My NASA Pics Encrypted by Unkown Person

After reading accusations of NASA altering or removing photos on their Apollo program, I downloaded the entire website at the URL I believe to have been /www.hq.nasa.gov... Someone mentioned that NASA had deleted Apollo 10 images from their archives, so I wanted to see if that indeed did happen, or at least in the last three months. However, opening my folders I saw instead of .jpg the images were all .crypted files that had been converted, and when I clicked on them nothing happened at all. While I have maybe 200GB worth of files of numerous different types, only the NASA files were encrypted. It turns out I don't seem to have any Apollo 10 images and may not have downloaded that section of the website. In theory they could have been deleted but I never looked for them in the first place as I was interested in Apollo 11 and later, so probably not.

I first suspected that this occurred because the trial version of the website downloaded expired and then encrypted the downloaded website with the files to be unlocked only after paying for the app. I tried three different ones and settled on HTTrack WebsiteCopier which is totally free and offers no paid version. I had already copied the files to an external drive I only rarely plug in to access because I need it there for backup purposes and specifically don't want a virus to be able to wipe the files. Also, I already uninstalled the trial version downloaders. So if nothing else this will let others know who do the same process to be exceptionally careful with what application they are using to download the Apollo Image library.

I looked up .crypted to see that it seems to be a faulty encryption based on the Nemucod virus. There is an application that can be used to decrypt the files, which I used and was able to recover the images. I'm about to go on the process of a full virus scan so I can remove any remaining problems. But it seems incredibly strange to me that the files would have been picked out at random by a virus, or that the virus would only encrypt some folders with images but not others. Perhaps the virus looks for the largest group of images or most recently accessed group of images? I don't know, but my hard drive has tons and tons of files yet the only ones encrypted were my NASA pics. I have a folder named something like "pictures" with about 20 images that were not encrypted by the malware for example.

This looks to be something with your computer. I grabbed a copy of the website with wget in Linux. I have jpg's and pdf's. I think you have a nasty virus on your computer. :/

Edit: Apollo 10 images are in the alsj/a410 directory, so they're there.

a reply to: wayforward

Looks like you have yourself some Nemucod. Try this -
Nemucod Decryptor]

a reply to: wayforward

I looked up .crypted to see that it seems to be a faulty encryption based on the Nemucod virus. There is an application that can be used to decrypt the files, which I used and was able to recover the images. I'm about to go on the process of a full virus scan so I can remove any remaining problems.

Sooner the better. Virus programs are as insidious as the creeps that write them.

a reply to: wayforward

Malware like this often uses regular expressions / parsing / search queries or whatever you want to call them so they make the most sense to you to find the files they're looking to encrypt.

It can be thrown off by odd characters or naming schemes and most of them are specifically designed to ignore system files. A lot of them do go for the last modified date which can be updated for a number of reasons. Had a look at the ransomware being dropped by the recent Numucod trojan variation and it's targeting specific directories first.

If you were amazingly curious you could probably find out what version of ransomware you have and look up the search queries / loops it's using to encrypt. I doubt it's specifically targeted. If it was, it isn't actually that hard to deobsfucate and look at the code.

Note: hopefully you've stopped the encryption process by now?

a reply to: Vizzle

I forgot to mention, I was able to use Emisoft Decryptor to decrypt the files. But, my virus scan is complete and shows no viruses.

a reply to: wayforward

It sounds like you've been hit by ransomware. A version of cryptolocker or something.

is it only those files?

Did you check to see if other files on your computer have been encrypted?

did you notice any strange pop ups on your computer?

Blah blah blah. . Virus... malware..

The truth is you stumbled across something you shouldn't have and they are on to you..
Have you seen any black suvs and copters near your home? If so pack yourself a bag and get out of town.. leave your cell phone and whatever you do.. DO NOT use your cards..
Godspeed my brother.. and good luck..

I've got shedloads of NASA Apollo images, had them for years with no bother.

I've also got the original hard copy book of Apolo 10 images in a NASA report, which has all of them published in it. No-one has been round in the night and scribbled them out with a biro.

originally posted by: Misterlondon
Blah blah blah. . Virus... malware..

The truth is you stumbled across something you shouldn't have and they are on to you..
Have you seen any black suvs and copters near your home? If so pack yourself a bag and get out of town.. leave your cell phone and whatever you do.. DO NOT use your cards..
Godspeed my brother.. and good luck..

Sarcasm alert!