sintax

Nemucod-AES

Recommended Posts

I can't seem to find any instructions on how to point the NemucodAES decryptor to the .db file... it says the database cannot be found but i've checked the temp directory and the files do indeed exist, it's a 1.04GB DB file along with the PHP/BMP files. What do i need to do so that the tool can find these files ?

Share this post


Link to post
Share on other sites

I too have this problem, even with .54 version, I can look into the temp folder and find the following (See attached .jpg). I think these are the files, and that is the .DB. But the Decrypter for NemucodAES goes through it's searching and never find it. Thanks for all that you do.

-Troy

VirusTempFlag.jpg
Download Image

Share this post


Link to post
Share on other sites

That would be version: [Jul, 13, 2017] - Version: 1.0.0.54

That did not work either for this. I had tried the first version 1.0.0.51 and the new version 1.0.0.54. The new one takes a little time to search for the database, and after that 5 minutes pause, it then pops up with the same screen that says it can't find the database. I'm not harping on anyone, just saying that it doesn't work on what ever version NEMUCODAES I got. Thanks for the reply though quietman7 and anyone else looking into this...

Share this post


Link to post
Share on other sites

Version 1.0.0.54 is doing the same thing on one of my systems.  I see the database file in the temp folder, but the program runs and a few minutes later I get the message that the the *.db file cannot be located. Are there any typical file names for the database file or have they been random?

Share this post


Link to post
Share on other sites

Still working on full decryption, but it should be noted that .tmp files were not targeted by the ransomware.  I have recovered several office documents via the tmp files associated. 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.