Main key for encryption is stored under HKLM\Software\Fcd.
If you have that key in the registry - don't touch it.


If not - you can try to restore them from backups (if you have them), but make sure you change your system time back to the infection time (this is important!).
If you don't know infection time - you can find it by looking at modification time of encrypted files.

hope this information will help someone.

p.s. if you can send export and send me the value of HKLM\Software\Fcd registry key along with some samples of encrypted files - this will help a lot.

I've been following this issue very carefully on various forums, and have heard some say that the encryption key is for 10% of the encrypted files, and then the other 90% were encrypted via a predictable key. If that is the case, why would the Decrypt tool need a key to decrypt all of the files. Is there any truth to this statement, or are people mistaken. I would be happy if I could get 90% of my files back at this point.

But I will tell you - this forum is definitely ahead of the others as far as information on this problem.

Michael

Bob:

PM Sent

Guys I have read the whole thread here and I am getting this Error when I try to open files for example like .jpg. I was reading and I am not sure if it's the same problem. This is what I get

Application can't open the file due to data corruption
C:\Documents and Settings\(name).................(file directory)

Error 0xC005: Invalid header sequence.
Corrupted block:
DA69A8CA25EBAA0065961C71C147B78C
D4ECB8B02DDB4E05BD7A0083BC95C5A8
A53BAB0625A1E173205D1C38EC0C1682
D4CD0A24A6D319E335B7E8F9D8144FA3
EA194CA318FB4ECE6510DB4EF955BB62
5EB90AE9127F199B38007EA0E737FF66
9913AB8F0DD9E2E115FF38A509427629
32B1B80E7090402A9566B2B7E7EFD602

It also tells me to download FileFix Proffesional and then tells me to buy it. I have been looking all over the web for this issue and have only found this page with these threads. Is it the same problem as the File Error??? If not u guys know of any solution for it ?

I didn't open a new thread because not sure if it's a different problem.

Thanks in advance.

it's a different virus:
FileFix Professional 2009

So I've read a lot about this virus and I guess I've been blessed because I haven't been hit by it - but it also might be because I have Cyberdefender as my security softwre. I would be interested to see what security software you were using when you were infected.

THanks.