Hi all, I have just had this virus show up on my computer over the weekend. Norton somehow missed it or was not running and allowed the files to be changed however it did end up catching and deleting the virus. I cannot find the HKLN directory at all, even after 3 different system restores. I have run both the versions of Bob G's fix and the TE33decryptor to no avail(assume this is due to the directory and virus already being deleted). Does anyone know if I can still recover my photos in this case? Thank you in advance.



Justin

first try to find encrypted *.fcd files. they are usually located in \documents and settings\<your username>\local setting\application data\CDD and FLR folders.
if you find them - we are able to restore your files.

In regards to deFE22001.1.0c.exe (http://sourceforge.net/projects/defe22001/files/):

I ran version C of this app and it was finding less than 10% of affected files.
I downloaded version B, and it finds the MAMBA/WAMBA keys but immediately stops and says Completed but with 0 files decrypted. Before it found many thousands of files but most of the photos were corrupted. I stopped running it so I could try version B. Both version B and C stop immediately now.

I renamed the first recover folder and there is over 100G free on the hard drive. The *.fcd files have not been modified as the original "Last Modified" date still shows on all of them.

Any ideas? Please help.

Apologies...I was under the wrong username.

But its still only able to decrypt a very small amount of the data, and Ive tried both B and C (A didn't seem to work at all).

I can pull the keys out using the Info program (FCDInfo.exe I think its called).

Maybe its a new strain that has a new technique. ???

Hi Bob, can confirm that no .FCD files exist on my computer. What does this mean for me?

thanks
Justin

Ok it ran and completed, and still a very low percentage are "sane".

I think one of the keys is wrong.

Are you sure? Did you go to My Computer, Tools, Folder Options, View and Show Hidden Files and Show System Files? The FCD Files are under

"C:\Documents and Settings\SOMEUSERNAME\Local Settings\Application Data\CDD"
"C:\Documents and Settings\SOMEUSERNAME\Local Settings\Application Data\FLR"

Haha!!! I found the folders CDD and FLR in my app data. They do in fact contain .FCD files. I assume this is good news. What's next


Justin