Quote:
Originally Posted by Vic911
Hello Bob. G,
I actually had my files on a Cruzer Drive, all the files on there seem to have been lost. My hard drive went out on my laptop and I replaced since, but still have not been able to recover the files. Anyone out there hnow to to recover them if they were and are still on this thumb drive. I have had the drive scanned and now it shows that the System file on the drive has a virus, but cannot delete it or fix it since the drive is locked/protected.
Vic
|
Virus keeps encrypted files in following directories:
\Documents and Settings\<user>\Local Settings\Application Data\CDD
\Documents and Settings\<user>\Local Settings\Application Data\FLR
if you cannot find them - make sure you have "view hidden files" option enabled in your explorer, and check all the <user> folders.
if the files in these folders are reported as infected by your antivirus - do not let him to delete or fix it - that's not true - they are not infected, just encrypted.
if other files are reported infected and cannot be deleted - you can try to do a full scan in Safe Mode.
but before that export your "HKEY_LOCAL_MACHINE\SOFTWARE\Fcd" entry into some backup file - you will need it to decrypt your files later. otherwise if you antivirus deletes that registry key - you won't be able to recover your files.
if you provide more info - i could be more helpful.