Rogue .yoyvyrf file extension

Status
Not open for further replies.
F

Firetree

New member
Curious if anyone has run across a bug that adds a bogus file extension of .yoyvyrf at the end of an otherwise legitimate file name (cf., myphoto.jpg becomes myphoto.jpg.yoyvyrf). The file also becomes hopelessly corrupted, even if you fix the file name. Neither SpyBot or Avast found anything. It was done on hundreds of files on this person's backup drive...I won't be getting into the main box until tomorrow afternoon.

Anyone seen this? Basically curiosity...gonna have to clean out the whole system anyway.

Thanks in advance.
----------------------------------
Admin Edit
For future reference and others reading. :)
http://forums.spybot.info/showthrea...ocedure-Before-Requesting-Assistance)-Updated
 
Very uncomfortable with what your finding.

If I have you run this tool and it finds what I'm thinking it will, you will have a ton of work to do.

Don't know if there is anything I can do, if we can identify which infection it is then there is a chance we can undo some of the damage.

IDToolbyNathan.png
IDTool
  • Please download IDTool and save the file to your Desktop.
  • Right-Click idtool.zip and click Extract All. Select your Desktop and click Extract.
  • [font=helvetica, arial, sans-serif]Right-Click IDTool.exe and click [/font]
    AVOiBNU.jpg
    Run as administrator     to run the programme.
  • If you're prompted to download and install [font=helvetica, arial, sans-serif]Micorsoft .NET Framework, please agree. [/font]
  • [font=helvetica, arial, sans-serif]Allow the programme to collect the necessary data. [/font]
  • [font=helvetica, arial, sans-serif]Once the main console is loaded, click [/font]Rescan Computer and Generate a New Report.
  • Upon completion, and when prompted that the rescan is complete, click Generate Text Friendly Report for Forums.
  • Copy the contents of the report and paste in your next reply.
 
Last edited:
It's a network drive

I'll try that...so long as this utility will handle an external drive. I won't be getting into the main box until this afternoon...but I'm now thinking I'd better wait on any action until I get a look at "mama." Thanks for the response/suggestion.


Juliet said:
Very uncomfortable with what your finding.

If I have you run this tool and it finds what I'm thinking it will, you will have a ton of work to do.

Don't know if there is anything I can do, if we can identify which infection it is then there is a chance we can undo some of the damage.

IDToolbyNathan.png
IDTool
  • Please download IDTool and save the file to your Desktop.
  • Right-Click idtool.zip and click Extract All. Select your Desktop and click Extract.
  • [font=helvetica, arial, sans-serif]Right-Click IDTool.exe and click [/font]
    AVOiBNU.jpg
    Run as administrator     to run the programme.
  • If you're prompted to download and install [font=helvetica, arial, sans-serif]Micorsoft .NET Framework, please agree. [/font]
  • [font=helvetica, arial, sans-serif]Allow the programme to collect the necessary data. [/font]
  • [font=helvetica, arial, sans-serif]Once the main console is loaded, click [/font]Rescan Computer and Generate a New Report.
  • Upon completion, and when prompted that the rescan is complete, click Generate Text Friendly Report for Forums.
  • Copy the contents of the report and paste in your next reply.
Click to expand...
 
Found it...wha' hoppened?

I figured it out. It's CTB-Locker. From all indications it was on the HDD AFTER the previous techs had "clean installed" Win7. There is also evidence (from file IDs) that the infection was there BEFORE they clean installed the OS. That's troublesome. I also had scanned this drive (outside of the box, on my hot-swap system using my paid version) and SpyBot did NOT see it. I'm running a boot-time scan with Avast now to see what comes up there...but not expecting anything, because it did not discover any indicators when file transfers were started...which it will do if the threat is in its library. Also...the bug's UI isn't auto-triggering as it normally would. Interesting indeed.

Anyway...considering the HDD is eight years old, and the computer is six years old, I think my recommendation will be a new machine. Unfortunately, they've lost all their data. The backups were also contaminated/encrypted.

Hope that info may be of help to others.

Firetree said:
Curious if anyone has run across a bug that adds a bogus file extension of .yoyvyrf at the end of an otherwise legitimate file name (cf., myphoto.jpg becomes myphoto.jpg.yoyvyrf). The file also becomes hopelessly corrupted, even if you fix the file name. Neither SpyBot or Avast found anything. It was done on hundreds of files on this person's backup drive...I won't be getting into the main box until tomorrow afternoon.

Anyone seen this? Basically curiosity...gonna have to clean out the whole system anyway.

Thanks in advance.
Click to expand...
 
