Member Avatar for phphp

Good morning,

On my localhost, suddenly all of my php files are looking like this format
Untitled.png

What is this?
Is it hacker attack?

How to stop this action in future.

Please help

  • 8 Contributors
  • 10 Replies
  • 415 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by Josh Ross

Dani AI

Generated

Quick summary and what to do first (for ): the symptoms described by and others strongly match a ransomware encryption event on your local machine. Contain it immediately: disconnect the PC from the network, unplug any external/backup drives, and avoid running "cleanup" tools that write to disk until you have a forensically usable copy. If possible, make a full disk image and RAM capture so you (or a responder) can work from an exact copy rather than the live system. (cisa.gov)

Immediate checklist (do these in order):

  • Isolate: pull network cable / disable Wi‑Fi and remove attached USB/external drives.
  • Preserve evidence: photograph ransom notes, save any ransom filenames/IDs.
  • Image the drive / capture memory before modifying files (important for forensics).
  • Identify the strain: upload the ransom note and a single encrypted sample to an identification service (only the note + one encrypted file). This will tell you whether a known decryptor exists.
  • Search reputable decryptor repositories only (do not trust random blog how‑tos). If a decryptor exists you must remove the malware first, then run the official tool per its instructions. (id-ransomware.malwarehunterteam.com)

Windows-specific recovery tips and quick commands:

  • If you use Windows, check whether Volume Shadow Copies or File History contain recoverable versions before wiping anything. From an elevated prompt you can list shadow copies and writers: 
vssadmin list shadows
vssadmin list writers

Do not run deletion commands or arbitrary "fix" utilities you found by searching — many strains delete shadow copies and fake decryptors can make things worse. If you find usable backups or shadow copies, restore from offline media or a clean image. (learn.microsoft.com)

Final cautions and reporting:

  • Do not pay the ransom — payment does not guarantee recovery and fuels the criminal economy. File a report with law enforcement (FBI/IC3 in the U.S.) and consider contacting a specialist incident responder if your data is critical. As said, backups are the fastest recovery path; as and noted, rely on trusted sources only. (fbi.gov)

If you want, post the ransom note text (not original unencrypted files), or the exact filename extension added to your PHP files — that helps responders point to variant‑specific advice and any available decryptors.

Recommended Answers

All 10 Replies

Member Avatar for cereal

Localhost? It seems a ramsonware, a virus that encrypts data and ask money to return the files back. If you are using Windows that's probably in your system, so it should not be related to the application code. The same can happen if the folder is shared in a local network and the virus is compromising all the files it can reach.

Good luck with that.

Member Avatar for Dani

Oh no!! I'm so sorry.

Member Avatar for rproffitt

Nod to ransomware. As most programmers know, now is when your backups really count. We only lose what we didn't backup.

commented: True +15
Member Avatar for gentlemedia


Be careful with the Web of Trust extension. I used it as well for a long time untill they've been caught selling their users' data to third parties.
https://www.onlinethreatalerts.com/article/2016/11/10/web-of-trust-wot-caught-selling-their-users-data-they-collected-via-their-web-browser-extension-to-third-parties/

http://www.ghacks.net/2016/11/05/mozilla-and-google-remove-wot-extension/

commented: Thanks. Have a replacement? Do you use Spyhunter? +11
Member Avatar for gentlemedia


No I don't use Spyhunter (I'm on a mac).
I use uBlock Origin. It's not really a WOT replacement and it's also not an ad blocker... well... one on steroids maybe :) but it does not support Adblock Plus' "Acceptable Ads Manifesto" which is a good thing.
It blocks also trackers and heaps of malware sites automatically, but you can also setup filters yourself manually.

Edited by gentlemedia
Member Avatar for rproffitt

. I'm currently using Ublock Origin too. Just to sniff out more I installed Privacy Badger to see what's up with that.

Seems a shame we have to uparmor browsers like this. Arms race continues.

Member Avatar for Josh Ross

Hello, did you find a solution to unlock the filess? I am in the same situation right now and all what I have managed to do is to remove this wallet thing from my computer..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.