Notepad documents were fine. Now scrambled????

F

firehawk

Veteran
I have several simple text documents all created in notepad on this computer. All was fine until today and I try to open one and it's scrambled with a bunch of stuff like this.

ꓞ멟眕蒘ᮁ捅ǽ嫭袸蹙줆⺸脅✰酴ౚ럜笂攑쀜⊝᷆꥜欘耐䰉吨

Thinking a mistake I open several more and they all look like that. :furious3: I'm quite confounded. Any ideas?

I'm using WIN7 64 bit. I haven't downloaded any programs today or manually changed any settings.
 
I looked in my documents folder and I see some new files dated today. They are called HELP_DECRYPT. And there is a .txt, a .png and a google chrome document. I opened the .png and I am pasting what it said below. I have not clicked on those links and I recommend no one else do either Here is what it says "

-------------------------------------------------
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1.<LINKS REMOVED BY ADMIN>
If for some reasons the addresses are not available, follow these steps:
1.Download and install tor-browser:
2.After a successful installation, run the browser and wait for initialization.
3.Type in the address bar: <LINKS REMOVED BY ADMIN>
4.Follow the instructions on the site.

IMPORTANT INFORMATION:
Your personal page:
Your personal page (using TOR): <ADMIN REMOVED>
Your personal identification number (if you open the site (or TOR 's) directly): <REMOVED BY ADMIN>

-----------------------------------------------------


Crap! This does not look good. The only thing I can figure is that I was browsing the Ford Transit USA forum earlier today and noticed a whole bunch of weird looking threads like it had been hacked so I left the forum. I've seen the same thing happen on this forum before when someone posts several weird looking threads that don't make sense. Could I have gotten some infection from that forum? Obviously something is wrong because I can't open a previous word document in word and save it, either. What should I do?
 
It's essentially an extortion thing. Nearly all of your files were encrypted with cryptography. Don't shut down your computer... you may get permanently locked out. Right now you have some room to work. Do you have any restore points? If so, use one you may lose a few files, but you should retain a great deal of them. Otherwise the alternatives are pay them to get the key to decrypt your files or re-install windows from scratch completely overwriting the current drive. If that doesn't work, get a new hard drive and replace the current one.
 
You've downloaded ransomware. Not a whole lot you can do if you didn't back up your files. Call Geek Squad or the like and see what can be done to wipe your computer and start fresh.
 
Thank you. I have a backup hard drive I can swap out but my computer also has 3 media drives and I see it has put files on those as well. I don't want to swap in the backup drive only to infect it from the media drives. Seems I need to remove whatever virus program there is and then try to restore the files
 
It's not that easy with ransomware. Honestly, any drive that has been encrypted is pretty much done for.

Unless you give i to extortion and pay the hackers.
 
Alex H. said:
It's not that easy with ransomware. Honestly, any drive that has been encrypted is pretty much done for.

Unless you give i to extortion and pay the hackers.
Click to expand...

I wonder, if you pay them, what guarantee you have that the virus won't just hide and re-activate again at some future time. It seems blackmailers are never satisfied with a single payment.
 
I booted in safe mode and looked at my media drives. I see the help_decrypt files in many but not all the folders. Some text files are still intact. I wonder if I restart to normal windows if the virus will spread more?.?

Sounds like the only repair is format every drive in the system?? Then put my backup c:> back in ? It's not completely current but at least it has most of my software installed and activated. Wow, this really stinks! It would be worse if I had no backup at all though.

i have video footage that that I need to export as archive. How can I do that?
 
I was already worn out before this happened...

does anyome know if my video files can be copied off to another drive or will they carry the virus too. I'm calling a computer tech tomorrow.
 
Hi

I do not recommend paying. They will steal your credit card info and anything else and from what I have heard not release your files.

I do not recommend using an "average" computer tech. They most likely will not be able to help. I fix things similar to these part time (for the challenge), I am a coder as day job. You need someone who really understands the underpinnings of how it all works and has the tools and experience using them. In addition they will certainly have to go in by and work directly with files and parts of the operating system to shake things loose and then repair things. In several years of part time work I have only lost one machine to a reinstall. BUT it can take up t 8 to 12 hours which can get expensive if you are paying. Paying someone may not be worth it. Most normal techs know they can't take that kind of time and just tell you it's cooked. And for most practical purposes they are right.

I also want to be clear that I have not recently worked on extortion malware just like you describe so my info is more general. I don't want to mislead you. In general terms don't touch it if you want it fixed except to make sure it can't reach the internet or other computers on your network. Consider any connected external drives or USB drives infected. I hope some of this helps.
 
I downloaded on a different machine the latest bitdefender and made a boot cd which I ran a full scan and it said no threats.
I also installed and ran malware bytes from safe mode.
The guy on YouTube just shows erasing the newly created files.

https://m.youtube.com/watch?v=gPelrlpQIJg

i don't get it. It's like the virus seems to have encrypted a bunch of files and then stuck these warning files in all the locations where it encrypted my files saying pay up. But then no active virus remains. It's like it just decrypted a bunch of files and that's it. That's hard to believe. Seems like it would still be lingering to do more harm in the future. But I can't find any threat.
 
Don't count on there not being a threat just because the software could not find it.

It may not be able to recognize this one, particularly if it is a relatively new or rare version.

Any files you try to pull off any drive that was attached to the computer while infected must be considered suspect and potentially infected.
 
This stuff has gotten pretty sophisticated and it's no longer kids playing around. These are criminals and your only safe bet is going to be to wipe every drive that was accessible during the infection process. Just because it says the files were encrypted doesn't mean they were. Remember who you're dealing with. They might be more binary virus code or they might just be random bytes. Part 2 of this adventure will be identity theft if you're not careful.
 
You must log in or register to reply here.
Back
Top