sintax 0 Report post Posted July 14, 2017 I can't seem to find any instructions on how to point the NemucodAES decryptor to the .db file... it says the database cannot be found but i've checked the temp directory and the files do indeed exist, it's a 1.04GB DB file along with the PHP/BMP files. What do i need to do so that the tool can find these files ? Quote Share this post Link to post Share on other sites
quietman7 2 Report post Posted July 15, 2017 How to use the Emsisoft Decrypter for NemucodAES The decrypter requires access to a database file located inside your %TEMP% directory in order to restore your files... Quote Share this post Link to post Share on other sites
cavelord 0 Report post Posted July 17, 2017 I too have this problem, even with .54 version, I can look into the temp folder and find the following (See attached .jpg). I think these are the files, and that is the .DB. But the Decrypter for NemucodAES goes through it's searching and never find it. Thanks for all that you do. -Troy Download Image Quote Share this post Link to post Share on other sites
quietman7 2 Report post Posted July 17, 2017 Fabian has published a new version of the NemucodAES decrypter Quote Share this post Link to post Share on other sites
cavelord 0 Report post Posted July 17, 2017 That would be version: [Jul, 13, 2017] - Version: 1.0.0.54 That did not work either for this. I had tried the first version 1.0.0.51 and the new version 1.0.0.54. The new one takes a little time to search for the database, and after that 5 minutes pause, it then pops up with the same screen that says it can't find the database. I'm not harping on anyone, just saying that it doesn't work on what ever version NEMUCODAES I got. Thanks for the reply though quietman7 and anyone else looking into this... Quote Share this post Link to post Share on other sites
baywolf88 0 Report post Posted July 18, 2017 Version 1.0.0.54 is doing the same thing on one of my systems. I see the database file in the temp folder, but the program runs and a few minutes later I get the message that the the *.db file cannot be located. Are there any typical file names for the database file or have they been random? Quote Share this post Link to post Share on other sites
baywolf88 0 Report post Posted July 19, 2017 Still working on full decryption, but it should be noted that .tmp files were not targeted by the ransomware. I have recovered several office documents via the tmp files associated. Quote Share this post Link to post Share on other sites
cavelord 0 Report post Posted July 20, 2017 I see a new version is out. Haven't tried it yet.https://decrypter.emsisoft.com/nemucodaes Version 1.0.0.58 Quote Share this post Link to post Share on other sites
