Browsers forum: Internet Explorer favorites

because IE's Favorites is just one text file which the browser uses to list favorites while the browser is open.

So please tell us what happens when you try to open a link from inside your browser using your Favorites links.

Mark

While I know we could fix associations your post is incomplete. No mention of the version of Windows, IE and I'm left to wonder if LCBK is really a .LNK.
Bob

Thanks for your replies.

Windows XP, IE ver 8.0 and it is LCBK.

When I go into my favorites, all the names now have 'locked' in front of them, and they will not open.
If I right click on any favorite and look in properties, general, it says the file type is LCBK where it normally says Internet shortcut.

It must be some sort of virus but I am running AVG anti virus and Windows Firewall, so am a bit confused!!

And while we know what a LNK and .URL file may be, a trojan or something else could name a file anything it wants. You could scan with Grif's advice at http://forums.cnet.com/7726-6132_102-5098912.html?tag=posts;msg5099421
And hopefully it is a known pest.
Bob

Since then I have turned of the computer and restarted it. It is obviously a virus of some sort, as the computer comes up with a message saying it is locked!!

It boots up, and then totally locks up, so I cannot access anything at all.

What do I do now? I seem to remember you could boot from the CD or start in safe mode, but I dont know how that will help. I am not much of a techie!

Put the Windows version you run (Windows XP?) and SAFE MODE into google to pick the article you understand.

Grif does note to boot and scan in safe mode.
Bob

I have goy back to trying to sort out this issue, but it is even worse now!!!

All my data files, word docs, xls, pdf etc etc are now locked and I cannot access anything at all!!

Disaster of mega proportions!

The computer is a Toshiba lap top and I do not know even how to get into safe mode.

So some help would be appreciated please.

Colin

It appears you haven't cleaned off that nasty yet but I wonder if you took Grif's advice. You didn't tell.

Grif writes about UNHIDE.EXE at http://forums.cnet.com/7726-6122_102-5239386.html and this applies to what he writes there and files.

MY CONCERN HERE is that you appear to have no backup copies. That is, we only lose what we don't backup.

Are your files worth having a backup copy?
Bob

Hi Bob, I have downloaded the Rkill and Malwarebytes onto a memory stick, and the computer will not even recognise the memory stick, so no I have not managed to do it yet.
I also do not know how to open up the machine in safe mode so until I find that out I am going to struggle!

Backup? Yes they are worth having a backup copy, for for many reasons this has not been done. We have all sorts of pressures here at this time, and we have been talking about using a cloud. But we havnt done it ........

Colin

They do that to make recovery hard. You may have to boot SAFE MODE and use them from a CD.
Bob

Google would tell you, but quickly, reboot the computer and after the BIOS checks start tapping the F8 key once a second until you see the Safe Mode list of options.

Mark

Even worse, they are demanding money from me to turn my computer back on!!!!

But have got into safe mode and am now running Rkill and Malwarebytes.

Fingers crossed

and good luck.

Mark

I seem to be able to access programs now, but all my data files are corrupt.

For example a file named expenditure04-05.xls is now called locked-expenditure04-05.xls.cbml and is now known as a cbml file.
expenditure 05-06.xls is now called locked-expenditure05-06.xls.jlxv and is known as a jlxv file.

The virus has renamed all my files with a random 4 letter code.

What the h*ll do I do now??

If so, run those programs again in Normal Mode.

Remember when you run RKill, do not reboot afterwards but instead run MBAM again, then Unhide.exe

You may have to run these a few times.

Mark

"They want money"

Who is this 'they'? Is this the malware you thought you had but didn't know?

What are you seeing, and what does it say?

Mark

The money was demamnded by the Malware. I have managed with Rkill to clear all that but it has left all my data files corrupted.

then we might have suggested different routes.

Different malware often needs to be handled differently.

Do you know the name of this malware?

Try a test with one of those files, eg locked-expenditure05-06.xls.jlxv

Copy the file and place the copy in some other location, eg your Desktop. Why copy? We work on the copy, not on the original for tests. Right click that copied file and select "Rename".

