Tfude files encrypted in my computer! Please help

[jaseychan]

almost 3 years ago I got hit by this tfude virus and it affected a lot of my files.  I seem to not have the originals, i don't know why.  At that time i downloaded spyhunter and deleted the virus I had.  I can pay you for your services if you can bring my files back (anyone that can fix this for me), as they are very important to me.

this is the error I receive when i try to decrypt them with the emisoft decryptor

 

Error: Unable to decrypt Old Variant ID: PKJD3fCzU6q5yLToK8UXZCr3psCGy2moN62QlEpg

thank you so much, I hope you can help me out.

I think this an old variant, but with an onlide id key

[ShadowPuterDude]

Hello @jaseychan,

If our decryption tool cannot decrypt the files, submit file pairs to https://decrypter.emsisoft.com/submit/stopdjvu/

The decrypter can't decrypt all of my pictures even though I submitted file pairs for them? JPEG/JPG images have a format oddity that causes file pairs to be specific to each source of pictures, rather than the file format in general. As an example, if you have pictures from two different cameras, and submit a file pair from the group of pictures from one of the cameras, then the decrypter will only be able to decrypt files from the camera that the file pair came from. In order to decrypt all JPEG/JPG images, you will need to submit file pairs from every source you've obtained those pictures from.

Also, see https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ for more information on the STOP(DJVU) decryption tool.

[jaseychan]

7 hours ago, ShadowPuterDude said:

Hello @jaseychan,

If our decryption tool cannot decrypt the files, submit file pairs to https://decrypter.emsisoft.com/submit/stopdjvu/

The decrypter can't decrypt all of my pictures even though I submitted file pairs for them? JPEG/JPG images have a format oddity that causes file pairs to be specific to each source of pictures, rather than the file format in general. As an example, if you have pictures from two different cameras, and submit a file pair from the group of pictures from one of the cameras, then the decrypter will only be able to decrypt files from the camera that the file pair came from. In order to decrypt all JPEG/JPG images, you will need to submit file pairs from every source you've obtained those pictures from.

Also, see https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ for more information on the STOP(DJVU) decryption tool.

My files are wmv files (the tfude files), also when i'm in the submit parts page i can send the encrypted files, but not the original ones.....how do i find my original files?

[ShadowPuterDude]

The originals can be obtained from the source. Such as the original download site or media files that were stored on an removal storage device.

[Amigo-A]

6 hours ago, jaseychan said:

how do i find my original files?

Here is a rough list of ways you can find the originals of encrypted files:

1 ) on flash drives, external drives, CD / DVD, memory cards of the camera, smartphone;
2 ) in attachments of emails sent or received by you;
3 ) among the copies of shared photos of friends, relatives (on their PC) that you gave;
4 ) among the uploaded photos on the social networks, including via smartphone and tablet;
5 ) among the uploaded photos to cloud services (Google Disk,  OneDrive, Dropbox, etc.);
6 ) among unencrypted files, copies, renamed files on your PC;
7 ) on an old PC or disk, from where you transferred photos and documents to a new PC;
8 ) you can re-upload from the Internet previously downloaded photos, pictures, etc .;
9 ) use photos or pictures that you previously posted on the avatar or attached to messages on forums.
10 ) you can use sample images supplied with Windows (link); 

[jaseychan]

File: C:\$GetCurrent\SafeOS\SetupComplete.cmd
Error: No key for New Variant online ID: PKJD3fCzU6q5yLToK8UXZCr3psCGy2moN62QlEpg
Notice: this ID appears to be an online ID, decryption is impossible
 

 

this is the error i receive with the decryptor

[ShadowPuterDude]

1 hour ago, jaseychan said:

File: C:\$GetCurrent\SafeOS\SetupComplete.cmd

ZIP that file and attach it to your reply.  That does not appear to be encrypted.  I'll take a look at it.

[jaseychan]

On 12/9/2021 at 7:17 PM, ShadowPuterDude said:

ZIP that file and attach it to your reply.  That does not appear to be encrypted.  I'll take a look at it.

yeah from that file you can find the key?  becuase that is not the only file i have encrypted,i have several media files that are encrypted by the same key.

[jaseychan]

On 12/9/2021 at 7:17 PM, ShadowPuterDude said:

ZIP that file and attach it to your reply.  That does not appear to be encrypted.  I'll take a look at it.

ok, this is it

SetupComplete.cmd.zip

[ShadowPuterDude]

I wanted to see how many bytes of that file were encrypted.  All but the first 5 bytes and last 78 bytes are encrypted.  The first five bytes identify the file type and the last 78 bytes are the File ID.  Since, SetupComlete.cmd is usually an unique, user created, batch file you probably will not be able to decrypted that file.

[jaseychan]

12 hours ago, ShadowPuterDude said:

I wanted to see how many bytes of that file were encrypted.  All but the first 5 bytes and last 78 bytes are encrypted.  The first five bytes identify the file type and the last 78 bytes are the File ID.  Since, SetupComlete.cmd is usually an unique, user created, batch file you probably will not be able to decrypted that file.

i understand, but i have media files.......that are tfude.....those are the ones i'm trying to decrypt.

[ShadowPuterDude]

Are there any ways to recover/repair files that can't be decrypted? In most cases this is not possible, however there is a tool called DiskTuna that can help repair some videos that have been encrypted. This tool was made by a third-party, and they are not affiliated with us, however one of our developers has verified that it does work in at least some cases. You can find more information at this link.

The decrypter can't decrypt all of my pictures even though I submitted file pairs for them? JPEG/JPG images have a format oddity that causes file pairs to be specific to each source of pictures, rather than the file format in general. As an example, if you have pictures from two different cameras, and submit a file pair from the group of pictures from one of the cameras, then the decrypter will only be able to decrypt files from the camera that the file pair came from. In order to decrypt all JPEG/JPG images, you will need to submit file pairs from every source you've obtained those pictures from.

[ShadowPuterDude]

Thread Closed