Kaspersky Lab Releases File Recovery Instructions For Gpcode.ak Attacks

Kaspersky Lab has released instructions on how to recover files attacked by the Gpcode.ak virus.

Gpcode is a form of ransome malware, which infects your computer, encrypts your files and then demands money in exchange for their safe return or decryption. The computer security company says that Gpcode.ak works by creating a new encrypted version of a file next to the original. Once encryption is complete, it deletes the original file and adds ._CRYPT to the extension of the newly-created files. It then places a text file named !_READ_ME_!.txt in the same folder, which contains the message,

The original Gpcode.ak used a 660-bit encryption and was cracked by Kaspersky Lab a couple of years back. However, earlier in the month, it was reported that a new, improved version of the virus had surfaced, which used a 1024-bit encryption and did not have certain bugs or flaws that were present in the 660-bit version. The company estimates that it would take 1 PC with a 2.2 Ghz processor around 30 years to crack a 660-bit key.

Kasperksy says that while decrypting files encrypted by Gpcode.ak without the private key is not yet possible, the company has identified a method for recovering files. Kaspersky reports that PhotoRec, a utility which was originally developed to recover graphics files but later extended to cover a whole range of formats including PDF and Microsoft Office documents, may be able to help users recover their files as long as the computer has not been rebooted.

TOPICS

Jane McEntegart is a writer, editor, and marketing communications professional with 17 years of experience in the technology industry. She has written about a wide range of technology topics, including smartphones, tablets, and game consoles. Her articles have been published in Tom's Guide, Tom's Hardware, MobileSyrup, and Edge Up.