My current status: Paranoid.

Monday night I had a friend over and we were making travel plans on my computer.

A message appeared at some point asking about backing up encrypted files. I stupidly thought nothing of this and dismissed it.

The next night I am reading the news...and start to feel cold. A lot of talk of encrypted folders and ransomware and all that. That such things exist isn't new to me, I work in IT afterall. But the timing of this message with the weird message on my computer.....

I was out last night so today I turned on my computer booting into safe mode. I have used cipher /u/n/h to view the encrypted files on my computer- trying this on my laptop gives me nothing. Trying this on my desktop....literally hundreds of files.


some private files on my second hard disk (they are indeed locked and from safe mode I cannot open them)

files in a mysterious folder called wpsystem (seems to be related to a windows phone I used to use)

a folder called projects on my d drive which doesnt seem to exist.

A strange combination of nothing critical really...

Malware bytes is finding nothing and there is no perf file in my windows folder. However this is all very mysterious and scary and I don't feel secure using my normal computer at the moment.

Googling I find people with similar problems in the past but no conclusive solutions or explanations.

I have never knowingly encrypted any files and have downloaded no encryption software.

Any ideas?


I tried the trend micro usb and it gave a error upon trying to boot. Comodo booted but it requires a network to virus scan, which it couldn't connect to

I have win 10 pro however I am unable to launch bitlocker, the shortcut and the exe just aren't working, nor is it in security settings.


The CIPHER command shows information about NTFS encrypted files. Windows always has a number of such files, even if you never have done this manually yourself. And some 3rd party software will use this encryption as well to store some or all of its data.
By itself no cause for alarm.

The CIPHER command knows nothing at all about files encrypted with ransomware and as far as I know there isn't any form of current ransomware that would use the build-in Windows NTFS encryption to do its dirty work.
So CIPHER doesn't tell you anything about a possible ransomware infection at all.

If your PC runs a current anti-virus product and is up to date with hot-fixes/security-patches you are reasonably safe from the current ransomware deluge, as long as you are careful with opening files/documents from unknown sources.

If I were you I would download a bootable virus-scanner that can be run from USB or CD (several free ones are available) and use that to scan the computer. (Basically: This is getting a 2nd opinion next to the MalwareBytes scan.)
If that doesn't show any issues too I would feel reasonably assured that the PC is clean.

  • I tried the trend micro usb and it gave a error upon trying to boot. Comodo booted but it requires a network to virus scan, which it couldn't connect to – the other one Jun 28 '17 at 15:24
  • 1
    Most of these boot sticks require that the Bios is UEFI with Legacy boot enabled (or non-UEFI). In case of UEFI with legacy boot, often the Bios offers to boot the stick in either mode and you will have to explicity select the Legacy method (default is UEFI). If memory serves (been a while since I used it) the TrendMicro stick is one of those. – Tonny Jun 28 '17 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.