U.S. CitiesCity-Data Forum Index
Go Back   City-Data Forum > General Forums > Science and Technology > Internet
 [Register]
Please register to participate in our discussions with 2 million other members - it's free and quick! Some forums can only be seen by registered members. After you create your account, you'll be able to customize options and access all our 15,000 new posts/day with fewer ads.
View detailed profile (Advanced) or search
site with Google Custom Search

Search Forums  (Advanced)
Reply Start New Thread
 
Old 12-30-2014, 01:53 PM
 
548 posts, read 1,065,744 times
Reputation: 160

Advertisements

ALL my files..... including pictures, text files etc have now got an added extension of " .lwojehi"

for example .... mypicture.jpg.lwojehi or meetingnotes.txt.lwojehi

Is that some sort of ecription or a virus?

Is there any way to restore my files so I can see them?

.

Last edited by elnina; 01-06-2015 at 02:36 PM..
Reply With Quote Quick reply to this message

 
Old 12-30-2014, 06:15 PM
 
Location: Wooster, Ohio
1,085 posts, read 829,888 times
Reputation: 1624
If you rename your files by eliminating the added extension, can you then work with them?
Reply With Quote Quick reply to this message
 
Old 12-30-2014, 06:36 PM
 
548 posts, read 1,065,744 times
Reputation: 160
Quote:
Originally Posted by mshultz View Post
If you rename your files by eliminating the added extension, can you then work with them?
No. I can open the file but the text is changed to what looks like japaneese symbols
Reply With Quote Quick reply to this message
 
Old 12-30-2014, 07:11 PM
 
Location: Denver
9,353 posts, read 16,134,983 times
Reputation: 5624
Quote:
Originally Posted by LastStraw View Post
ALL my files..... including pictures, text files etc have now got an added extension of " .lwojehi"

for example .... mypicture.jpg.lwojehi or meetingnotes.txt.lwojehi

Is that some sort of ecription or a virus?

Is there any way to restore my files so I can see them?

.
Those look like random characters to me.

It could be this virus (not sure until you run an anti-virus program):
How to restore renamed .exe, .doc and .pdf files*with Panda Ransomware Decrypt tool*-Technical Support-Panda Security

  • Do you have an anti-virus(AV) program installed like McAfee, Symantec, Panda, Sophos etc?
  • If not get one ASAP, make sure you update to the latest anti-virus dat files, then run a scan.
  • If it finds a virus make sure to note what that is for later research then allow AV to clean.
  • You may still have to rename your effected files afterwards. The link above indicates what kind of utility to run that may clean your machine.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 01:29 PM
 
548 posts, read 1,065,744 times
Reputation: 160
* Now ALL files have that same ending added to them ( .lwojehi )
and I found a message in my document folder that reads as follows:

"_Your documents, photos, databases and other important files have been encrypted
with strongest encryption and unique key, generated for this computer.
Private decryption key is stored on a secret Internet server and nobody can
decrypt your files until you pay and obtain the private key.
If you see the main locker window, follow the instructions on the locker.
Overwise, it's seems that you or your antivirus deleted the locker program.
Now you have the last chance to decrypt your files.
Open http://xxxxxxxxx or http://xxxxxxxxx
in your browser. They are public gates to the secret server.
If you have problems with gates, use direct connection:
1. Download Tor Browser from http://xxxxxxx
2. In the Tor Browser open the http://xxxxxxxx
Note that this server is available via Tor Browser only.
Retry in 1 hour if site is not reachable.
Copy and paste the following public key in the input form on server. Avoid missprints.
-QBIOWC-72UO25-SJJZCP-ZL2VGF-KPL43J-BVPXCH-KP5XJK
T7XCOI-SKGRWT-7IUWOY-KWM6-I6VLPT-TDCAU3
L72QZE-OZAGTK-JAVSQU-3WETOA-AY5AVA-TL4WOO-S4FROL-AAN4PQ
Follow the instructions on the server.__"

---------------------------------------
I'm surprised something about this terrible virus has not been mentioned on this forum???
Or has it? Really havn't had time to do a "search" because I've been trying to take care of this problem.

I believe it is called the "crptolocker virus" or Trojan.Ransom and Trojan.CriLock.XL

I've done a Virus Scan with MSSE and I think I removed it (actually multiples of them) but I've been told it may still be on my computer somewhere.
Is is necessary to reformat my hard drive and reinstall Windows again?

Also,.. is there any way to remove the encryption on my files and get them back without having to pay the ransom for the key ??

