Welcome to City-Data.com Forum!
U.S. CitiesCity-Data Forum Index
Go Back   City-Data Forum > General Forums > Science and Technology > Internet
 [Register]
Please register to participate in our discussions with 2 million other members - it's free and quick! Some forums can only be seen by registered members. After you create your account, you'll be able to customize options and access all our 15,000 new posts/day with fewer ads.
View detailed profile (Advanced) or search
site with Google Custom Search

Search Forums  (Advanced)
Reply Start New Thread
 
Old 12-30-2014, 12:53 PM
 
570 posts, read 1,286,306 times
Reputation: 170

Advertisements

ALL my files..... including pictures, text files etc have now got an added extension of " .lwojehi"

for example .... mypicture.jpg.lwojehi or meetingnotes.txt.lwojehi

Is that some sort of ecription or a virus?

Is there any way to restore my files so I can see them?

.

Last edited by elnina; 01-06-2015 at 01:36 PM..
Reply With Quote Quick reply to this message

 
Old 12-30-2014, 05:15 PM
 
Location: Wooster, Ohio
4,141 posts, read 3,050,632 times
Reputation: 7280
If you rename your files by eliminating the added extension, can you then work with them?
Reply With Quote Quick reply to this message
 
Old 12-30-2014, 05:36 PM
 
570 posts, read 1,286,306 times
Reputation: 170
Quote:
Originally Posted by mshultz View Post
If you rename your files by eliminating the added extension, can you then work with them?
No. I can open the file but the text is changed to what looks like japaneese symbols
Reply With Quote Quick reply to this message
 
Old 12-30-2014, 06:11 PM
 
Location: Denver
9,963 posts, read 18,496,447 times
Reputation: 6181
Quote:
Originally Posted by LastStraw View Post
ALL my files..... including pictures, text files etc have now got an added extension of " .lwojehi"

for example .... mypicture.jpg.lwojehi or meetingnotes.txt.lwojehi

Is that some sort of ecription or a virus?

Is there any way to restore my files so I can see them?

.
Those look like random characters to me.

It could be this virus (not sure until you run an anti-virus program):
How to restore renamed .exe, .doc and .pdf files*with Panda Ransomware Decrypt tool*-Technical Support-Panda Security

  • Do you have an anti-virus(AV) program installed like McAfee, Symantec, Panda, Sophos etc?
  • If not get one ASAP, make sure you update to the latest anti-virus dat files, then run a scan.
  • If it finds a virus make sure to note what that is for later research then allow AV to clean.
  • You may still have to rename your effected files afterwards. The link above indicates what kind of utility to run that may clean your machine.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 12:29 PM
 
570 posts, read 1,286,306 times
Reputation: 170
* Now ALL files have that same ending added to them ( .lwojehi )
and I found a message in my document folder that reads as follows:

"_Your documents, photos, databases and other important files have been encrypted
with strongest encryption and unique key, generated for this computer.
Private decryption key is stored on a secret Internet server and nobody can
decrypt your files until you pay and obtain the private key.
If you see the main locker window, follow the instructions on the locker.
Overwise, it's seems that you or your antivirus deleted the locker program.
Now you have the last chance to decrypt your files.
Open http://xxxxxxxxx or http://xxxxxxxxx
in your browser. They are public gates to the secret server.
If you have problems with gates, use direct connection:
1. Download Tor Browser from http://xxxxxxx
2. In the Tor Browser open the http://xxxxxxxx
Note that this server is available via Tor Browser only.
Retry in 1 hour if site is not reachable.
Copy and paste the following public key in the input form on server. Avoid missprints.
-QBIOWC-72UO25-SJJZCP-ZL2VGF-KPL43J-BVPXCH-KP5XJK
T7XCOI-SKGRWT-7IUWOY-KWM6-I6VLPT-TDCAU3
L72QZE-OZAGTK-JAVSQU-3WETOA-AY5AVA-TL4WOO-S4FROL-AAN4PQ
Follow the instructions on the server.__"

---------------------------------------
I'm surprised something about this terrible virus has not been mentioned on this forum???
Or has it? Really havn't had time to do a "search" because I've been trying to take care of this problem.

