File security

[Alec19]

Hello,

 

I recently decided to move many of my old files from my laptop to my recently build desktop which has a lot more storage capacity. I transferred pretty much all of my files to two separate flash drives to facilitate the transfer. After that was done I decided that it would be a good idea to run a windows defender security scan on each of the drives prior to transferring the files to my desktop. This turned out to be an excellent plan as it flagged a document on one of the drives which was an html document labeled how to recover your files. I noticed that all of the other files in the folder had the file extension .vvv so I assumed that this was a ransomware attack and just deleted all of the files in the folder. I also checked for hidden files but did not find any. Sadly I did not look for the date stamp on those files so I am unsure of when this may have happened although I guess that isn't super useful information. Either way, I rescanned the drives again with windows defender and found nothing. Then I completely cleaned my main drive and reinstalled windows which I was planning on doing anyways. Figuring that as a newly blank laptop I could freely test the drives again knowing that I wouldn't loose anything just in case something unexpected happened. I once again scanned with windows defender (full scan, offline scan, and custom scans of the flash drives). I also noticed that McAfee live protect was installed by default when I reset the computer. I have once again done a full scan and individual scans of the drives using McAfee this time and nothing has shown up. What concerns me is that I never found any sort of program that would have been responsible for encrypting my files in the first place. I am always as safe as possible online so I don't have any ideas where it may have come from but the fact that I didn't see any evidence of it concerns me although I did wipe the laptop so that should help. While I would normally just give up on the contents of the drives, there is about 100 GB worth of really important data on those drives that I'd prefer not to lose. What I am wondering is whether or not I have done enough to consider that these drives safe to plug into my desktop so that I can pull the files off. If there is more that I can do I am all ears. Any suggestions would be greatly appreciated.

 

-Alec

[Roswell]

Here's the ransomware that created those files: https://www.bleepingcomputer.com/virus-removal/teslacrypt-alphacrypt-ransomware-information