Panda did not work because it said it needs a copy of the orignal file which i do not have.





.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 01:51 PM
 
Location: Wandering.
3,545 posts, read 5,678,821 times
Reputation: 2654
Pretty sure it's been mentioned here before.

There really is no way to unlock the files other than pay the ransom (if it is indeed one of those variants, which it appears to be).
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 02:15 PM
 
548 posts, read 1,065,744 times
Reputation: 160
I saved my files on an external USB stick, but I don't know how safe it is to put in back into my computer again.

I thought maybe I would take the USB stick to the library and put in into one of their computers to check it out,....because I'm assuming they must have great protection since so many people use their computers.

I did put it into an old LapTop I have that is outdated and it looked like some files were not encripted but I did not have a way to connect to the internet to load them onto cloud storage, so that is why I thought of the library.

But the main thing I want to find out .....Is necessary for me to have my hard drive wiped clean and reinstall Windows again?




.







.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 02:39 PM
 
Location: HoCo, MD
4,589 posts, read 8,194,016 times
Reputation: 5133
Quote:
Originally Posted by LastStraw View Post
I saved my files on an external USB stick, but I don't know how safe it is to put in back into my computer again.

I thought maybe I would take the USB stick to the library and put in into one of their computers to check it out,....because I'm assuming they must have great protection since so many people use their computers.

I did put it into an old LapTop I have that is outdated and it looked like some files were not encripted but I did not have a way to connect to the internet to load them onto cloud storage, so that is why I thought of the library.

But the main thing I want to find out .....Is necessary for me to have my hard drive wiped clean and reinstall Windows again?

.

.
Uh... I wouldn't do that. Nor would I put that USB on a public computer at the library(assuming those files are personal/sensitive). Those are probably one of the more risky places. If that USB is your only backup, I would make sure I'm 100% confident in the stability of the computer I intend to insert that into.

Personally, I would wipe the drive and reinstall. But that's just me. Is it absolutely necessary? No. There are plenty of people that clean malware off and go on without issues. The resources (and know how) you have at your disposal to rebuilding that computer would come into play. But many malware have a tendency of being persistent. To me, it's not worth the risk.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 02:42 PM
Status: "Enjoying life..." (set 9 days ago)
 
Location: San Antonio/Houston/Tricity
39,875 posts, read 57,694,079 times
Reputation: 93720
Did you Google that problem?
Not sure about outcome, but read this:
'Your personal files are encrypted' Virus - how to remove?
New Crypto Locker type Virus - General Security


More to read and try:
Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. - Google Search
__________________
.
"No Copyrighted Material"
Moderated forums:
World, Europe, Texas, Corpus Christi, El Paso, Lubbock, Tyler, Houston, San Antonio, Tallahassee,
Minnesota, Fish, Home Interior Design and Decorating, Science and Technology Forums
.

Need help? Click on this: >>> ToS, Mod List, Rules & FAQ's, Guide, CD Home page, How to Search
Realtors are welcome here but do see our Realtor Advice to avoid infractions.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 03:13 PM
 
548 posts, read 1,065,744 times
Reputation: 160
Quote:
Originally Posted by macroy View Post
Uh... I wouldn't do that. Nor would I put that USB on a public computer at the library(assuming those files are personal/sensitive). Those are probably one of the more risky places. If that USB is your only backup, I would make sure I'm 100% confident in the stability of the computer I intend to insert that into.
The files are not that personal/sensitive.
They are mostly photos and description of the photos. So is there really that big of risk?
I have never used the computer at the library for a USB. I assume they have USB ports for people to use don't they?

And as far as being 100% confident in the stability of the computer,...that is why I thought about using the Library. Wouldn't their computers have that kind of stability ?




.
Reply With Quote Quick reply to this message
Please register to post and access all features of our very popular forum. It is free and quick. Over $68,000 in prizes has already been given out to active posters on our forum. Additional giveaways are planned.

Detailed information about all U.S. cities, counties, and zip codes on our site: City-data.com.


Reply
Please update this thread with any new information or opinions. This open thread is still read by thousands of people, so we encourage all additional points of view.

Quick Reply
Message:

Over $104,000 in prizes was already given out to active posters on our forum and additional giveaways are planned!

Go Back   City-Data Forum > General Forums > Science and Technology > Internet
Follow City-Data.com founder on our Forum or

All times are GMT -6. The time now is 09:41 PM.

© 2005-2019, Advameg, Inc. · Please obey Forum Rules · Terms of Use and Privacy Policy · Bug Bounty

City-Data.com - Archive 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35 - Top