Sign in with
Sign up | Sign in
Your question

Documents and music files 'ncrypted' - trying to revert the change

  • Music
  • Windows XP
Last response: in Windows XP
February 23, 2009 5:58:50 AM

I have a customer whos PC has been hit with some form of virus/script/whatever. The end result is that all the document (.doc, .ppt etc) and music files have been changed to an unreadable state.

The initial symptom is that the files are renamed to xxxx.doc.NCRYPTED.NCRYPTED.NCYRPTED.NCRYPTED.ncrypted

Renaming the file to remove the rubbish on the end makes no difference as the file is still unreadable - appears the file header has been altered perhaps?

There is also a text file left behind with the following:

"Some files on your machine are encrypted and your private informations were collected and sent to us.
To decrypt files so you could use them again, you have to buy our decryptor.
After you buy decryptor, your files will be decrypted, and we will destroy your private informations from our system, and help you remove malicious software from your system.
To buy decryptor, contact us at: or
If you dont contact us, your private informations will be shared and you will loose all your data."

Normally, I would just run a format & reinstall the system but in this case the customer is desperate to keep their data since they have no backup.
So far I have run multiple virus scans with NOD32 which has pulled off some 30+ infections. I have also run spyware scans but of course this has had no effect.
Goggle has so far been unable to help and I'm not very confident of being able to get this resolved.

Any ideas or help would be greatly appreciated!


More about : documents music files ncrypted revert change

February 23, 2009 6:45:50 AM

First step is to identify which "RansomWare" was detected, some are easy to remove and the decrypting keys can be found by Google, others are almost impossable to remove.

PS: In my humble opinion: To get 30+ infections on a machine with no backup takes a special kind of idiot.
April 22, 2009 8:07:37 PM

how to identify which "RansomWare" is it? and how to remove?
Please reply at
Related resources
April 23, 2009 5:39:47 AM

Most up to date anti-virus tools will detect and identify, you then use Google to see if there any removal tools/instructions available.
April 23, 2009 5:58:42 PM

Did anyone figure out which virus this is (leaves .NCRYPTED files)
April 28, 2009 2:46:42 AM

the Virus i believe is a win32.gpcode virus.
Ive been researching this problem for 2 days now and there isn't much out there.

According to the Kasparsky AV team (they seem to be the only ones on top of this) its a virus that people have modifed so its hard to keep up with. they also state the data is not recoverable... (but give you recommendations on what might work) :S

if anyone has found different i would love to know as i have a client who was rather upset when i told her she had lost everything.
i have followed this guide below with not to much joy but hopefully it will work for one of you.
PhotoRec may do the job, its hard to tell with the amount of data it brings back.

Good luck and if anyone finds out anything more please let me know.
March 30, 2010 3:22:45 AM

true, its a win32.gpcode issue. these guys have a solution to this.