Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

(I'm not sure if here is correct place for asking this question)

I've come across a strange virus that changed contents of all MS Word, Excel, PowerPoint and image formats. It places this ASCII string in all files:

Because fuck you! Thats why

How do I recover information?

Updates

  • This computer is not mine. (I don't use Windows at all). A friend of mine asked me to recover her files. Without those documents she can't get her degree of MSc.
  • Modification time of Word files are very close to each other. That's absolutely not the last time the user accessed those files.
  • The message is not inserted into body of a document. All contents of the file (binary data) is replaced with an ASCII string. Now they're all 29 bytes in length. This is what I can see in Linux:

    $ file ./area-research-2013.docx
    ./area-research-2013.docx: ASCII text, with no line terminators
    $ cat ./area-research-2013.docx 
    Because fuck you! That's why.$
    $ stat ./area-research-2013.docx
      File: `./area-research-2013.docx'
      Size: 29              Blocks: 8          IO Block: 4096   regular file
    Device: 821h/2081d      Inode: 2929        Links: 1
    Access: (0644/-rw-r--r--)  Uid: ( 1000/ soroush)   Gid: ( 1000/ soroush)
    Access: 2013-05-26 17:32:13.000000000 +0430
    Modify: 2013-05-21 09:51:18.000000000 +0430
    Change: 2013-06-26 17:29:09.870000000 +0430
     Birth: -
    
  • I don't have any other information about what exactly happened. I got this laptop when a new operating system was installed and everything looks fine right now. This may be a virus, a trojan (running in Java runtime) or an MS Word macro. I'm not interested in what exactly that is and how to get rid of. I'm looking for a way to recover the very important data on one of partitions. If it can help, I'll upload maybe-infected executables (7zip-ed).

share|improve this question
    
I'm curious what makes you believe it's indeed a virus (suggesting it's capable of replication and spreading), and not rather a bit lame office prank by either manually overwriting your documents, or changing them with a fast written custom malware that would do a search of your local MS Office files and attach (inject) this message in their bodies? I'm asking because, well: 1) It seems a bit personal, 2) It could be written really fast, 3) You don't provide any information that would clearly identify this as a computer virus. Have you tried identifying what was changing your files? –  TildalWave May 25 '13 at 20:43
1  
Could you please provide following information: 1) Last modified date stamps for these files (do they change much?), 2) Where in document bodies is this message inserted and how frequently per document? 3) A sample part of the raw document data where it's inserted, 4) List of running processes that you can't identify, 5) Inspect for injected system startup processes using msconfig and report names of unidentified applications, 6) Provided you've identified the malware responsible, upload it in an archive to any file sharing service and attach a link to it, so we can inspect it. Thanks! –  TildalWave May 25 '13 at 20:51
3  
For the record, I didn't write your virus no matter how frequently I say that to people. –  Scott Pack May 25 '13 at 21:42
1  
@ScottPack - For the record, if this really turns out to be some new yet undiscovered virus, I'd like it named "know your meme virus" ... And I've heard you only write viruses in Snark++, is that true? :)) –  TildalWave May 25 '13 at 21:57
1  
@ScottPack Why do you feel the need to deny it unless you are guilty of something? –  Terry Chia May 26 '13 at 6:19

1 Answer 1

With this information I am saying the files are overwritten. So I hope you didn't fool about too much but have a look at file recovery: https://www.google.co.uk/search?q=recover+lost+files+windows

If that doesn't work, rewriting the documents will be the only option. Unless you can find this virus and upload it for analysis :)

share|improve this answer
    
Unfortunately recovering didn't help. I should give this laptop back to its owner today and I can't search anymore. Thanks for your answer –  sorush-r May 27 '13 at 8:13
    
Better luck next time, sorry to hear about the loss. –  Stolas May 27 '13 at 8:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.