Finding Files with hidden extentions


  1. Posts : 2
    WIndows 10
       #1

    Finding Files with hidden extentions


    I am recovering from two ransomware attacks on my Windows 10 desktop.

    I've been told that one mal-hacker tactic is to append to the filename of a doc file (as an example) an exe extension, hide that additional extension, and when the doc file is chosen a malware app is executed locking up the PC.

    I tried to find any files that have some kind of extra extension, but have been unsuccessful. I want to be reasonably sure that this sort of file manipulation doesn't exist on the recovered machines.

    I thought my best chance at a positive result was to use the command line. Any combination of * or ? queries, like dir *.???? /s or dir *.???.?* provides me with a list of all standard 3 digit extensions as well.

    Either, what am I doing wrong, or what method should I be using to get a list of only files with more than one extension in the same filename?

    BTW, I also have a Windows 7 PC on the LAN that I would like to check in the same way, in case the syntax is different between the two OSs.

    Thanks.

    Frank
      My Computer


  2. Posts : 14,025
    Win10 Pro and Home, Win11 Pro and Home, Win7, Linux Mint
       #2

    Don't know if it will help but a default install of Windows has file extensions hidden. Open File Explorer/Windows Explorer, find the Options and in its View tab you can Unhide the extensions. I'm from old school and always do that.
    Attached Thumbnails Attached Thumbnails Finding Files with hidden extentions-screenshot-2024-01-19-095933.png  
      My Computers


  3. Posts : 745
    Windows 10/11
       #3

    As @Berton showed in the screenshot, just ensure that "Hide extensions for known file types" is NOT checked and then search for *.exe. You may want to limit that search to C:\Users or C:\Users\{yourusername}.

    There are no special tricks in this regard. The bad actors simply take advantage of the fact that the default setting is to hide file extensions and then create an exe with a filename such as "CuteKittens.doc.exe" which you see as "CuteKittens.doc" if extensions are hidden. Note that, in this example, ".doc" is not an extension. It's just part of the filename. The extension is the part after the LAST dot.

    The usual path for such files to be on your computer is an email attachment that you opened (but shouldn't have). Your email spam filters should generally put such messages straight into the spam folder. If that's not happening, you might want to consider changing your email service.
      My Computer


  4. Posts : 43,062
    Win 10 Pro (22H2) (2nd PC is 22H2)
       #4

    I am recovering from two ransomware attacks on my Windows 10 desktop.
    One approach to protect yourself so you can recover quite readily is of course to use 3rd party disk imaging regularly and routinely, and keep your set of image files offline. (Image as a minimum at least all your O/S partitions and any others you care to). For non-imaged data, use some other appropriate form of backup.

    You can supplement disk imaging with additonal more frequent backup by other means of fast changing critical data. Again, keep backups offline.

    Should you be affected by ransomware, you can then wipe the affected disk, and restore the most recent image, and backups as needed.

    Sadly the British Library is now paralysed, having been attacked by a Russian hacker group, and is spending millions on recovery. Sounds as if they hadn't planned ahead...
    The Disturbing Impact of the Cyberattack at the British Library | The New Yorker
    The British Library hack is a national outrage – and the Government must pay to save it | Evening Standard
    Rhysida, the new ransomware gang behind British Library cyber-attack | Cybercrime | The Guardian
    British Library starts restoring services online after hack - BBC News
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 11:29.
Find Us




Windows 10 Forums