Locked file Ukash?

valerian

valerian

valerian

Associate
Joined
8 Feb 2006
Posts
1,846
Location
Stafford
hi all
ive had a pc to fix
with the ucash scam on it, wouldnt boot into safe mode, fair enough
thought to myself ill just save the photos etc, then format it

but
all the photos, videos, mps3s are altered
eg each file is prefixed with 'locked' and is a white unrecogonised file with
info like kkkk file, or qqqq file not the usual avi or jpeg or mp3
any ideas welcome
 
I spent many hours trying to fix pen with the same. Could not get any of the data back at all.

I take it you have ran the usual clean up tools.

TDSKiller
Combofix
Unhide
Malwarebytes.
 
Sounds like some nasty ransomware. If you're lucky, it's just changed the name of the files. If you're unlucky it's encrypted them.

Can you change the extension back to jpeg, etc, and see if you can open the files? If not then they've probably been encrypted. In the latter case it'd be useful to know exactly which virus it is, since some of these things have workarounds (other than paying the ransom) and others don't.

[edit] Actually, the link posted above matches the symptoms and looks promising.
 
Last edited:
tried changing em back no joy
tried combofix no joy
serves her right i suppose, stuff not backed up, and no working av, nod 32 not updated for a couple of years
ah well, ive formatted it now
 
It's a nasty little virus that I am not sure would have been picked up by AV anyway as our work AV didnt pick it up and it doesn't seem to exist on any other AV manufacturers knowledgebase other than Kaspersky. Conspiracy theory in the making... :P
 
Thanks, I'll email that across to him. Failing that I'll mess around with it when I'm back home. Some some reading on it, looks like a right pain! If all else fails perhaps format it. Don't dell lock the bias or something. Ah well we shall see.
 
You must log in or register to reply here.
Back
Top Bottom