Spyware, Viruses, & Security forum

Question

Virus/malware has compressed my files

by atlapolis / April 19, 2014 6:27 AM PDT

Hey guys

I made the mistake of using a public computer in an internet cafe in Central America to backup my files from an SD card onto a USB-flash drive. After initally copying the files I could still view them on my SD card but the ones on the USB drive looked like the screenshot that I have attached.

Unfortunately I lost the SD card later on so the only thing I have left is my USB stick with some weird file. The size of it is pretty mucht the size of my photos but it's all compressed into this one file.

I've spent heaps of time googling a solution (I didn't change the name of that file btw) but have failed to come up with a solution so this is my last resort. Any help would be much appreciated!

http://i59.tinypic.com/2ajv0uq.jpg

Discussion is locked
You are posting a reply to: Virus/malware has compressed my files
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Virus/malware has compressed my files
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

All Answers

Collapse -
Answer
Does not look compressed.
by R. Proffitt Forum moderator / April 20, 2014 1:44 AM PDT

I see some oddly named file with no extension. That could be an archive or zip file without an extension but the clues are far too sparse to start offering much of any advice yet.

Is there more to this? Any use of drive security software, zip?, a name of the possible malware?
Bob

Collapse -
PS. I see you at BleepingComputer?
by R. Proffitt Forum moderator / April 20, 2014 3:47 AM PDT
Collapse -
ta
by atlapolis / April 20, 2014 4:09 AM PDT

Unfortunately I haven't got any more information than this, I have absolutely no idea what kind of malware/virus has caused this. It looks like my files are gone for good but thanks for the help anyway!

Collapse -
I noted truecrypt for a reason.
by R. Proffitt Forum moderator / April 20, 2014 7:22 AM PDT
In reply to: ta

It might not be malware at all but truecrypt or something similar. Try this to dive into what that file is.

Copy the file to your desktop and rename it to foo.txt and open it with Notepad. In notepad turn word wrap on and let me see what you see. Many of these truecrypt folders have text in the first 1000 bytes to tell me what it is.

You can delete foo.txt after you are done.
Bob

Collapse -
thanks for your help
by atlapolis / April 20, 2014 11:44 PM PDT

Hey mate

I made a copy and named it foo.txt as you said. When I turn word warp on my computer freezes. Even though Ive got 16 GB RAM and a 3.5Ghz CPU (Windows 8.1)

This is what the file looks like when word wrap is not on:

http://i58.tinypic.com/2h4arlf.png

ps. the file has 526'233 lines and 792 columns that's probably why it takes so long

Collapse -
Re: file
by Kees_B Forum moderator / April 21, 2014 12:30 AM PDT
In reply to: thanks for your help

That certainly looks like encrypted and totally unusable if you don't know how to decrypt it.
Now back to that Internet Cafe to find the cause.

Kees

Collapse -
Ouch. Nothing in plain view there.
by R. Proffitt Forum moderator / April 21, 2014 1:09 AM PDT
In reply to: thanks for your help
Collapse -
RE
by atlapolis / April 21, 2014 2:21 AM PDT

Ok so in the meantime I managed to word wrap the file and this is how it looks like:

http://i60.tinypic.com/1io1ae.png

And if I drag the foo.txt into the strings file that I downloaded it just comes up with an empty cmd, is that how I run it?

Collapse -
Rererere...
by R. Proffitt Forum moderator / April 21, 2014 2:43 AM PDT
In reply to: RE

OK, Technet just went down.

https://www.google.com/search?hl=en&as_q=mark+russinovich+strings

OK, how to use strings was at the site I linked to. It's a classic command line utility and from memory I open a CMD window, CD to the folder that has the foo.txt file and then

C:\wherethefilesare>strings -a foo.txt > text.txt

Remember this is basic command line skills which you've done fine so far with.
Bob

Collapse -
err what
by atlapolis / April 21, 2014 3:17 AM PDT
In reply to: Rererere...

hah sorry mate I'm not so tech savvy. So the file is called foo.txt and it's currently on my desktop

I open CMD and then enter

C:\Users\Tom\Desktop\>strings -a foo.txt > text.txt

is that correct? Because when I do that it says "blabla is not recognised as an internal or external command operable program or batch file"

I appreciate your help!

Collapse -
Why it gave that message.
by R. Proffitt Forum moderator / April 21, 2014 3:25 AM PDT
In reply to: err what

strings.exe would also have to be on the desktop (folder) or in the PATH.

You've very very close to getting a file with just the strings.
Bob

Collapse -
Doesn't work for me :/
by atlapolis / April 21, 2014 3:38 AM PDT

So I switched to my laptop now, this is what I'm trying to enter:

http://i58.tinypic.com/29paudh.png

I feel like a complete beginner now, can you tell me what I'm doing wrong?

ta!

Collapse -
So close.
by R. Proffitt Forum moderator / April 21, 2014 3:45 AM PDT
In reply to: Doesn't work for me :/

Is strings.exe on the desktop or at C:\users\Donimic?

Use DIR STRINGS.EXE to check.
Bob

Collapse -
both at the same location
by atlapolis / April 21, 2014 3:55 AM PDT
In reply to: So close.

both files are on the desktop. If I use DIR STRINGS.EXE it says

"Volume in drive C has no label.
Volume Serial Number is xxxx
Directory of C:\users\Dominic

File not found"


I appreciate your time and help!

