West Yorkshire Police Virus

[exbrit]

Yes it can be any old file as long as you have the original stored somewhere as well as its now encrypted version, but those must be the same file.

[ryko25]

Ex_Brit wrote:
Yes it can be any old file as long as you have the original stored somewhere as well as its now encrypted version, but those must be the same file.

I think I'm losing my mind guys  - without actually painting the words 500 feet high across the Tower of London, I don't know how else I can get this across.

I DON'T HAVE ANY ORIGINAL COPIES OF THE CORRUPTED FILES.

That was my original question - why would I need to use a decryptor if I had copies of the corrupted files?  I'd just delete the corrupted ones and use the copies? No? Perhaps I'm speaking Greek!

Anyway, in the end I sorted everything out - right click on all the folders containing all the corrupted files, go to Properties, then go to Previous Versions, find one early enough to not be corrupted, and restore. Then delete all the corrupted "locked" files.

But thanks for trying anyway.

[exbrit]

Well in my case I was only making sure that you had searched everywhere for possible copies.   In that case the only answer would have been to format and reinstall your operating system and of course you will lose everything as a result.

I was hoping that you perhaps had some forgotten backups somewhere, I guess not.

If there's a computer repair store handy for you, by all means try them, but I honestly think that's the only choice left here had that previous version not been available..

Message was edited by: Ex_Brit on 12/06/12 8:46:10 EDT AM

[yaffle]

surreal conversation. but I'm glad you fixed it.

[exbrit]

Yes, the previous folder version idea is a good one.   It may not work for everyone however.

[iwolf]

I don't know if this will help but it did me

Windows will always ship with sample pictures and sample music etc.

If you still have these on your machine they are more than likely locked however if you get a copy of the exact same sample file from another machine it will work as it did for me 🙂

Hope this helps

[ashuasnani]

My laptop also infected with similiar virus and my documents files are locked and renamed with locked-filename.doc.abcd. I have tried with kaspersky tool but unable to unlock file and give error cannot file decrption key. May be unknown trojan program modification, pls. suggest any alternate method to do it

[simonheh]

Use Dr Web service. Email vms@drweb.com with one original unencrypted file and the encrypted version of the same file.  Must be identical otherwise will not work.  Dr Web will send you a tool which uses these two files and in my case unencrypted over 10,000 files in under an hour.  Do not interrupt process until it is compleyely finished. I didn't touch keyboard or mouse while running.

Also used Dr WebLive downloaded to CD and rebooted computer from DVD drive to remove original West Yorkshire Police virus. It takes a long time (over 8 hrs) for 20 GB of data on HDD but removed the virus which AVG recovery, Microsoft Defender, OTLPE and Kaspersky Rescue/Recovery couldn't.

Huge relief and blood pressure now returned to normal.  Originally got virus by looking at a link on Linkedin so like Facebook be very careful with these links which are obviously not monitored.

[ashuasnani]

Thanks for your reply , i  have email to drweb, but how much time they take to reply also can you share your tool that dr.web given to you, may be same will work in my case also.

[simonheh]

They are very quick.  My response was within minutes.  Email tomorrow and you should get an almost instant response.  The tool I was given may not work for you as there are different variations of this virus.  To be safe send files and wait for the tool which is bespoke for your problem.  If you used my tool and it didn't work could rencrypt your files to make them irrecoverable.  I know its not easy to wait but try and be patient its only 16 hrs till 8 tomorrow.