Win10 Version 22H2 (OS Build 19045.4170)
How do I search for files that have 3 letters of the alphabet, followed by 5 numbers?
Such as “aam84824” ... “aak28764”. These are Trojan files I need to delete (Trojan_Script_Wacatac.B!ml).
How do I search for file names with 3 alpha followed by 5 numbers?
These files are located in different folders. The filenames are different. Searching for one or two names will not find the files with different names.
Do the files have any extension/s?
If you want a visual representation of the locations of such files you could try using "Everything" by void tools.
voidtools
For files on Drive C:\ eg: whose names have 3 alpha and 5 numeric characters and no Extension.
Use a search term like:
file: C: regex:^[a-z]{3}[0-9]{5}$
Or, for files on ALL Drives eg: whose names have 3 alpha and 5 numeric characters and no Extension.
Use a search term like:
file: regex:^[a-z]{3}[0-9]{5}$
If they also have extensions:
Remove the $ at the end of the Search term and replace it with this instead:
[\.]
You can select and delete the files in the Everything GUI itself, however, the crucial questions are firstly whether you would be confident enough that deleting such files themselves, permanently gets rid of the trojan infection , and also, you have to be careful about any other Windows files which might have the same name pattern.
No extensions.
Did you try to see if either of the search terms I mentioned show the files you are interested in?
for those files on C: drive
file: C: regex:^[a-z]{3}[0-9]{5}$
Or for those files on all drives
file: regex:^[a-z]{3}[0-9]{5}$
Of course, beyond pointing you to the method for showing such alphanumeric files, I can't recommend any actions for you to perform as I am no expert on malware.
Personally, if it were my PC, I would be looking to salvage my important files first (if I did not have any backup plans in place), and then at the very least, reinstalling Windows - but that is only a personal opinion.
Yes, I ran the sequence you recommended. It searched for hours. Lots of hits. None that were useful. However, thanks for the suggestion!
After backing up my files, I plan to delete everything and install Win11. I would like to be certain I don't copy any Trojans.
I'm baffled how the Trojan infected my laptop. I never connect to a website unless it is an "https://". Perhaps it was embedded in a pdf file?
If they're trojans, as you say, use Malwarebytes
Otherwise, Ultrasearch using Regex search expression syntax
or
Agent Ransack using Perl search expression syntax
Win10 Defender / Security notification -> Trojan_Script_Wacatac.B!ml (on 20 Feb 2024). Win10 Defender / Security was unable to find it.
MalwareBytes (have used it for years) was unable to find it. Ditto for Aura Anti-Virus. Trojan files are located in many folders. Regex could not find any files.
The Trojan is still there. It continues to interrupt Win10 File Explorer, opening pdf files, and Visual Studio 2019 compilation.
- - - Updated - - -
I forgot to mention. The Recycle Bin folder is now a subfolder of $RECYCLE.BIN. Subfolders under the $RECYCLE.BIN folder has folder names such as "S-1-5-18". The Recycle Bin folder is accessible. The subfolders under $RECYCLE.BIN are not accessible.
A search, using "Everything", finds pdf files in those subfolders -> with names such as $I08MNCM.pdf, $I1ABVD0.pdf, $I3KKBLF.pdf. These are Trojan files. They are not accessible and cannot be restored.
Quote
