Attn. Computor Gurus: I NEED YOUR HELP - All my saved files were erased by an email file I opened!!!

Perform a system restore, my friend. The method depends on your operating system (Windows 7, 8, 10, Mac, etc) but you can google "System restore for" and enter yours for instructions.

Best of luck.

not a computer guru wrote:

Perform a system restore, my friend. The method depends on your operating system (Windows 7, 8, 10, Mac, etc) but you can google "System restore for" and enter yours for instructions.

Best of luck.

VERY much appreciated. I'll try it after I get back from my run.

Okay, don't do anything yet.

1. Never open attachments from someone you don't know

2. Back up your files automatically on the cloud. Lots of free ways to do this.

That said, your files probably are still there. They haven't been erased. They can be recovered, but I'm not an expert on how to do this. Just don't make it worse until someone posts how to do it.

not a computer guru wrote:

Perform a system restore, my friend. The method depends on your operating system (Windows 7, 8, 10, Mac, etc) but you can google "System restore for" and enter yours for instructions.

Best of luck.

This reply was sent while I was drafting my reply. It should work. Give it a try.

System restore doesn't touch data files (like stuff in My Documents). It only restores system files to a previous restore point.

It seems that your machine has been infected with Locky ransomware, as discussed here:

https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/

Any files that are encrypted with the Locky (.Osiris) ransomware variant will be renamed with random alpha-numerical characters and have the .osiris extension appended to the end of the encrypted data filename (i.e. 11111111--1111--1111--FC8BB0BA--5FE9D9C2B69A.osiris) and leave files (ransom notes) named DesktopOSIRIS.bmp, DesktopOSIRIS.htm, OSIRIS-[4_numbers].htm, OSIRIS-[4_numbers].htm

According to that link it's not possible to decrypt .OSIRIS files encrypted by the Locky Ransomware without paying the ransom.

The only way to recover encrypted files is via a backup, or if you are incredibly lucky, through Shadow Volume Copies. Though Locky does attempt to remove Shadow Volume Copies, in rare cases it can fail to do so for whatever reason.

https://www.bleepingcomputer.com/tutorials/how-to-recover-files-and-folders-using-shadow-volume-copies/

So you're saying, unless they are backed up elsewhere, they're gone for good?

Just wow... wrote:

So you're saying, unless they are backed up elsewhere, they're gone for good?

Exactly right, only other option is to pay the ransom. Everyone should know by now to have backups (and more than one in my opinion).

elviejo wrote:

Just wow... wrote:

So you're saying, unless they are backed up elsewhere, they're gone for good?

Exactly right, only other option is to pay the ransom. Everyone should know by now to have backups (and more than one in my opinion).

There is another option, he could put out a bounty for the first person to bring the hacker in with handcuffs.

You can easily tell that this is spam because of the grammar error. IDK why, but all of these things have at least one grammar mistake.

"... arrived at February 16 ..." does not make any sense.

Just wow... wrote:

I got an email from this address,

hubspire@rac.rackspire.com

, with the message below, along with an attachment file named "UPS-Receipt-2849291.zip". I was stupid enough to open the attachment, and now all of the saved files on my laptop are gone and have been replaced by tons of weird files (example: GKX6XCT3--CFAP--1CUE--1D7AE68F--D147D28F926D.osiris). My homescreen also has a weird message printed out over the entire screen, behind the shortcut icons, which are still functioning normally.

Dear Customer,

Your item has arrived at February 16, but our courier was not able to deliver the parcel.

Please check the attachment for details!

Best regards,

Corey Price,

UPS Chief Office Manager.

This may be a dumb question, but did you try calling Corey Price at UPS and ask him what happened?

Pookie Jones wrote:

Just wow... wrote:

I got an email from this address,

hubspire@rac.rackspire.com

, with the message below, along with an attachment file named "UPS-Receipt-2849291.zip". I was stupid enough to open the attachment, and now all of the saved files on my laptop are gone and have been replaced by tons of weird files (example: GKX6XCT3--CFAP--1CUE--1D7AE68F--D147D28F926D.osiris). My homescreen also has a weird message printed out over the entire screen, behind the shortcut icons, which are still functioning normally.

Dear Customer,

Your item has arrived at February 16, but our courier was not able to deliver the parcel.

Please check the attachment for details!

Best regards,

Corey Price,

UPS Chief Office Manager.

This may be a dumb question, but did you try calling Corey Price at UPS and ask him what happened?

No, but that did cross my mind at first. I feel like such a fool to get played by this!

Pookie Jones wrote:

Just wow... wrote:

I got an email from this address,

hubspire@rac.rackspire.com

, with the message below, along with an attachment file named "UPS-Receipt-2849291.zip". I was stupid enough to open the attachment, and now all of the saved files on my laptop are gone and have been replaced by tons of weird files (example: GKX6XCT3--CFAP--1CUE--1D7AE68F--D147D28F926D.osiris). My homescreen also has a weird message printed out over the entire screen, behind the shortcut icons, which are still functioning normally.

Dear Customer,

Your item has arrived at February 16, but our courier was not able to deliver the parcel.

Please check the attachment for details!

Best regards,

Corey Price,

UPS Chief Office Manager.

This may be a dumb question, but did you try calling Corey Price at UPS and ask him what happened?

haha! Ask for the Chief Office Manager .... cuz every big company has that position!

Do a hard shutdown (press down the power button until all lights and screen go out)

Pull the drive out

Attach via USB3/SATA/M.2/etc cable to another computer

Run disk drive recovery s/w such as Recuva, Qphoorec, Pandora Recovery, etc

Whatever though, DO NOT DO ANYTHING on your PC like read email, open a file, etc. STOP and do the hard shutdown.

I guess all that advice you hear from computer geeks about the dangers associated with using Windows fell I deaf ears?

Stop running Windows and problems like this stop.

pop_pop!_v2.2.1 wrote:

I guess all that advice you hear from computer geeks about the dangers associated with using Windows fell I deaf ears?

Stop running Windows and problems like this stop.

What? Linux is way worse. Just look at Android.

pop_pop!_v2.2.1 wrote:

I guess all that advice you hear from computer geeks about the dangers associated with using Windows fell I deaf ears?

Stop running Windows and problems like this stop.

No they don't. A co-worker had a dead hd so I hooked him up with a live usb. For a couple of weeks he said it worked great, then,,,he clicked on (doesn't remember what) then kapow, no more booting up. Unless a user is constantly supervised they will make mistakes such as our op.

To the OP I've had limited luck using a pe-usb or externally mounting as someone suggested. In some cases I've been able to recover some files, but other times nothing. You could take it to a shop and pay 50 bucks to say you're screwed or a lot more if they can recover anything If you or a friend who knows what they're doing you can try this. Google windows pe usb. They're some you have to "make" others are pre made. Use rufus to burn the iso to a thumb drive and boot to the usb drive on your computer. Navigate to where your files are at. There could be you originals that were hidden by the encrypted ones when the computer was "live", or not. Some of these groups eventually get busted and the authorities are able to get there hands on the keys and perhaps eventually allow yours to get unlocked. You can pay up with a 50/50 chance the the hackers will "honor" there end of the deal. Or nuke your drive now and start over. How important are those files?

Just wow... wrote:

So you're saying, unless they are backed up elsewhere, they're gone for good?

If you don't have recent file back-ups, you can opt to pay the ransom as discussed here:

Rule 1: Always have off-site backups - I use CrashPlan for local and off-site back-up of all the computers in my house:

Rule 2: Do not open email attachment if the sender is not in your email contact list.

Rule 3: Set your email client to not open macros. Always say "no" to any dialog requesting that you run macros in an attachment.

If they use the term "Best Regards" Kindest Regards" you should know it is a scam.