What is a .pdf.abc file

[comp_see]

On helping my friend to cleaning her computer, I noticed that on her 3 year old computer desktop, there are a lot of Acrobat pdf files and the Acrobat is version 8

I decided to download the latest version Acrobat Reader DC. After the installation, the Acrobat files icon change to unknown file type. Checking the "Organize", "File Option", "Hide File Extension for known File" is checked. I unchecked it and noticed that there is an ".abc" at the end of the file name. A file "<file name>.pdf" become "<file name>.pdf.abc. The Acrobat Reader cannot read them because of the unsupported structure.

These files are stored through downloading email attachment from different emails from different senders. I believe that they should be pdf files. How can I restore or read them because I may not be able to find the emails that attaching them. Also why they were saved as .abc files as my friend is not a computer geek that every thing must be simple.

Thanks for your advises.

[Train]

If your pictures, videos and documents have an .abc extension at the end and have a Restore_files.txt document on your desktop, then your computer has been infected with the TeslaCrypt ransomware.

Dump/DELETE them!
http://malwaretips.com/blogs/remove-...and-abc-virus/

[comp_see]

Thank you very much. I am release as my friend is blaming me screwing up her computer when we found the pdf files are unreadable. I did see the restore.txt files and a short cut to the black screen warning. But we were in hurry, we did delete them without looking them carefully.

I'll first remove the virus and download the original pdf files from the emails again. Hoping that will recover all her needs. If you do have further info regard this virus, please post them for me. Thanks.

[fink]

download the original pdf files from the emails again.

I would double/triple check any files in those emails before you open them just in case one of them is the actual malware that infected the computer. Scan them with the active system antivirus first and then scan them here...

https://www.virustotal.com/

For further confirmation.

[comp_see]

Thank you. I'm with my friend now. Just downloaded the Malwarebytes and find Trojan.FileCryptor.Trace - 2 html and 2 txt files in the c:\users\<name>\AppData\Roaming\MS\Windows\Startmenu\Programs\Startup and c:\ProgramData\MS\Windows\Start Menu\Programs\Startup folder.

I just wonder that she has Norton 360 Premier installed, activated and run in real time. Why this anti-virus not blocking the infection.

[comp_see]

Oh, I miss the same html and txt files are also found in crogramData\nnnnnnnn (nnnnnnn is a no. looks like random) as well.

[Train]

Got some nastiness on there for sure.
Take it to the intensive care forum.

[comp_see]

Is this post and all correspondence moved to the Intensive Care now?

[fink]

It would be best to start a new thread there. Follow the instructions in the sticky thread at the top of the forum and copy/paste the log files as required. You may want to link to this thread just for added info.

[HAN]

Why this anti-virus not blocking the infection.

No "anti" anything can or will block everything. Just not possible. Too many variables (different viruses, different ways to infect users machines and on and on.)

Most antivirus products mostly rely on blacklisting, meaning they block known viruses/malware. That means someone, somewhere has to be the first one(s) "infected". Reports of a possible new virus circulate and samples are collected from potentially infected machines. Then, the potential virus/infection is analyzed. If it's a true virus, a virus definition created for the virus. Then the definition has to go out to all the antivirus users around the world. Hopefully, this means only a few users get infected from the virus early on and that users that encounter the virus later are protected by the new virus definition.

So now millions of users are now protected from the new virus and hopefully only a few (hundred?, thousand?) users were initially infected. But the big bad virus maker also knows his first release is now blocked. So he (she) makes a modification to it and releases it into the wild. And the whole process begins anew...

To help compensate for the known deficiencies of blacklisting, a variation of blacklisting definitions was developed called heuristics. Looking for things that look like viruses, might be viruses, but haven't been seen before. The problem with heuristics is false alarms (aka false positives.) If the heuristics are too aggressive, good files might be classified as bad. Which is not a good thing!

The bottom line is that the thought that any antivirus provides 100% protection is not correct. It's always something less than that...

The best advice is something I recently read or heard. Use your PC as though is did not have any protection on it at all. Don't open emails or email attachments that you aren't expecting, don't surf to websites you know is risky, don't insert unknown USB flash drives into your PC, make sure your WiFi router has a good password on it and so forth. If your aren't sure how to proceed with safety, ask someone who does know. And lastly, don't assume your PC is ok because it seems ok.

[Train]

And the antivirus does not touch malware, that is why Malwarebytes found stuff that Nortons did not find.