All documents show with gibberish, and programs don't open....

[denvercardonations]

I suspect that the files in my laptop might have gotten a "ransomware" type of malware or something similar, because hundreds of documents show like this, with gibberish:



That is what hundreds of txt, doc, ppt, rtf, pretty much all documents now look like. The only thing I can find in researching this, is that the ransomware will change the document encoding and to get it decoded you have to pay them to decode it.

I did change my computer name/workgroup recently, I don't know if that has anything to do with it.

Newly created documents are file....has anyone else encontered this? Or possibly the registry has been changed?

 

[Ron Killian]

Are you sure it's the files? Maybe it's the program you are using to open/view them? Did you try opening them in another program?

Never had that happen to me, but wouldn't be surprised it is possible.

 

[denvercardonations]

I think, or hope, it is something like that. Maybe you could check on your end please. For me, neither the text document nor Google Docs can open these. The file permissions don't look messed up, and the file format seems like it should open it, I was trying to find a way to force a program to read it, no luck though:

Docs: [URLnf="https://docs.google.com/document/d/10k5CoZMCoveat9HqHsuP3uOfUNYjKdI6oWc85gHya1M/edit?usp=sharing"]https://docs.google.com/document/d/10k5CoZMCoveat9HqHsuP3uOfUNYjKdI6oWc85gHya1M/edit?usp=sharing[/URLnf]

[URLnf="https://www.dropbox.com/home?preview=Ready+to+Work+program+Boulder+PDF+hosting.txt"]https://www.dropbox.com/home?preview=Ready+to+Work+program+Boulder+PDF+hosting.txt[/URLnf]

[URLnf="https://www.hashdoc.com/documents/284125/ready-to-work-program-in-boulder-80305-pdf-hosting"]https://www.hashdoc.com/documents/284125/ready-to-work-program-in-boulder-80305-pdf-hosting[/URLnf]

[URLnf="https://onedrive.live.com/redir?resid=2F4543FC1D4DF0A1!446&authkey=!ALry0aPq3xhp4Mw&ithint=file%2ctxt"]https://onedrive.live.com/redir?resid=2F4543FC1D4DF0A1!446&authkey=!ALry0aPq3xhp4Mw&ithint=file%2ctxt[/URLnf]

Scan for detected issues: [URLnf="https://www.metadefender.com/#!/results/file/38811ec72da141a8ab8ddd8fa45ae356/regular"]https://www.metadefender.com/#!/results/file/38811ec72da141a8ab8ddd8fa45ae356/regular
[/URLnf]

For me, Google Docs does render a thumbnail in the folder view. Also, the encoding characters are different...all of the files show the same last modified dateL ‎Friday, ‎May ‎27, ‎2016, ‏‎7:07:03 AM

I googled exactly what happened and this showed up in google searchL: [URLnofo]http://www.symantec.com/connect/articles/recovering-ransomlocked-files-using-built-windows-tools[/URLnofo]

 

[Ron Killian]

First one looks fine.

Drop box one is not working for me.

Hashdoc looks like gibberish.

One drive is gibberish.

Did not know these were all online, I thought you meant they were on your PC.

Hope that helps.

 

[Web Marketing Tool]

For me it is also gibberish. It looks possibly like the charset got messed up or somehow it was converted to binary (or maybe the files were originally binary and got converted to ANSI txt files). I tried converting it to a few popular charsets to see if that fixed it but it didn't fix it for me. I'm honestly not sure if the issue is reversible.

 

[EpicGlobalWeb]

The charset IS messed up! It's loading ASCI in Japanese for some reason.

There is no reason to believe you have ransom-ware based on this though, especially if you loaded it from the cloud. Here's one way to find out though:

1. Download Firefox
2. Download the Japanese to English translator add-on (it's free)
3. Re-open and view the files.

If they are still not readable then the problem is not ASCI.