Hello , i have a very strange problem with a hard-drive from a HP laptop , last year the laptop caught a virus , everytime the laptop was powered on a spam page would appear that asked me to pay 100 euro's so i can access my files again . I managed to get rid of the virus without formating the hard-drive . Recenlty i tried to access some photos on the d:\ partition but with no succes , all the pictures are there , the folder has the same size but i cannot view any pictures , i checked with the hex editor and noticed that the jpeg code has been modified up to a certain point , basicly the part of the code with the date / hour / camera and some other stuff is missing from there . I took the hard-drive to 3 different data recovery centers and they told me that the photos are unretrievable. The only answer i got was that the scam page virus modified the pictures, some are intact from the same folder and others don't open at all , the file extension and file size are correct but they appear as damaged . I don't know what chances i have to recover the photos , the photos are still there on the hard drive , i allread took the drive to 3 different centers , if there is any chance that someone can fix it i am willing to pay any costs . The hard drive is a toshiba 750gb , it has 7 realocated sectors for almost 2 years but that doesn't seem to be the problem , the virus that modified the jpeg code is . Thank you and i hope you can help .

You didn't mention the malwares name but it sounds like cryptovirus. If it is read there is some hope. Sample link to help decode partially encrypted files : http://www.bleepingcomputer.com/virus-r ... nformation

Hey, thx for the quick answer, i made a picture in that day but the name of the virus i don't know. The guy from the recovery center told me if i took a virus with police scam page and pay 100 euros.


I will check with that program from bleeping, thx again.

Hi Velimir,

If you want you can try to upload a file, and gurus from here will take a look.

Hey, what file do you need to upload? I upload the picture with the virus but in that day i made a full clean on my hard disk and i didn't save the log from combofix, i will search that log in the hard drive and i will put here, this is what i got, that picture.

You defiantly have cryptovirus. Upload as suggested to here and guys will help. There is some hope!
Suggest you upload sample file to https://www.decryptcryptolocker.com/ and they will provide you with some assistance decoding your files. The prior link I gave you will get you started also.