fileerror_22001 infected my files.  How to remove

Posted on 2009-04-27
Last Modified: 2013-11-22
Hi There,
I have a Windows xp sp2 computer and recently it got infected with a virus that when i try to open any picture or document file i get the following error.

If i click on file it opens up with fileerr_22001
I tried to run spyware cleaners and antivirus but still doesn't remove.  Anyone know how to clean this so i can restore my files.

Question by:snipa911
    LVL 6

    Expert Comment

    doc could be corrupted. also make sure the pc knows what type of software to use to open differnt file types.
    explorer/tools/folder options/ file types/ scroll through the list and match up accordingly.
    LVL 47

    Accepted Solution

    Apparently this infection converts these files to .fcd type file extensions and placed in folders in my C:\Documents and Settings\Steven\Local Settings\Application Data area. The folders are then named CCD and FLR.
    C:\Documents and Settings\<your username>\Local Settings\Application Data area\CCD
    C:\Documents and Settings\<your username>\Local Settings\Application Data area\FLR

    Also read here:
    Steps to take as long as your AV program hasn't removed the infection.

    1. Use "Msconfig" to deselect the startup process in the startup tab, The process you are looking for looks something like "43718D7A.exe" Then apply and restart the PC. After the Trojan should not be active.

    2. Backup the 2 folders with the encrypted original files
    \Documents and Settings\<username>\Local Settings\Application Data\CDD,
    \Documents and Settings\<username>\Local Settings\Application Data\FLR.
    To pendrive, CD or DVD etc. In case the decryption goes bad.

    3. Now use the Dr Web decrypting tool to decrypt the .fcd files in the folders above back to their original state. If the tool doesn't work when in your account try when logged in via the others users accounts if any available.

    4. Once you have your original files back, back them up for safety, once you are satisfied all your photos etc are back.

    5. Remove the Trojan completely, using DrWebCureIt, MalwareBytes or Combofix.
    1. Download and install DrWebCureit:

    2. Download Malwarebytes' Anti-Malware to your desktop, check for the tool's Updates before running a scan.

    3. Please download ComboFix by sUBs:
    You must download it to and run it from your Desktop
    Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    Double click combofix.exe & follow the prompts.
    When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
    Re-enable all the programs that were disabled during the running of ComboFix..

    Do not mouse-click combofix's window while it is running. That may cause it to stall.
    CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    OVERVIEW This guide provides information on the process performed when the Symantec Endpoint Protection (SEP) client checks in with the Symantec Endpoint Protection Manager (SEPM). AUDIENCE Information Technology personnel responsible for suppo…
    PREFACE The purpose of this guide is to explain what the SEPC Status Utility is and how it works. I have written the utility using AutoIt and have included the source code for your review. You are welcome to modify the code to your liking, but I wi…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now