I believe it is called the "crptolocker virus" or Trojan.Ransom and Trojan.CriLock.XL

I've done a Virus Scan with MSSE and I think I removed it (actually multiples of them) but I've been told it may still be on my computer somewhere.
Is is necessary to reformat my hard drive and reinstall Windows again?

Also,.. is there any way to remove the encryption on my files and get them back without having to pay the ransom for the key ??

Panda did not work because it said it needs a copy of the orignal file which i do not have.





.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 12:51 PM
 
Location: Wandering.
3,549 posts, read 6,663,367 times
Reputation: 2704
Pretty sure it's been mentioned here before.

There really is no way to unlock the files other than pay the ransom (if it is indeed one of those variants, which it appears to be).
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 01:15 PM
 
570 posts, read 1,286,306 times
Reputation: 170
I saved my files on an external USB stick, but I don't know how safe it is to put in back into my computer again.

I thought maybe I would take the USB stick to the library and put in into one of their computers to check it out,....because I'm assuming they must have great protection since so many people use their computers.

I did put it into an old LapTop I have that is outdated and it looked like some files were not encripted but I did not have a way to connect to the internet to load them onto cloud storage, so that is why I thought of the library.

But the main thing I want to find out .....Is necessary for me to have my hard drive wiped clean and reinstall Windows again?




.







.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 01:39 PM
 
Location: The DMV
6,590 posts, read 11,284,036 times
Reputation: 8653
Quote:
Originally Posted by LastStraw View Post
I saved my files on an external USB stick, but I don't know how safe it is to put in back into my computer again.

I thought maybe I would take the USB stick to the library and put in into one of their computers to check it out,....because I'm assuming they must have great protection since so many people use their computers.

I did put it into an old LapTop I have that is outdated and it looked like some files were not encripted but I did not have a way to connect to the internet to load them onto cloud storage, so that is why I thought of the library.

But the main thing I want to find out .....Is necessary for me to have my hard drive wiped clean and reinstall Windows again?

.

.
Uh... I wouldn't do that. Nor would I put that USB on a public computer at the library(assuming those files are personal/sensitive). Those are probably one of the more risky places. If that USB is your only backup, I would make sure I'm 100% confident in the stability of the computer I intend to insert that into.

Personally, I would wipe the drive and reinstall. But that's just me. Is it absolutely necessary? No. There are plenty of people that clean malware off and go on without issues. The resources (and know how) you have at your disposal to rebuilding that computer would come into play. But many malware have a tendency of being persistent. To me, it's not worth the risk.
Reply With Quote Quick reply to this message
 
Old 01-06-2015, 02:13 PM
 
570 posts, read 1,286,306 times
Reputation: 170
Quote:
Originally Posted by macroy View Post
Uh... I wouldn't do that. Nor would I put that USB on a public computer at the library(assuming those files are personal/sensitive). Those are probably one of the more risky places. If that USB is your only backup, I would make sure I'm 100% confident in the stability of the computer I intend to insert that into.
The files are not that personal/sensitive.
They are mostly photos and description of the photos. So is there really that big of risk?
I have never used the computer at the library for a USB. I assume they have USB ports for people to use don't they?

And as far as being 100% confident in the stability of the computer,...that is why I thought about using the Library. Wouldn't their computers have that kind of stability ?




.
Reply With Quote Quick reply to this message
Please register to post and access all features of our very popular forum. It is free and quick. Over $68,000 in prizes has already been given out to active posters on our forum. Additional giveaways are planned.

Detailed information about all U.S. cities, counties, and zip codes on our site: City-data.com.


Reply
Please update this thread with any new information or opinions. This open thread is still read by thousands of people, so we encourage all additional points of view.

Quick Reply
Message:


Over $104,000 in prizes was already given out to active posters on our forum and additional giveaways are planned!

Go Back   City-Data Forum > General Forums > Science and Technology > Internet

All times are GMT -6. The time now is 03:05 PM.

© 2005-2024, Advameg, Inc. · Please obey Forum Rules · Terms of Use and Privacy Policy · Bug Bounty

City-Data.com - Contact Us - Archive 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37 - Top