Tool for recovering files encrypted by the Virus.Win32.Gpcode.ak file-encrypting malware (Kaspersky)

To recover files you will need an external storage drive, such as a USB drive.

1. Download the TestDisk archive from the vendor’s website and extract the files.
2. Save the extracted files to the external storage.
3. Connect the external storage to the infected PC.
4. Open the folder with the saved files and run photorec_win.exe.

5. Select the disk the tool is saved on. Press Enter.

6. Select the disk partition to scan. Press Enter on the keyboard. If the disk has multiple partitions, repeat this step for each one.

7. Select the file system type. Press Enter on the keyboard.

8. Select the disk space to scan for encrypted files. Press Enter on the keyboard.

9. Specify the folder in which to save the decrypted files.
   1. Go to the root folder. To do so, select the “…” folder twice.

      

   2. Select the external storage drive.
   3. Create a folder on the external storage drive in which to save the decrypted files. Name it, for example, Recovered.
   4. Select the Recovered folder.

      

   5. Press Y on the keyboard.
10. Wait until the scan has completed.

The decrypted files will be saved on the external storage drive in the specified folder under names such as t*.jpg or t*.txt.

Using the StopGpcode tool, you can rename and sort decrypted files:

1. Download the StopGpcode tool and save it to an external storage drive.
2. Connect the external storage to the infected PC.
3. Open the command line.
4. Run the command:

Where:

• -r <decrypted files> — path to the folder containing the files decrypted by the PhotoRec tool
• -i <encrypted files> — path to the disk or folder containing the encrypted files
• -o <files with recovered names> — path to the folder where the files with recovered names will be saved

The tool will collate the sizes of the decrypted and encrypted files and save to the folder:

• “Sorted” decrypted files with recovered names, copying the original folder structures.
• “Conflicted” decrypted files without recovered names.