Author Topic: Virus changing file extensions to .vscrypt  (Read 3913 times)

0 Members and 1 Guest are viewing this topic.

tkane

  • Guest
Virus changing file extensions to .vscrypt
« on: May 12, 2009, 02:04:23 AM »
I got hacked! File extensions changed to .vscrypt.
E.g. filename.doc.vscrypt and filename.jpg.vscrypt
Can someone help me change the files back?
« Last Edit: May 12, 2009, 05:50:53 AM by tkane »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67198
Re: Virus changing file extensions to .vscrypt
« Reply #1 on: May 12, 2009, 02:04:29 PM »
I suggest:

1. Clean your temporary files.
2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
3. Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
6. Disable System Restore and then reenable it again.
7. Immunize your system with SpywareBlaster.
8. Check if you have insecure applications with Secunia Software Inspector.

After that, restore your file associations: http://www.dougknox.com/xp/file_assoc.htm
The best things in life are free.