sintax Posted July 14, 2017 Report Share Posted July 14, 2017 I can't seem to find any instructions on how to point the NemucodAES decryptor to the .db file... it says the database cannot be found but i've checked the temp directory and the files do indeed exist, it's a 1.04GB DB file along with the PHP/BMP files. What do i need to do so that the tool can find these files ? Link to comment Share on other sites More sharing options...
quietman7 Posted July 15, 2017 Report Share Posted July 15, 2017 How to use the Emsisoft Decrypter for NemucodAES The decrypter requires access to a database file located inside your %TEMP% directory in order to restore your files... Link to comment Share on other sites More sharing options...
cavelord Posted July 17, 2017 Report Share Posted July 17, 2017 I too have this problem, even with .54 version, I can look into the temp folder and find the following (See attached .jpg). I think these are the files, and that is the .DB. But the Decrypter for NemucodAES goes through it's searching and never find it. Thanks for all that you do. -Troy Link to comment Share on other sites More sharing options...
quietman7 Posted July 17, 2017 Report Share Posted July 17, 2017 Fabian has published a new version of the NemucodAES decrypter Link to comment Share on other sites More sharing options...
cavelord Posted July 17, 2017 Report Share Posted July 17, 2017 That would be version: [Jul, 13, 2017] - Version: 1.0.0.54 That did not work either for this. I had tried the first version 1.0.0.51 and the new version 1.0.0.54. The new one takes a little time to search for the database, and after that 5 minutes pause, it then pops up with the same screen that says it can't find the database. I'm not harping on anyone, just saying that it doesn't work on what ever version NEMUCODAES I got. Thanks for the reply though quietman7 and anyone else looking into this... Link to comment Share on other sites More sharing options...
baywolf88 Posted July 18, 2017 Report Share Posted July 18, 2017 Version 1.0.0.54 is doing the same thing on one of my systems. I see the database file in the temp folder, but the program runs and a few minutes later I get the message that the the *.db file cannot be located. Are there any typical file names for the database file or have they been random? Link to comment Share on other sites More sharing options...
baywolf88 Posted July 19, 2017 Report Share Posted July 19, 2017 Still working on full decryption, but it should be noted that .tmp files were not targeted by the ransomware. I have recovered several office documents via the tmp files associated. Link to comment Share on other sites More sharing options...
cavelord Posted July 20, 2017 Report Share Posted July 20, 2017 I see a new version is out. Haven't tried it yet.https://decrypter.emsisoft.com/nemucodaes Version 1.0.0.58 Link to comment Share on other sites More sharing options...
Recommended Posts