CheckEmoji Community · the emoji forum
🏠 Home 🆕 What's new ❓ Unanswered 🔥 Popular 📡 RSS Members 👥 0 online log in · register
Home › IT › IT Support › Can't open any Word docs on my D: drive

Can't open any Word docs on my D: drive

Started by Carol Harris9 · · 👁 4 views · 8 replies

📡 Subscribe to replies

Participants Carol Harris9Sam Rodriguez51Maria James94Benjamin King2David Price5Michelle Alvarez8
Carol Harris9 Carol Harris9 MemberOP
21 messages
joined Feb 2015
#1 ·
I keep all my documents, photos, and MP3 files on my D: drive, but I am absolutely reeling from what happened today. I’m in total shock. I can’t open a single Word document—instead, it just displays these bizarre, nonsensical Greek and Chinese characters. My photos won't load, my music won't play, nothing works! To make matters worse, I noticed that every single folder and subfolder is now cluttered with three specific files named:
DECRYPT_INSTRUCTION.URL
DECRYPT_INSTRUCTION.HTML
DECRYPT_INSTRUCTION.TXT


I realize some people might reply with English links explaining how to handle this, and frankly, I’m a bit overwhelmed and might struggle to follow technical instructions in a foreign language. If anyone would be kind enough to explain the situation in plain American English, I would be incredibly grateful.

Please, if anyone knows how I might be able to rescue my documents and MP3s, I am desperate for help.
Sam Rodriguez51 Sam Rodriguez51 Member
14 messages
joined Dec 2014
#2 ·
Probably some kind of virus. Run a scan on your PC using this and your own antivirus, then let me know what you find
Carol Harris9 Carol Harris9 MemberOP
21 messages
joined Feb 2015
#3 ·
Well, it looks like my Malwarebytes scan turned up about ten different issues. Here is the breakdown of what it found:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/17/2014
Scan Time: 22:59:49 Logfile
Logfile: malware.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.05.28.05
Rootkit Database: v2014.05.21.01
License: Free
Antivirus Protection: Disabled
Web Protection: Disabled
Self-protection: Disabled

OS: Windows 7
CPU: x86 file system
File System: NTFS
User: PAPE

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 227973
Time Elapsed: 5 min, 19 sec

Memory: Enabled
Enabled startup: Enabled
Enabled Filesystem: Enabled
Enabled Archives: Enabled
Enabled Rootkits: Enabled
Deep Rootkit Scan: Enabled
Enabled Heuristics: Enabled
Enabled PUA: Warn
PUM: Warn

