Ransomware Corrupted Document and Media Files
A client brought in a machine that was infected with a ransomware application. He System Restored it and was able to use the machine but all the document and media files were changed to "filename"."filetype".html If the .html extension is removed, the file will open the appropriate application but the program cannot read the file. Has anyone seen this before? I don't know what the name of whatever infected him was. Is there a way to automate (batch) removing the .html extension across many selected folders? Any ideas on what the malware did to break the files?