to possible hidden codes needed you have deleted.
You should not have gone about doing what you are doing without knowing the exact variant and knowing if there are any hidden codes
05-20-2012 02:17 AM
ive only deleted the files form the games folders i havent gone into windows or other programs which the computer uses, i ran norton several times and upgreaded to 360 V6 and that has found notthing. Is there any other programs i can/should use to look jsut to make sure i havent missed anything.
05-27-2012 02:27 AM
2 Tools available, You have to make sure you have broiken and deleted the actual Ransomware files first before running the drycrypt tools for your personal files.
When you run it, it asks for an unencrypted file and the corresponding encrypted version, all you need is one unencrypted copy and it's corrosponding encrypted version, whether you get the unencrypted version from another PC or from a backup set . Point it to the relevant files via the usual file selection, once it works out the encryption used for your copy of the wide Fake Police ransom family it will scan the rest of the Hard drive(s) for the rest of the encrypted files and decrypt all of those whether just one more file or over 1,000 files.
But make sure you have enough Hard Drive space available otherwise the output files will = 0kb in size.
Looks like it uses the same random-ish encryption key for all the files that it affects on a particular machine, hence by providing just one original and its corresponding encrypted version the tool is able to decrypt all files on that system..
After you make sure you have all the files back and YAY!!!!!!!! you have to delete the encrpted versions yourself.
Tool number 2 is http://support.kaspersky.com/faq/?qid=208286527
Instructions on that page, for this wider family.