Archive notice: This article was originally published on June 17, 2008. Links and embedded videos are preserved as part of the historical record.
To understand the solution, it is necessary to know how Gpcode.ak works: it first creates a new file “next to” the one it encrypts. The virus writes the encrypted data from the source file into this new file and then deletes the original file. Because deleted data can be recovered if the data on the hard drive has not been altered too extensively, Kaspersky Lab’s experts advised affected users from the outset not to restart their computers and to contact Kaspersky Lab. Kaspersky Lab’s virus analysts have now found an effective and readily available solution using the free PhotoRec tool, which can restore files deleted by Gpcode.ak. PhotoRec was developed by Christophe Grenier. It is available under a GPL license and is provided as part of the latest version of the TestDisk package.
PhotoRec easily solves the problem of restoring files from a selected section of the hard drive. However, restoring the exact file name and path presents some difficulties. To solve this problem, Kaspersky Lab developed the free StopGpcode program, which makes it possible to restore the original file names and paths.
Kaspersky Lab recommends that all victims of Gpcode.ak reject the ransom demands of the Gpcode authors and instead consider making a voluntary donation to the creator of the excellent PhotoRec program.
Detailed instructions for manually restoring files using PhotoRec and StopGpcode can be found in the description of Gpcode.ak on the http://www.viruslist.de information portal at
http://www.viruslist.com/de/viruses/encyclopedia?virusid=313444.