Hi.

Maybe there are unaffected copies of some jpegs on other medium? In this case you could try to compare before- and after- states and try to figure out the algorithm. Maybe just a couple of bytes are changed or files are XOR'ed with something (you can try to use known JPEG headers to figure out the key).

Just guessing.

Check out https://bitbucket.org/jadacyrus/rans...alkit/overview

As they say they received a popup asking for payment, it would indeed appear to be some cryptolocker type of exploit.

On the other hand, you say it is only jpg image files that are affected, and your original links were to a goodle drive account (thanks again for removing them so quickly) - so I wonder if it is related to the problem discussed in this thread.

Firstfire, I will check with my friend if we can find a photo that we can compare.
Habitual, will check this as soon as I have access to my computer!
Astrogeek, I don't think it is related: jpg files infected were local on my friends pc (he also corrupted his back-up hard drive when he plugged it on his machine). I just uploaded an example of corrupt jpg on my google drive so that people could try to detect what's wrong with the file or attempt to fix it, knowing it does cause any issue on non win**** systems (tried on my mac :-))

Thank you all for giving advice: I didn't expect so many useful answers, somehow I knew I was turning myself to the best !

IF you can upload one of those suspect file to virustotal.com, you may just a clue about these anomalous files.

Hi,

A little update:
- virustotal didn't find anything weird about my file
- my friend will look if he can find a non corrupted version of one file to see if we can compare data contained
- his office documents were infected too (must have been tired when he explained in the first place)

- it seems he was infected by "threat finder v3", need to see if i can find more details about that (it does not seem to be included in the ransomware removal kit you provided, Habitual)

Haroun

PS: it seems files can be recovered with the system restore tool sometimes, will give it a try !

This is "ransom-ware" and is one very good reason to keep Win-doesn't anti-virus soft up to date. Backup everything, preferably to a write once CD or DVD, that you want to keep.

Even better, ditch Win-d'ohs completely.

1 members found this post helpful.