Rename it to expenditure05-06.xls

Press Enter. Now open that file. Does it work?

Mark

Sorry I do not know the name of the malware and do not know hoe to find it, particularly as I have run Rkill and Matwarebytes.

I have copied a word file and a spreadshhet file and saved them as .doc and.xls files.

they will not open!!

Any other suggestions please?

Colin

I hope you have backups of these files because then you can just load the backups, (try one just as a test), and when you have confirmed they all work, delete all the locked files.

If not...?

It seems you were hit with Ransomware, a form of malware that demands money from you for an unlock code. But without knowing which Ransomeware, there are many, your options are severely limited.

How do you know the files are locked? The file names may have 'locked' added to them, along with another file extension, but what happens when you try to open them?

Please give full details.

Here is an example of what one Ransomeware does;
http://news.softpedia.com/news/New-Worm-Locks-Documents-with-Password-155228.shtml

Mark

Hi Mark, I have no backup for the data files, that is the problem. This machine is a laptop I have been using temporarily for about 3 months, and I was going to copy everything back to my desktop when I had finished using it. Unfortunately that was not done!

The locked files all have locked in front of them for example locked-dvla2.doc.cbwr. If I try to open it with Word it just comes up with gibberish.
When I copy and rename it dvla2.doc and open it, I get the message 'Word cannot start the convertor mswrd632' . And I still get gibberish, but different gibberish!!

I have copied my other word documents across from the desktop to the laptop, and they work OK.

I have also copied over my Internet Explorer favorites and they work OK, just not up to date!

If I have lost the data, then that is a total pain in the butt, but I wqould like to recover my emails which are not affected.

I am using Firefox, and do not know where the folders are stored!

The linked article on Ransomware was interesting reading!

Regards

Colin

Firefox doesn't manage emails, except web access email accounts but then any browser would do there as the emails are stored in the cloud, (on the email web servers).

If you mean Thunderbird, (Mozilla's family of Firefox browser and Thunderbird email client), then for Windows XP the emails are store in;

C:\Documents and Settings\{WindowsAccountName}\Application Data\Thunderbird\Profiles\Profile name

But I am unsure what you need to recover if the emails are not affected.

Mark

Thanks for your reply, I need to get all the emails from the laptop onto my desk top, which I can now do thanks.

Colin

It's good that you can now rescue the emails.

I see Bob is helping also and that's great, but I have to be straight here. If you provide a file via Dropbox and we still cannot de-crypt it then your options become severely limited. I see now that the lock has affected other files besides your personal documents and I am assuming that these other files are going to make this OS unstable.

If so, then it is time to cut and run. Reformat that laptop drive and install the OS again as a fresh install.

For your information here's another link, a different example of Ransomeware;
http://www.bleepingcomputer.com/virus-removal/remove-decrypt-accdfisa-protection-program

That one is even worse as it seems the malware wasn't obtained via the usual methods but is actually installed by someone.

You might try BleepingComputer's forums, (available via the link above), or even Kaspersky's forums here http://forum.kaspersky.com/index.php?showforum=3 .

But frankly, if you intend to carry on with this, I am not at all sure forums are the best venue for you and you may have to consider removing the drive and sending it off to some expert data recovery service.

Mark

Put a locked file up on a Public link on your DROPBOX account then share the public link. I'll get and see if the file is one I've seen before.

Sorry but please use google to learn about DROPBOX since we would be duplicating the web if I wrote how to share a file over that.
Bob

Just got in from work and this 62 year old has another skill. Dropbox user!!!

http://dl.dropbox.com/u/80737663/locked-maserati%20job%20list%205.xls.rqet

http://dl.dropbox.com/u/80737663/locked-maserati%20parts%205.xls.psfh

I have taken the liberty of copying 2 what were xls files.

The first is a very simple list, mainly text. The 2nd is a smaller, similar file.

Both of these items relate to a customer's job which has not been invoiced, and I do not have any other record of what is on here. Getting the invoice to him will make the difference to eating this month or not! Sorry to be so glum, but times are pretty hard here in the UK!!!

Good luck!

Colin