Solved Is it possible to recover/restore this file?

  • Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  • Hello everyone We want to personally apologize to everyone for the downtime that we've experienced. We are working to get everything back up as quickly as possible. Due to the issues we've had, your password will need to be reset. Please click the button that says "Forgot Your Password" and change it. We are working to have things back to normal. Emails are fixed and should now send properly. Thank you all for your patience. Thanks, PCHF Management
Status
Not open for further replies.
D

DyllyZ

PCHF Member
Nov 18, 2017
18
0
30
Hello, a while back I had to restore windows 10 on my laptop because of a virus. I couldn't make a back-up of the files because the virus was doing it's work I guess...
There were some pictures and videos that I didn't want to lose and those pictures/videos turned into "mxpchyvl" files because of the windows restore.
Does anyone know if there is a way to recover/restore these files?
 
Look in the HDD directories and see if there is a Directory called Windows.old

If there is one then the files you want may be there. If not then you could try changing the extensions on some of the files and see if that helps.

This is why I always tell people to BACK UP before some thing happens DO NOT wait till some thing does happen. Do not back it up to an internal drive use external and remove it once done.
 
Rustys said:
Look in the HDD directories and see if there is a Directory called Windows.old

If there is one then the files you want may be there. If not then you could try changing the extensions on some of the files and see if that helps.

This is why I always tell people to BACK UP before some thing happens DO NOT wait till some thing does happen. Do not back it up to an internal drive use external and remove it once done.
Click to expand...
I have the files but somehow they changed from AVI or JPG to MXPCHYVL and I have no clue what this is or how to restore them (If this is still possible)
I was hoping that there would be some kind of recovery software for this or anything?
 
Rustys said:
Look in the HDD directories and see if there is a Directory called Windows.old

If there is one then the files you want may be there. If not then you could try changing the extensions on some of the files and see if that helps.

This is why I always tell people to BACK UP before some thing happens DO NOT wait till some thing does happen. Do not back it up to an internal drive use external and remove it once done.
Click to expand...
Okay... i just found something strange

There was a text document called MXPCHYVL-DECRYPT so I opened it and it said this...

---= GANDCRAB V5.1 =---

***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************

*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****

Attention!

All your files, documents, photos, databases and other important files are encrypted and have the extension: .MXPCHYVL

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.


The server with your key is in a closed network TOR. You can get there by the following ways:

----------------------------------------------------------------------------------------

| 0. Download Tor browser - https://www.torproject.org/

| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/10ef0ed3a67a707d
| 4. Follow the instructions on this page

----------------------------------------------------------------------------------------


On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.


ATTENTION!

IN ORDER TO PREVENT DATA DAMAGE:

* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

(and some more bull crap)......


Now this looks like a scam and I hope those links aren't harmfull!
but does this tell you anything? because I've tried some recovery software and it didn't do anything for me.
 
On that you would have to ask the Malware specialist they would be the best ones to assist on answering that.

From past experience yes most of those are scams yet they do encrypt the files and change the extensions and if there is any way to get them unencrypted they would know.
 
Rustys said:
On that you would have to ask the Malware specialist they would be the best ones to assist on answering that.

From past experience yes most of those are scams yet they do encrypt the files and change the extensions and if there is any way to get them unencrypted they would know.
Click to expand...
At least I know what actually happened to the files now.
Thanks for the help my man!
 
Status
Not open for further replies.
Top Bottom