To me, the security software didn't seem to be important, the victims happened to visit some evil web pages.

I've recovered the files but have corrupted Excel files. I've tried a few things with no luck. Anyone have this problem and solved the problem?

How'd you recover the files? I still haven't been able to recover anything!

I have run deFE22001.1.0c.exe for about 27 hours... it seems to have found a key, and recovered over 14,000 files to a "recover" folder on my desktop.

But... all the files still open as gibberish... the jpeg files won't even open.

Anyone? Any suggestions?

everyone, who has run defe22001 utility, but was able to decrypt only part of files - try version 1.0c:
https://sourceforge.net/project/plat...roup_id=249613

Bob G.

Thank you very VERY much for your help! I cannot say enough about your dedication and commitment to this problem, and your time spent is invaluable.

Thank you, thank you, thank you.

For those that are still trying to recover files, please try version 1.0c... it may be the solution you have been searching for

Cheers!

Hi all, I have just had this virus show up on my computer over the weekend. Norton somehow missed it or was not running and allowed the files to be changed however it did end up catching and deleting the virus. I cannot find the HKLN directory at all, even after 3 different system restores. I have run both the versions of Bob G's fix and the TE33decryptor to no avail(assume this is due to the directory and virus already being deleted). Does anyone know if I can still recover my photos in this case? Thank you in advance.

Justin

first try to find encrypted *.fcd files. they are usually located in \documents and settings\<your username>\local setting\application data\CDD and FLR folders.
if you find them - we are able to restore your files.

In regards to deFE22001.1.0c.exe (http://sourceforge.net/projects/defe22001/files/):

I ran version C of this app and it was finding less than 10% of affected files.
I downloaded version B, and it finds the MAMBA/WAMBA keys but immediately stops and says Completed but with 0 files decrypted. Before it found many thousands of files but most of the photos were corrupted. I stopped running it so I could try version B. Both version B and C stop immediately now.

I renamed the first recover folder and there is over 100G free on the hard drive. The *.fcd files have not been modified as the original "Last Modified" date still shows on all of them.

Any ideas? Please help.

Apologies...I was under the wrong username.

But its still only able to decrypt a very small amount of the data, and Ive tried both B and C (A didn't seem to work at all).

I can pull the keys out using the Info program (FCDInfo.exe I think its called).

Maybe its a new strain that has a new technique. ???

Hi Bob, can confirm that no .FCD files exist on my computer. What does this mean for me?

thanks
Justin

Ok it ran and completed, and still a very low percentage are "sane".

I think one of the keys is wrong.

Are you sure? Did you go to My Computer, Tools, Folder Options, View and Show Hidden Files and Show System Files? The FCD Files are under

"C:\Documents and Settings\SOMEUSERNAME\Local Settings\Application Data\CDD"
"C:\Documents and Settings\SOMEUSERNAME\Local Settings\Application Data\FLR"

Haha!!! I found the folders CDD and FLR in my app data. They do in fact contain .FCD files. I assume this is good news. What's next


Justin

I just found out I have this virus. None of the above solutions have helped, 1 in 10 files have been restored. I would like to send info to you Bob, but, not sure how to do it. Please fill me in. I have the registry key, but there is no value posted. Thank You in advance.