Yesterday I noticed my hard drive light was working unusually hard. I instantly shut down, ran both Malwarebytes and Superantispyware. Malwarebytes found some things. I removed them but did not make note of what it removed because I did not see any damage at the time.
Today (the following day) I went to work in Excel and noticed strange behavior relating to files that could not be found. I quickly realized that about 75% of my files across two physical hard drives have names and extensions that have changed. Obviously the file renaming/encryption is what my computer was suspiciously up-to yesterday. The file names are random but they all share the same extension. The extension is *.8877. The modified date and time are the same as well.
Example. An mp3 file that did have a file name of "11 - Rock'n Roll.mp3" now is "d87VrXO9GD.8877".
I ran Malwarebytes again today in safe mode ran 3 times.
Below is what Malwarebytes found on those scans. I cannot confirm if this is the related to the issue, or a coincidence. These have now been removed:
1. Trojan.MalPack, C:\Users\Mark\AppData\Local\Temp\rad0C5EA.tmp.exe, , [1a84ebd38d0dfa3ccc9cf2db000346ba],
2. PUP.Optional.Spigot, C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\kyz1lfbj.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "https://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=888596&p=");), ,[8a144777ebafc1755f77b5854ab9e51b]
This is my first time confronted with potential ransomware. I've read that others who contract ransomware often have their system locked with a screen stating what to do (or asks for money/bitcoin). I was not presented with a lock screen, hijack screen, or instructions of any kind. Perhaps because I shut my computer down during the the encryption it prevented it from completing or showing any screen.
Where and how should I begin to restore my data? There is data I really need to recover that is not on my last backup. The file sizes are correct so I assume the data is there, just not accessible.
I have a couple screen shots that shows how file names looked before and after if that helps. I'm not sure how to upload images to this forum, if possible.
OS. Windows 7 Ultimate. 64bit. Service pack 1.