Hello, my english is very bad, but could you help me? the te33decrupt says unable to find first key. Pc not infected? What can I do.Could you please explain me in simple words, because I can´t understand the posts here very well? thank you soo much. Angiie.

Download and execute FCDInfo.exe:
SourceForge.net: FE22001 decryptor: Files
copy/paste the output of the program here, and we'll see what can we do in your case.

i've finished the initial version of decryption utility for testing.
now it should be able to find both encryption keys and decrypt all encrypted files.

download deFE22001.exe:
https://sourceforge.net/project/plat...platform=12963
save it a folder and execute. it will create "recover" folder with decrypted files keeping original directory structure.

1. if HKLM\Software\Fcd registry entry is absent - it won't be able to decrypt
2. make sure you have enough space to hold decrypted files on a disk which you run utility from
3. encrypted files should be in <app_data>/CDD and /FLR folders - exactly as the virus left the encrypted there

any comments/questions/feedback are welcomed.

Hello Bob. G,
I actually had my files on a Cruzer Drive, all the files on there seem to have been lost. My hard drive went out on my laptop and I replaced since, but still have not been able to recover the files. Anyone out there hnow to to recover them if they were and are still on this thumb drive. I have had the drive scanned and now it shows that the System file on the drive has a virus, but cannot delete it or fix it since the drive is locked/protected.

Vic

Virus keeps encrypted files in following directories:
\Documents and Settings\<user>\Local Settings\Application Data\CDD
\Documents and Settings\<user>\Local Settings\Application Data\FLR
if you cannot find them - make sure you have "view hidden files" option enabled in your explorer, and check all the <user> folders.

if the files in these folders are reported as infected by your antivirus - do not let him to delete or fix it - that's not true - they are not infected, just encrypted.
if other files are reported infected and cannot be deleted - you can try to do a full scan in Safe Mode.
but before that export your "HKEY_LOCAL_MACHINE\SOFTWARE\Fcd" entry into some backup file - you will need it to decrypt your files later. otherwise if you antivirus deletes that registry key - you won't be able to recover your files.

if you provide more info - i could be more helpful.

Okay, I've got my son's computer where he allowed his anti-virus software to lapse. Grrrr. He has lots of college schoolwork that he can no longer access.

I've run the Dr. Web decryptor but it was unable to find main key and only part of files could be decrypted. Where are these decrypted files stored sincd I was unable to find not a one. Tried the sourceforge suggestion which I downloaded on a thumb drive to my computer (his Internet is not working), opened up on his and got an error msg. "This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem."

Is this because the HKLM\Software\Fcd registry entry is absent? With regedit where do I go to see if this registry key is there?

Thanks for your help as I am about to pull all my hair out.

from your message i can be sure that your HKLM\Software\Fcd registry entry is present and you can decrypt all your files.
I've updated decrypt utility - it should not display that error message again.
download deFE22001.1.0b.exe from:
https://sourceforge.net/project/plat...platform=12963

note that decrypted files will be placed in newly created "recover" folder.
if anything goes wrong - please send me "defe22001.log" file which will be created - and i will see what can i do.

Bob I have been following this thread and reading how you have been able to help others recover their lost data. I need help too!!
All of my Office files are encripted and only about 5-10% of my pictures have been recovered using the info in your last couple of posts.
Can you help?

Thanks,
Rick

Rick,
please run deFE22001.exe utility. It will place your decrypted files into newly created "recover" folder.
if anything goes wrong, please send "fe22001.log" file to me: "bob dot grigoryan at gmail dot com".

To me, the security software didn't seem to be important, the victims happened to visit some evil web pages.

I've recovered the files but have corrupted Excel files. I've tried a few things with no luck. Anyone have this problem and solved the problem?

How'd you recover the files? I still haven't been able to recover anything!

I have run deFE22001.1.0c.exe for about 27 hours... it seems to have found a key, and recovered over 14,000 files to a "recover" folder on my desktop.

But... all the files still open as gibberish... the jpeg files won't even open.

Anyone? Any suggestions?

everyone, who has run defe22001 utility, but was able to decrypt only part of files - try version 1.0c:
https://sourceforge.net/project/plat...roup_id=249613

Bob G.

Thank you very VERY much for your help! I cannot say enough about your dedication and commitment to this problem, and your time spent is invaluable.

Thank you, thank you, thank you.

For those that are still trying to recover files, please try version 1.0c... it may be the solution you have been searching for

Cheers!