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Web Searches.A, C:\Users\PAPE\AppData\Local\Google\Chrome\user data\Default\Preferences, Good: (), Bad: ( "startup_urls": [ "https://isearch.avg.com/?cid={9DA53BAF-6579-4798-8412-6C9D779B03A9}&mid=4a787702072a47d0ac24d153354807e5-21f0121011a1faf2dbd4c7d9a8f0a61df9a8be6b&lang=en&d s=bm012&pr=sa&d=2012-10-08%2009:17:28&v=12.2.5.34&sap=hp", "http://www.mysearchresults.com/?c=3507&t=07", "http://search.conduit.com/?ctid=CT3225826&SearchSource=48", "http://feed.snap.do/?publisher=DownloadX&dpid=DownloadX&co=US&userid=7 a23e65f-d51a-40ff-bb52-e652370b5e2b&searchtype=hp", "http://tuvaro.com/ws/?source=4c3f95e5&tbp=homepage&toolbarid=base&u=104 0fd65000000000000001a73acee16", "http://www.google.com/", "http://www.msn.com/?pc=UP93&ocid=UP93DHP&dt=041013", "http://websearch.helpmefindyour.info/?pid=821&r=2013/04/15&hid=4178208008&lg=EN&cc=US", "http://us.yahoo.com/?fr=fpc-comodo", "http://websearch.homesearch-hub.info/?pid=964&r=2013/06/18&hid=4178208008&lg=EN&cc=US&unqvl=20", "http://websearch.searchdwebs.info/?pid=500&r=2013/06/22&hid=4178208008&lg=EN&cc=US&unqvl=22", "http://websearch.searchboxes.info/?pid=924&r=2013/07/17&hid=203906117&lg=EN&cc=US&unqvl=28", "http://www1.delta-search.com/?babsrc=HP_ss&mntrId=781D001E3702E891&affID=121564 &tsp=4947", "", "http://websearch.simplesearches.info/?pid=500&r=2013/08/23&hid=2234966653&lg=EN&cc=US&unqvl=31", "http://www.delta-search.com/?babsrc=HP_ss&mntrId=E063001A73ACEE16&affID=120698 &tsp=5039", "http://www.msn.com/?pc=BDT1&ocid=BDT1DHP&dt=121413", "http://www.google.com/", "http://www.search.ask.com/?tpid=OVO2V7C&o=APN11137&pf=V7&trgb=CR&p2=,[c946da7a9be021154aad2264fe06d22e]EBD6,[c946da7a9be021154aad2264fe06d22e]EYYYYYY,[c946da7a9be021154aad2264fe06d22e]EYY,[c946da7a9be021154aad2264fe06d22e]EHR&gct=hp&apn_ptnrs=,[c946da7a9be021154aad2264fe06d22e]EBD6&apn_dtid=,[c946da7a9be021154aad2264fe06d22e]EYYYYYY,[c946da7a9be021154aad2264fe06d22e]EYY,[c946da7a9be021154aad2264fe06d22e]EHR&apn_dbr=cr_32.0.1700.107&apn_uid=C1B5CF41-0D84-435A-9DC0-365266B9C8AC&itbv=12.10.0.3729&doi=2014-02-08&psv=", "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-107&v=n11551-262&t=4", "http://www.buenosearch.com/?babsrc=HP_ss&mntrId=80E5001A73ACEE16&affID=128403 &tsp=5188", "http://websearch.exitingsearch.info/?pid=1182&r=2014/03/17&hid=8152084885853768692&lg=EN&cc=US&unqvl=50", "http://websearch.amaizingsearches.info/?pid=725&r=2014/05/05&hid=780482451046187295&lg=EN&cc=US&unqvl=51", "http://www.buenosearch.com/?babsrc=HP_ss&mntrId=58D8001A73ACEE16&affID=128403 &tsp=5224", "http://istart.webssearches.com/?type=hp&ts=1407356823&from=wpc&uid=HitachiXHTS545 032B9A300_110121PBPC03CD077KZLX", "http://websearch.wonderfulsearches.info/?pid=1909&r=2014/08/06&hid=6699362537208269756&lg=EN&cc=US&unqvl=60", "http://search.gboxapp.com/" ],), ,[c946da7a9be021154aad2264fe06d22e]

Physical Sectors: 9
Forged physical sector, Physical Sector #1 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1192 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1195 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1455 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1511 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1551 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1663 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1943 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],
Forged physical sector, Physical Sector #1975 on Drive #0, , [fcf915fe6cae0af18e09fb418074461c],

(end)
Maria James94 Maria James94 Member
39 messages
joined May 2009
#4 ·
Carl Fowler said:DECRYPT_INSTRUCTION.URL
DECRYPT_INSTRUCTION.HTML
DECRYPT_INSTRUCTION.TXT

Just my initial take, but this whole thing smells like Ransomware.
Benjamin King2 Benjamin King2 Active Member
138 messages
joined Apr 2007
#5 ·
Yep, Ransomware.

Carol Harris9, you really stepped in it this time. 🙂 It’s pretty much a binary choice at this point—either you pay whatever ridiculous amount they're demanding (you might want to take a look at what those decryption docs actually say) or you just say goodbye to all your files.
Carol Harris9 Carol Harris9 MemberOP
21 messages
joined Feb 2015
#6 ·
Good grief, I must say, I haven't encountered a situation quite like this in my fifty years on this planet.
Well, there's no sense crying over spilled milk, I suppose; if only I had shaved my head completely bald, perhaps I wouldn't be tearing my hair out right now.

As the old saying goes, "this is quite the learning experience."
David Price5 David Price5 Regular
435 messages
joined Jul 2012
#7 ·
Now, all that's left is deciding whether you want to settle up using Bitcoin or stick with another currency...
Carol Harris9 Carol Harris9 MemberOP
21 messages
joined Feb 2015
#8 ·
There is absolutely no way in hell I am paying anyone a single cent. Honestly, if everything falls apart, then so be it—we’ll just wipe the slate clean and start from scratch.
Michelle Alvarez8 Michelle Alvarez8 Regular
299 messages
joined Nov 2015
#9 ·
Carl Fowler said:Oh man, this hasn't happened to me once in the last 50 years or so!

Well, it probably would've been pretty weird if it had happened in the last 50 years, right? 😁

You must log in or register to reply here.

Log in Register

🔗 Similar threads