5

Yesterday i noticed a folder with a strange name, it looked like this from the inside: enter image description here

I was cautions not open any of the files, but i opened the .sql in a text-editor, to realize it's not SQL but some hash, i renamed the folder to "virus" to remind myself to google the content later, but then i noticed another folder that didn't exist, it must have been created after i renamed the folder, and this time it has a different names: enter image description here

Then it jumped/copied it self to all partitions on the hard desk. Each folder is exactly 1.83 MB with the same file structure. My computer is behaving normally but i might re-install the OS if i couldn't find a way to remove this virus.

so... Can you recognize this virus? What category it might belong to?

Maged E William
  • 153
  • 1
  • 4
  • 2
    You can upload and test the files on virustotal.com Maybe you'll get some idea – pri Jan 16 '17 at 11:16
  • @PriyankGupta Oh that's a good idea, but it actually gave me all green – Maged E William Jan 16 '17 at 11:22
  • None of those file names come up in google so i presume they are randomised (including extensions). If VT hasn't found anything and your local anti virus hasn't either there are plenty more online tools - housecall, bitdefender, eset, f secure. – iainpb Jan 16 '17 at 11:27

1 Answers1

18

It looks like you installed Cybereason RansomFree.

This writes two folders with 'random' file names to each of your partitions, and one to the desktop labeled This folder protects against ransomware. Modifying it will reduce protection* (which you will only see if you have configured Windows to show hidden/system files).

The program monitors these folders for ransomware activity, and regularly rewrites them. The file contents are gibberish, you can't open one of these .xls files in Excel, etc.

So, not a virus.
Here is a sample folder from my drive:

enter image description here

* Actual text changes with version. They have been updating the program several times over the past few weeks.