At the moment, files encrypted by Gpcode cannot be decrypted. However, you can use PhotoRec to recover your original files which were deleted by Gpcode after the virus created an encrypted version of the files.
The utility can be used to recover Microsoft Office documents, executable files, PDF and TXT documents, and also certain file archives. Here is a full list of supported file formats.
PhotoRec is part of the TestDisk package.
Below are detailed instructions on how to manually restore deleted files using PhotoRec:
- Use a different, not infected computer to download TestDisk, which includes PhotoRec.
- Save PhotoRec to an external device, and connect this device to the infected machine (this does not pose any threat, as Gpcode.ak cannot spread independently and deletes itself after launching).
- Run PhotoRec (the file is called photorec_win.exe, and it is located in the win directory of the TestDisk package):
- Choose the target drive drive for PhotoRec to search for files, and press ENTER to continue.
If you have several hard drives in your system, you should perform this step for every hard drive (e.g. once you have recovered files from one drive, you should repeat the process for the next drive).
- Select the partition table type (typically 'Intel') and press ENTER to continue.
- Choose the partition you want to recover files from and press "Enter" to continue.
If your disk has several partitions, you need to repeat this step for each one.
- Choose the type of file system (Windows users should choose 'Other') and press ENTER to continue.
- Choose where to search for deleted files and press ENTER to continue. Choose "Whole" to search the entire disk for deleted files.
- PhotoRec will then ask you to specify a destination directory for restored files. Use the PhotoRec file browser to move to the root directory (by choosing ".." and pressing ENTER).
-
The root directory shows which disks your system has. Choose the appropriate removable (or network) drive, and the folder in which you want to save recovered files. It is very important to choose an external drive (i.e. don't choose a drive on your infected machine, because deleted files could be damaged).
Before recovering files, please make sure you have created a separate directory on the drive (e.g. "recovered") and choose to save recovered files to this directory, in order to prevent errors arising later in the recovery process. Once you have chosen the directory, press "Y".
Once you have pressed "Y", you will see the file restoration process in action. Please be aware that this process may take a considerable length of time.
Wait for scanning to finish before moving to the next step.
- The recovered files are now on your chosen external drive. When you open the directory which contains the recovered files, you will notice that the file names do not correspond to the original names of the files on your hard disk.
-
Your file names will look something like this:
This is due to the way PhotoRec works, and you should not be alarmed. In addition, although the utility can restore the contents of files, it cannot establish their original location.
To complete the recovery process, we've created a free utility called StopGpcode that will sort and rename your restored files.
- On another computer, download the stopgpcode.zip utility and copy it to a USB flash drive.
- Put this flash drive into the infected computer and load the Windows Command Prompt by going to START -> PROGRAMS -> ACCESSORIES.
- Select your USB flash drive by typing the drive letter e.g. W:
- Then run the utility from the command line by typing the following: "STOPGPCODE -r -i -
e.g. STOPGPCODE -r W:\ RECOVERED -i С:\ -o W:\SORTED"
The utility will process the entire disk and compare the sizes of encrypted and recovered files. The program will use the file size as a basis for determining the original location and name of each recovered file.
The utility will try to determine the correct name and location for each file, recreating your original folders and file names within a folder called "sorted". If the utility cannot determine the original file name, the file will be saved to a folder called "conflicted".
