Following its announcement last week detailing a new variant of Gpcode called Virus.Win32.Gpcode.ak, Kaspersky Labs is now able to provide users with instructions on how to recover files hijacked by the Gpcode virus.
Although it is still not possible to decrypt files once they have been attacked by Gpcode.ak, it is possible to recover original files from a user's hard drive.
This method takes advantage of the fact that Gpcode deletes the original file after encrypting it, and makes it possible for the original file to be recovered from the hard drive.
Kaspersky recommends that users make use of the free file-recovery utility, called PhotoRec, which was developed by Christophe Grenier and distributed under a GPL licence. Most similar utilities are distributed under shareware licences.
PhotoRec, originally used to recover image files, can be used to recover Microsoft Office documents, executable files, PDF and TXT documents.
According to Kaspersky, PhotoRec is very good at recovering files on a selection partition, but restoring the exact files and paths seem to be a problem. To counter this, Kaspersky has developed a free utility called StopGpcode.
Detailed information on recovering encrypted files with PhotoRec and StopGpcode can be found here.
Share
