Mh.hemmat

Member
  • Content Count

    2
  • Joined

  • Last visited

Community Reputation

1 Neutral

About Mh.hemmat

  • Rank
    New Member

Contact Methods

  • Website URL
    http://www.cafegooya.com

Profile Information

  • Location
    Iran

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. It probably works for that too. But I'm not sure. I don't know why, but some of my folders are intact, and no files have been encrypted in these folders, and even the KODC extension has not been added to their name. For example, a game was installed on one of these folders, and I can still play it. You know a game contains dozens of audio, image, DLL, etc, and none of them are lost. If the ransomware encrypts only a small portion of the file, then there must be a way to recover a significant amount of them. I mean, the encrypted section should be replaced with data that makes the rest of the file executable. Isn't it possible to create a decryptor that works this way?
  2. Hello. After several days of dealing with this KODC ransomware, I realized that it has some weaknesses. Some videos as well as MP3 and wav files, and few folders remain completely intact. The virus is also weak in encrypting certain formats, such as zip and mp3. About zip files: Remove the .KODC extension from the end of the file and open it. Only one file may have a problem and the rest may still be usable. (This method does not work for all zip files.) About mp3 files: Remove the .KODC extension from the end of the file and open it with KMPlayer. Your file will probably run! However, your file is still encrypted. To decrypt, open the file (After removing the kodc extension from the end) in "Freemake Video Converter" and convert it to mp3. This method may also be usable for other stop djvu extensions. If this works for anyone, please let me know.