It's possible some files/folders can be recovered.....which ones I can't say.
If your interested in trying:

recovery with the use of Previous Versions or ShadowExplorer may be possible. File recovery software may also be an option if the infection does not securely delete the original files.

y3MMIrs.png
Previous Versions
  • Right-click the file/folder and click Properties.
  • Click Previous Versions.
  • This tab will list all copies of the file and the date they were backed up.
  • To restore a particular version of the file, click Copy and select the directory you wish to restore the file to.
  • If you wish to restore the selected file and replace the existing one, click Restore.
  • If you wish to view the contents of the file before restoring, click Open.
MzmiIl9.gif
ShadowExplorer
  • Please download ShadowExplorer and save the file to your Desktop.
  • Right-Click ShadowExplorer-0.9-portable.zip and click Extract All. Select your Desktop and click Extract.
  • Right-Click ShadowExplorer.exe and select
    AVOiBNU.jpg
    Run as administrator     to run the programme.
  • You will see a drop-down menu with the shadow copies of all partitions and disks present.
  • Click C:\ from the drop-down menu.
  • To the right, pick a date prior to the infection from the drop-down menu.
  • To restore a whole folder, right-click on your desired folder and click Export. You will then be prompted as to where you would like to restore the contents of the folder to.




J8xQM97.png
File Recovery Software
File Recovery Software may be able to recover the original file deleted by the infection. Please bear in mind, the more you use the machine after the files are encrypted, the harder it will be for the recovery software to recover your files.
  • fSA1TL4.png
    R-Studio
  • http://i.imgur.com/C08PZmH.png[/img [url=http://www.cgsecurity.org/wiki/PhotoRec]Photorec[/url]
    [*][url=http://www.piriform.com/recuva/builds][img]http://i.imgur.com/uc6sByo.png[/url] Recuva
 
Last edited:
File recovery utilties are useless

I specialize in data recovery...three different data recovery apps did not find any residual, unencrypted files. These folks are SOL, I'm afraid.

What bothers me most, I think, is that SpyBot didn't detect this at all. Neither did Avast, or McAfee, or Norton, or AVG. Hmmmm...

Another development (just today) is that this same person found that files they have residing on Picasa are infected/encrypted. I'm not able to discern as yet if they were infected by someone else uploading to Picasa, or were infected on the client's machine prior to being uploaded.

Not one of our better days out here in tropical paradise... :cool:

Juliet said:
It's possible some files/folders can be recovered.....which ones I can't say.
If your interested in trying:

recovery with the use of Previous Versions or ShadowExplorer may be possible. File recovery software may also be an option if the infection does not securely delete the original files.

y3MMIrs.png
Previous Versions
  • Right-click the file/folder and click Properties.
  • Click Previous Versions.
  • This tab will list all copies of the file and the date they were backed up.
  • To restore a particular version of the file, click Copy and select the directory you wish to restore the file to.
  • If you wish to restore the selected file and replace the existing one, click Restore.
  • If you wish to view the contents of the file before restoring, click Open.
MzmiIl9.gif
ShadowExplorer
  • Please download ShadowExplorer and save the file to your Desktop.
  • Right-Click ShadowExplorer-0.9-portable.zip and click Extract All. Select your Desktop and click Extract.
  • Right-Click ShadowExplorer.exe and select
    AVOiBNU.jpg
    Run as administrator     to run the programme.
  • You will see a drop-down menu with the shadow copies of all partitions and disks present.
  • Click C:\ from the drop-down menu.
  • To the right, pick a date prior to the infection from the drop-down menu.
  • To restore a whole folder, right-click on your desired folder and click Export. You will then be prompted as to where you would like to restore the contents of the folder to.




J8xQM97.png
File Recovery Software
File Recovery Software may be able to recover the original file deleted by the infection. Please bear in mind, the more you use the machine after the files are encrypted, the harder it will be for the recovery software to recover your files.
  • fSA1TL4.png
    R-Studio
  • http://i.imgur.com/C08PZmH.png[/img [url=http://www.cgsecurity.org/wiki/PhotoRec]Photorec[/url]
    [*][url=http://www.piriform.com/recuva/builds][img]http://i.imgur.com/uc6sByo.png[/url] Recuva
Click to expand...
 
I think developers are searching relentlessly for an exact venue on how people are infected with this version of CTB-Locker, past versions, and future versions, and dissect it for a patch.

It's sad to say we don't know it all when it comes to what will become infected and what wont. We do try to post info on how to stay protected and avoid infection but some how I think it's able to slip through those preventions.

Let me supply you with an article for this specific version in hopes it can help in some small way.
http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information
 
Glad we could help. :)
sparkle.gif


Since this issue appears resolved ... this Topic is closed.
 
Status
Not open for further replies.
Back
Top