herman1134 is slowly decrypting his files using the decrypt tool, Tons of them
ap123456 Disappeared, maybe has used the decrypt tool and hasd success, as if unhappy they usually come back
Ih I don't told much hope as you have no password available.
Quads
Quads,
I'll keep checking back and hope for the best!
-lh
Hello..sorry to intrude like this but I was afflicted with the exact same problem and probably did eveything wrong about handling it and now I have removed the problem but my files are still encrypted too.
Something you just said Quads about the encryption without a password struck me because the text file that it creates everywhere on the computer says that if I wish to test the validity of their solution that I can send one file to them and they will decrypt it, but I must tell them MY ID...which makes me wonder if they have a decrypter that does not need the registry info at all, but only the ID as some kind of parameter in the algorithm, otherwise they would request the actual reg_key to be sent as well.
You have removed all to do with Trojan.Encoder.141 already then there is nothing I can do. I do not deal with the malware creators so I have no idea what that are up to.
Bye.
Quads
Please Mr. Quads, I am not impying that you should deal with them at all...I am in agreement with your stance on that particular matter.
I was only bringing the point up because it seemed odd to me that the solution you were investigating focused on the regsitry keys while the malware creators themselves say they only need the ID to decrypt the files.
I thought this might mean the solution could be approached from a different angle.
I did not mean to offend!
Sorry guys, i was away from this forum and browsing for the past week and a half because i was trying to use the testdisk program to try to recover my files. i think i recovered most of my jpgs, but pdfs and docs, that were my primary goal in the recovery process, were not recovered. I will read all the posts I've missed since I was gone.
One thing I am not sure about is whether the file that caused the crypt problem has been removed or not. I know that I used norton to "clean" but I did not specifically search my computer for the file to remove it. Does this mean its still on my computer?
So right now, I am rereading all the posts from this topic. Hold on.
".........................because i was trying to use the testdisk program to try to recover my files......................."
Gone off on your own, even though a program was created (though only quickly tested by myself and another) so there is nothing I can do for you either. I have no idea what programs you used or what has been removed.
Good luck, if you can't get files back, it's just a matter of OH WELL.
Quads
I used the photorec program. i didnt touch the registy or search for any files. I didnt move the crypt files either. I only used that program and I guess it made duplicates of all the files on my computer onto a seperate external drive. Reading this forum, I think I didnt break any of your rules and warnings. I just tried the photorec program and it didnt completely help. I read that you have tested out a program that should solve the problem if the users didnt alter the registry files. I am sure I didnt do that. I tried to look for the program you were talking about but I couldnt find it on this forum and I tried clicking the bleeping computer link and the link doesnt work.
The site with the download link is down at the moment there is nothing I can or will do for you seperate as you went off on your own, it's that simple.
Ask for help but then think better of it and go off on your own, So as I say good luck.
Quads
Im sorry Quads. I sent you a message.
The section of the site has now bee fixed http://www.bleepingcomputer.com/forums/topic455347.html
Quads
Looks like it is a new variant because it didnt work for me.
I know that i did not go to the registry. I am sure about it. That was an early warning on this thread and I followed it. I dont know what to do now. Maybe Norton removed it?
Norton did not remove the registry key for me.
You went away and did your own thing, so good luck
Quads
Quads. I explained my situation in the message I sent you. I had a family issue that required me to rush and retrieve photos that were lost. I followed every rule you required. I went away due to a family request for photos. I was always keeping in mind your warnings. I only used photorec to get the photos. I followed every other rule you said to follow. I did all the steps. I knew it wasnt the solution but I desperately needed the photos. I always intended to come back here to see the full solution from you. So I’m sorry. I would just like to know what I can do to get the work docs and pdfs that are very important for my job.
Nothing, they are encryped with AES256
If they are or were that important you should have backups
Quads
Since that program doesn’t work, absolutely nothing can be done? Has anyone else been successful with getting their files back?
One person has used the program, and done as I said to use the key and got their files back, because they have an intact key. They even stated on the thread.
I have also stated on the thread about AES256 I am not going to say again.
The only other possilbe way is to do a algorithm Hard Drive recovery that scans cluster by cluster looking for files by algorithm even when undelete and unformatting does not work, like when the hard drive is screwed or corrupt, I have done this for people.
It can take Hours on end as it depends on how bad the drive and how big.
I have got files back from a HD that has had 2 reformats and a drive corruption, to get 9 DVD's of personal files.
Quads
How do I find out if I have an intact key? I know I did not go near the registry so would I still have an intact key?
I am not starting that again, I started with you and you disappeared
Quads
But I told you why I disappeared. I need to retreive photos for my family. It tooks awhile. The computer was occupied with that. I was doing something for my family. Now I need to do something for myself and my work. I need to get the docs and pdfs back for my job. Can you please help me? Consider that I was just trying to help others before I was helping myself. Please. One time, last time.? Or atleast tell me the steps and I will do them myself. Please.