I followed your location to the scrambled files... if you "import" them in to Word, the first line in the file tells you the original location and name of the file.
EG: in the CCD folder, the file called "fcd1A00" has the first line as
"wamba00000050C:\Program Files\Microsoft Office\Clipart\corpbas\J0078849.JPG"
I'll try to restore it somehow and post up. Looks like a one-by-one restore may be the only solution.
*sigh*
Quote:
Originally Posted by max
My computer has this problem too. It appears to wipe out all .doc, .xls, .jpg, and .txt files on a computer and replaces them all with files that say "FileError_22001". Malwarebytes ( Malwarebytes.org) has a scanning tool that seems to remove the virus, but it does not restore the lost files.
On my machine, the lost files appear to have been relocated in two directories, where they seem to have been scrambled and renamed with the file extension ".fcd". The directories containing these files are:
\Documents and Settings\<username>\Local Settings\Application Data\CDD, and
\Documents and Settings\<username>\Local Settings\Application Data\FLR.
Again, I have not seen any method posted for restoring the lost files, but it does appear that this should be possible. My guess is that the virus was intended to scramble people's critical data files so that the perpetrator could extort money out of users by selling the "solution". |