Dixie Posted December 7, 2010 ID:357574 Share Posted December 7, 2010 Got this horrible new disease from Facebook. My computer is fried. Any solution / help would be appreciated.Many thx.Trojan-Ransom.Win32.GpCode.axhttp://www.securelist.com/en/blog/333/GpCo...somware_Is_Back Link to post Share on other sites More sharing options...
kahdah Posted December 7, 2010 ID:357623 Share Posted December 7, 2010 Hello DixieWelcome to Malwarebytes.=====================You will need access to a working computer, a CD and a USB to do the following: Download GETxPUD.exe to the desktop of your clean computerRun GETxPUD.exeA new folder will appear on the desktop.Open the GETxPUD folder and click on the get&burn.batThe program will download xpud_0.9.2.iso, and when finished, it will open BurnCDCC which will be ready to burn the image.Click on Start and follow the prompts to burn the image to a CD. Now we need to prepare the USB, It doesnt necessarily need to be formatted, but might help if it is > Insert your USB drivePress Start > My Computer > right click your USB drive > choose Format > Quick formatNext download ransom.sh to your USB driveRemove the USB and insert it into the infected computerBoot the infected computer with the CD you just burnedThe computer must be set to boot from the CD (varies from PC to PC > but generally F12, F11 or F9 will access the boot menu)Follow the promptsA Welcome to xPUD screen will appear > select your languageWhen xPUD opens > Click on FileExpand mntsda1 or sda2 will usually correspond to your HDD > sda1 and/or sda2 may not be visible with this infection, > this is typicalsdb1 is likely your USBExpand your USB (sdb1)Confirm that you see the file ransom.sh that you previously downloadedPress Tool on the top menu barChoose Open TerminalType bash ransom.shYou should see the message ransomware mbr code detected on /dev/sda repairing mbr on /dev/sda mbr code OK on /dev/sdbA log file named log.txt will also be created on the USBthis should only take a brief moment to completeOnce completed > type exit to close the Terminal WindowNow go to Home > restart > remove the xPUD CD from the machine before it starts to reboot to allow the machine to reboot normally.If the script was successful, your machine should now be booting normally Link to post Share on other sites More sharing options...
Dixie Posted December 7, 2010 Author ID:357659 Share Posted December 7, 2010 Is there any way to recover the data encrypted by the malware ? Ransom.Win32.GpCode.axThxHello DixieWelcome to Malwarebytes.=====================You will need access to a working computer, a CD and a USB to do the following: Download GETxPUD.exe to the desktop of your clean computerRun GETxPUD.exeA new folder will appear on the desktop.Open the GETxPUD folder and click on the get&burn.batThe program will download xpud_0.9.2.iso, and when finished, it will open BurnCDCC which will be ready to burn the image.Click on Start and follow the prompts to burn the image to a CD. Now we need to prepare the USB, It doesnt necessarily need to be formatted, but might help if it is > Insert your USB drivePress Start > My Computer > right click your USB drive > choose Format > Quick formatNext download ransom.sh to your USB driveRemove the USB and insert it into the infected computerBoot the infected computer with the CD you just burnedThe computer must be set to boot from the CD (varies from PC to PC > but generally F12, F11 or F9 will access the boot menu)Follow the promptsA Welcome to xPUD screen will appear > select your languageWhen xPUD opens > Click on FileExpand mntsda1 or sda2 will usually correspond to your HDD > sda1 and/or sda2 may not be visible with this infection, > this is typicalsdb1 is likely your USBExpand your USB (sdb1)Confirm that you see the file ransom.sh that you previously downloadedPress Tool on the top menu barChoose Open TerminalType bash ransom.shYou should see the message A log file named log.txt will also be created on the USBthis should only take a brief moment to completeOnce completed > type exit to close the Terminal WindowNow go to Home > restart > remove the xPUD CD from the machine before it starts to reboot to allow the machine to reboot normally.If the script was successful, your machine should now be booting normally Link to post Share on other sites More sharing options...
kahdah Posted December 7, 2010 ID:357741 Share Posted December 7, 2010 You will have to be a bit more specific than that what is happening with the system what do you see on the screen?If you will read a bit more on the page there is another article that says that the encryption can be reversed by Kaspersky antivirus def's.But if you want me to help you then you will have to tell me what is going on. Link to post Share on other sites More sharing options...
RaymondB Posted December 10, 2010 ID:359252 Share Posted December 10, 2010 Hi there I also have this virus. I found this on google. I know AV vendors found about this virus on November 29, 2010. What GPcode.ac is doing encrypting files with a message seen here:So whats happened is most files on the computer have been "encrypted" renaming all files with .ENCODED as the file extension. What hes asking is if the files thats are "encrypted" can be recovered. I am also wondering this because the computer that got infected on mine was the server! So I really need a fix for this. I've been on the phone with Symantec for 3 hours now; they seem clueless!In the decrypting text file on the desktop its just basically asking you to pay them $120 through wire transfer and they still send the key to decrypt the files. Link to post Share on other sites More sharing options...
kahdah Posted December 11, 2010 ID:359362 Share Posted December 11, 2010 It says that the new release of gp code's encryption can be reversed by kaspersky.http://www.securelist.com/en/blog/20818756..._mostly_hot_airUsing the removal tool from them technically should reverse the encryption. Link to post Share on other sites More sharing options...
RaymondB Posted December 11, 2010 ID:359584 Share Posted December 11, 2010 No the virus was remade again and it was noticed by AV vendors on November 29, 2010. That won't work apparently! Link to post Share on other sites More sharing options...
kahdah Posted December 12, 2010 ID:359660 Share Posted December 12, 2010 Then at this time there is no fix for it.If you need further assistance I will have this topic split I would watch for kaspersky to release a tool to decrypt in the near future they appear to be "all over it" Link to post Share on other sites More sharing options...
LDTate Posted December 23, 2010 ID:364578 Share Posted December 23, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts