-1

(I'm not sure if here is correct place for asking this question)

I've come across a strange virus that changed contents of all MS Word, Excel, PowerPoint and image formats. It places this ASCII string in all files:

Because fuck you! Thats why

How do I recover information?

Updates

  • This computer is not mine. (I don't use Windows at all). A friend of mine asked me to recover her files. Without those documents she can't get her degree of MSc.
  • Modification time of Word files are very close to each other. That's absolutely not the last time the user accessed those files.

  • The message is not inserted into body of a document. All contents of the file (binary data) is replaced with an ASCII string. Now they're all 29 bytes in length. This is what I can see in Linux:

    $ file ./area-research-2013.docx
./area-research-2013.docx: ASCII text, with no line terminators
$ cat ./area-research-2013.docx 
Because fuck you! That's why.$
$ stat ./area-research-2013.docx
  File: `./area-research-2013.docx'
  Size: 29              Blocks: 8          IO Block: 4096   regular file
Device: 821h/2081d      Inode: 2929        Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/ soroush)   Gid: ( 1000/ soroush)
Access: 2013-05-26 17:32:13.000000000 +0430
Modify: 2013-05-21 09:51:18.000000000 +0430
Change: 2013-06-26 17:29:09.870000000 +0430
 Birth: -

  • I don't have any other information about what exactly happened. I got this laptop when a new operating system was installed and everything looks fine right now. This may be a virus, a trojan (running in Java runtime) or an MS Word macro. I'm not interested in what exactly that is and how to get rid of. I'm looking for a way to recover the very important data on one of partitions. If it can help, I'll upload maybe-infected executables (7zip-ed).

Improve this question
7
  • I'm curious what makes you believe it's indeed a virus (suggesting it's capable of replication and spreading), and not rather a bit lame office prank by either manually overwriting your documents, or changing them with a fast written custom malware that would do a search of your local MS Office files and attach (inject) this message in their bodies? I'm asking because, well: 1) It seems a bit personal, 2) It could be written really fast, 3) You don't provide any information that would clearly identify this as a computer virus. Have you tried identifying what was changing your files?
    – TildalWave
    Commented May 25, 2013 at 20:43
  • 1
    Could you please provide following information: 1) Last modified date stamps for these files (do they change much?), 2) Where in document bodies is this message inserted and how frequently per document? 3) A sample part of the raw document data where it's inserted, 4) List of running processes that you can't identify, 5) Inspect for injected system startup processes using msconfig and report names of unidentified applications, 6) Provided you've identified the malware responsible, upload it in an archive to any file sharing service and attach a link to it, so we can inspect it. Thanks!
    – TildalWave
    Commented May 25, 2013 at 20:51
  • 3
    For the record, I didn't write your virus no matter how frequently I say that to people.
    – Scott Pack
    Commented May 25, 2013 at 21:42
  • 1
    @ScottPack - For the record, if this really turns out to be some new yet undiscovered virus, I'd like it named "know your meme virus" ... And I've heard you only write viruses in Snark++, is that true? :))
    – TildalWave
    Commented May 25, 2013 at 21:57
  • 1
    @ScottPack Why do you feel the need to deny it unless you are guilty of something?
    – user10211
    Commented May 26, 2013 at 6:19

1 Answer 1

Reset to default
4

With this information I am saying the files are overwritten. So I hope you didn't fool about too much but have a look at file recovery: https://www.google.co.uk/search?q=recover+lost+files+windows

If that doesn't work, rewriting the documents will be the only option. Unless you can find this virus and upload it for analysis :)

Improve this answer
2
  • Unfortunately recovering didn't help. I should give this laptop back to its owner today and I can't search anymore. Thanks for your answer
    – sorush-r
    Commented May 27, 2013 at 8:13
  • Better luck next time, sorry to hear about the loss.
    – Stolas
    Commented May 27, 2013 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .