All files now have a .vault file extension!

Discussion in 'OS X Yosemite (10.10)' started by Doc69, Jul 31, 2015.

  1. Doc69, Jul 31, 2015
    Last edited: Jul 31, 2015

    Doc69 macrumors 6502

    Joined:
    Dec 21, 2005
    #1
    I just noticed that almost all the files that I keep on my desktop, including rtf, xls, doc and jpg documents, now have a .vault extension (added to the regular extension, i.e. xxxx.rtf.vault)! And if I remove the extension and restore the correct one, I can't open the files! Does anyone know how this could have happened and what to do abut it? The only thing I can think of, is that earlier today, I accessed the Mac desktop from a Fusion Virtual Machine PC running Windows 7. But I have done that hundreds of times in the past, not just on this particular VM.

    Any ideas?

    My plan is to restore the desktop from Time Machine, but I would really like to know how this all happened before I do.

    Update 1:
    After some more research, it appears that I have contracted a virus called the "VaultCrypt Virus". I have a file called VAULT.KEY on my Windows desktop.

    http://deletemalware.blogspot.com/2015/03/how-to-remove-vaultcrypt-virus-and.html

    I had received a .rar file on my Mac that I wanted to check for viruses before i opened it. So I opened a Win 7 virtual machine with Microsoft Security Essentials, and scanned the file there. I then proceeded to download some free unrar software and installed them in win7. Apparently the files on my Mac Desktop have now beed encrypted as well because I had shared the Mac Desktop with the VM.

    Does anyone know how far this reaches? If I delete the VM and restore all the files on the Mac Desktop from Time Machine, is everything connected with this virus gone then?

    Update 2:
    I deleted the VM and replaced the Mac Desktop folder with a Time Machine backup from 10 minutes before the virus hit. Everything seems fine now. However, if anyone thinks that there could be some "residue" of the virus on my Mac, please let me know. But I believe that it was just the files themselves that got changed. So everything should be fine.
     

Share This Page