My Samsung Galaxy Note II was infected by a virus called the "FBI virus." Fortunately, I've managed to remove the malware but my problem now is that all my files have been encrypted.

How can I decrypt these files and recover my data?

  • a lot of your data may be backed up to your google account Oct 2, 2014 at 10:23
  • You should provide, like how you know those files are encrypted (eg. maybe they were moved somewhere else), show some sample or even some encrypted files (that you are not sensitive). You should also perform a full backup of the files, in case decryption attempts make you lose the copy you are working on.
    – Ángel
    Oct 2, 2014 at 12:32

2 Answers 2


If the malware is same as the one identified as Andr/FBILock-A by anti-virus firm Sophos, they have detailed removal instructions here:


It appears that (according to Sophos) this malware does not actually encrypt files, so you may be the victim of some other attack.

this is an image they posted of the malware: enter image description here


An online decryption tool is available from FireEye:


The thing to note here is that it is specific to certain types of Ransomwares. If you are encrypted by a new variant of Ransomware then it might not decrypt.

  • 3
    That's only for CryptoLocker, not any arbitrary ransomware.
    – Polynomial
    Oct 2, 2014 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .