Not what you were looking for? Ask our experts!
Reply
Newbie
slimgraham
Posts: 2
Registered: ‎05-19-2012

locked files west yorkshire police virus

Hi my laptop was infected with the west yorkshire police virus. I have managed to get rid of it off my computer but my files are still locked. I have used the matsnu1 Decryptor  but it doesn't work for me .

Grateful for any help

Graham

Bot Obliterator
Quads
Posts: 16,529
Registered: ‎07-21-2008

Re: locked files west yorkshire police virus

What is the extension of the files to be decrypted??

 

Quads

Newbie
thomas235
Posts: 2
Registered: ‎05-20-2012

Re: locked files west yorkshire police virus

I had the same thing yesterday my norton has expired, got it while i was installin my new norton 360 got rid of the virus now have locked files to ive started to delete them even some of my games were locked.

some of the files ive found are YWMY,TJOO,XJQF,NXDQ,ZRZS,BBIH.

ive no idea what these file types are but sales locked-then file name so ive deleted them.

Bot Obliterator
Quads
Posts: 16,529
Registered: ‎07-21-2008

Re: locked files west yorkshire police virus

You have deleted files including the Ransomware codes there quite possibly nothing someone can do  due to possible hidden codes needed you have deleted.

 

You should not have gone about doing what you are doing without knowing the exact variant and knowing if there are any hidden codes

 

Quads

Newbie
thomas235
Posts: 2
Registered: ‎05-20-2012

Re: locked files west yorkshire police virus

ive only deleted the files form the games folders i havent gone into windows or other programs which the computer uses, i ran norton several times and upgreaded to 360 V6 and that has found notthing.  Is there any other programs i can/should use to look jsut to make sure i havent missed anything.

Bot Obliterator
Quads
Posts: 16,529
Registered: ‎07-21-2008

Re: locked files west yorkshire police virus

 "got rid of the virus now have locked files to ive started to delete them even some of my games were locked."

 

The Ransomware itself has codes.

 

Quads

Bot Obliterator
Quads
Posts: 16,529
Registered: ‎07-21-2008

Re: locked files west yorkshire police virus

2 Tools available,  You have to make sure you have broiken and deleted the actual Ransomware files first before running the drycrypt tools for your personal files.

 

matsnu1decrypt.exe   

When you run it, it asks for an unencrypted file and the corresponding encrypted version, all you need is one unencrypted copy and it's corrosponding encrypted version, whether you get the unencrypted version from another PC or from a backup set . Point it to the relevant files via the usual file selection, once it works out the encryption used for your copy of the wide Fake Police ransom family it will scan the rest of the Hard drive(s) for the rest of the encrypted files and decrypt all of those whether just one more file or over 1,000 files.

 

But make sure you have enough Hard Drive space available otherwise the output files will = 0kb in size.

 

Looks like it uses the same random-ish encryption key for all the files that it affects on a particular machine, hence by providing just one original and its corresponding encrypted version the tool is able to decrypt all files on that system..

 

After you make sure you have all the files back and YAY!!!!!!!!  you have to delete the encrpted versions yourself.

 

 

Tool number 2 is http://support.kaspersky.com/faq/?qid=208286527

Instructions on that page, for this wider family.

Quads