Collapse -
Directory of C:\users\Dominic
by R. Proffitt Forum moderator / April 21, 2014 4:28 AM PDT
In reply to: So close.

That's not the desktop.
C:\users\Dominic\desktop is the desktop.

strings.exe would have to be in C:\users\Dominic if you wanted to run it there. However I'd put it on the desktop and run it there. That way the .txt file will, if by magic show up when you succeed.
Bob

Collapse -
rererere
by atlapolis / April 21, 2014 4:46 AM PDT
In reply to: So close.
Collapse -
Re: rererere
by Kees_B Forum moderator / April 21, 2014 4:53 AM PDT
In reply to: Doesn't work for me :/

You did it right this time (can I assume that you only started using a PC after Microsoft invented Windows, it's all basic DOS everybody had to know back in 1990?). And it shows that it's hopeless indeed.

A useful lesson: after copying something, check the result.

Kees

Collapse -
..
by atlapolis / April 21, 2014 4:58 AM PDT
In reply to: Re: rererere

Ok so no dice ey! Thanks for the help anyway I'll not use public internet cafes again in the future or at least I won't plug anythign in there Wink

Collapse -
Answer
http://tinypic.com/view.php?pic=13ykwh&s=8#.U1VpJ1fGc2M
by R. Proffitt Forum moderator / April 21, 2014 4:55 AM PDT

Looking at http://tinypic.com/view.php?pic=13ykwh&s=8#.U1VpJ1fGc2M you appear to have succeeded.

BUT!!! You were not in the desktop folder at the time so the txt file should be in C:\Windows\system32

Try the dir text.txt at the prompt?

To see the content, try NOTEPAD text.txt
Bob

Collapse -
For me I would have CD'd to the desktop folder first.
by R. Proffitt Forum moderator / April 21, 2014 4:59 AM PDT

That way I would not have to type in paths to the foo.txt or to where strings.exe was.

Collapse -
woops didnt see your last post!
by atlapolis / April 21, 2014 4:59 AM PDT

Ah ok found the file! This is what came back :/


Strings v2.51
Copyright (C) 1999-2013 Mark Russinovich
Sysinternals - www.sysinternals.com

No matching files were found.

Collapse -
OK, now you see what I'd CD to the desktop first.
by R. Proffitt Forum moderator / April 21, 2014 5:04 AM PDT

The .exe was fully pathed to the desktop folder but you were in Windows\system32 at the time and since foo.txt was not in Windows\system32 well, it actually did work!

CD to the desktop and it will be much easier to run strings.
Bob

Collapse -
So it didn't find the file.
by Kees_B Forum moderator / April 21, 2014 5:11 AM PDT

That's what it tells. And that's right because you told US that you moved foo.txt to the desktop (or maybe there's a shortcut of foo.txt on the desktop) but you told THE PROGRAM to look for it c:\windows\system32.

Next thing to try:
c:\users\dominic\desktop strings -a c:\users\dominic\desktop\foo.txt>text.txt

Kees

Collapse -
Now I'm confused
by atlapolis / April 21, 2014 5:29 AM PDT

haha sorry this is clearly me not used to using CMD. And yes I started using Windows when XP came out so I never worked with these comand prompts.

Ok I'm really trying here but I'm a bit lost now.

1. So I made a copy of this weird file and its on my desktop and it's called foo.txt
2. I downloaded the strings.exe that you pointed out to me and that's also on my desktop
3. the path to my desktop is "C:\Users\Dominic\Desktop"
4. I'm using Windows 8.1 and it gives me 2 command prompts (one is admin). I'm using the admin one
5. this is what I type in according to your last post:

c:\users\dominic\desktop strings -a c:\users\dominic\desktop\foo.txt>text.txt


http://i58.tinypic.com/1088u8g.png

Am I just being stupid? Happy

Collapse -
Again, why I would CD to the desktop first.
by R. Proffitt Forum moderator / April 21, 2014 5:33 AM PDT
In reply to: Now I'm confused

You forget one \ in a path. If you had CD'd to the desktop you could have avoided all the paths you would have to type.

Then it would have looked like
C:\users\donminac\desktop>strings foo.txt > text.txt

You're very close.
Bob

Collapse -
..
by atlapolis / April 21, 2014 5:38 AM PDT

where did I forget one \ ?

is this not correct?
c:\users\dominic\desktop strings -a c:\users\dominic\desktop\foo.txt>text.txt

Collapse -
There's a space from desktop to strings.
by R. Proffitt Forum moderator / April 21, 2014 5:43 AM PDT
In reply to: ..

The space tells the command interpreter that you ended there for the "command" and a space provides a deliminator so all this could have been avoided by CD'ing to the desktop folder.
Bob

Collapse -
Sorry, my fault.
by Kees_B Forum moderator / April 21, 2014 5:44 AM PDT
In reply to: ..

c:\users\dominic\desktop\strings -a c:\users\dominic\desktop\foo.txt>text.txt

There must be a \ between desktop and strings.

Kees

Collapse -
Why type?
by Kees_B Forum moderator / April 21, 2014 5:37 AM PDT
In reply to: Now I'm confused

Copy/paste is faster and less error prone.
And yes, that's Windows, not DOS Wink . But, alas, it isn't ctrl-V in the command prompt window Sad .

Kees

Collapse -
wow I made it :)
by atlapolis / April 21, 2014 5:59 AM PDT
In reply to: Why type?
Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

CNET FORUMS TOP DISCUSSION

Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?