(I'm not sure if here is correct place for asking this question)
I've come across a strange virus that changed contents of all MS Word, Excel, PowerPoint and image formats. It places this ASCII string in all files:
Because fuck you! Thats why
How do I recover information?
- This computer is not mine. (I don't use Windows at all). A friend of mine asked me to recover her files. Without those documents she can't get her degree of MSc.
- Modification time of Word files are very close to each other. That's absolutely not the last time the user accessed those files.
The message is not inserted into body of a document. All contents of the file (binary data) is replaced with an ASCII string. Now they're all 29 bytes in length. This is what I can see in Linux:
$ file ./area-research-2013.docx ./area-research-2013.docx: ASCII text, with no line terminators $ cat ./area-research-2013.docx Because fuck you! That's why.$ $ stat ./area-research-2013.docx File: `./area-research-2013.docx' Size: 29 Blocks: 8 IO Block: 4096 regular file Device: 821h/2081d Inode: 2929 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ soroush) Gid: ( 1000/ soroush) Access: 2013-05-26 17:32:13.000000000 +0430 Modify: 2013-05-21 09:51:18.000000000 +0430 Change: 2013-06-26 17:29:09.870000000 +0430 Birth: -
I don't have any other information about what exactly happened. I got this laptop when a new operating system was installed and everything looks fine right now. This may be a virus, a trojan (running in Java runtime) or an MS Word macro. I'm not interested in what exactly that is and how to get rid of. I'm looking for a way to recover the very important data on one of partitions. If it can help, I'll upload maybe-infected executables (7zip-ed).