Why have my image file extensions changed from .jpg to .vbs?

[Pbovat2979]

Hello all,
I do not go into my dropbox and look at my old stored photos much. So I was suptised to see that for some reason my files have been changed from .jpg to a .vbs. I can no longer see my pics of my children. I am starting to panic that I lost years and memories of my children. The file is strange. It has the file name with the .jpg but an added extension of .vbs.

EX: photo45.jpg.vbs

I have already tried to just change the extension back to a .jpg but i am unable to view the pic.

Please someone help!!

[Rich]

---

@Pbovat2979 wrote:
So I was suptised to see that for some reason my files have been changed from .jpg to a .vbs.

---

It sounds like your computer had a virus. Take one of the photos with the .vbs extension and open it in Notepad. DO NOT DOUBLE CLICK THE FILE TO OPEN IT! Doing so could execute whatever code may be in the VBS file. Open Notepad first, then go to File, Open and browse to one of the files to open it. Copy the first few lines of text that you see and paste it in a reply here.

[Jay]

Hi @Pbovat2979, thanks for bringing this to our attention.

It sounds like your computer could have been infected with malware or ransomware, which would rename your files. 

Depending on your plan, you could use Dropbox Rewind to restore a previous version of your files from before this occurred.

If you need any further assistance, please let me know!

[Pbovat2979]

Thank you Rich! When I’m home from work I’ll do this. I cannot open Dropbox from my work PC as it is blocked.

I have gotten a new computer since this file was originally uploaded and no longer have the file on any PC. I can still get a virus even if these files were not touched?

Also, some of the files in Dropbox are fine. I would think that those would have been affected too?

Still learning about this. Thanks so much for your help!

[Pbovat2979]

If I don’t have that type of plan can I still get these files?

[Jay]

Yes, you should be able to revert the files individually using these steps. 

Just so you know, Dropbox Rewind is available on paid plans, so if you have a paid plan, you should have access to it.

[Pbovat2979]

Rich,

Here is a few lines from the txt file.

rem barok -loveletter(vbe) <i hate go to school>
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines
On Error Resume Next
dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
eq=""
ctr=0
Set fso = CreateObject("Scripting.FileSystemObject")
set file = fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=file.ReadAll
main()
sub main()
On Error Resume Next
dim wscr,rr

[Pbovat2979]

Jay,

The rewind feature is not working please help!!!!

Can I call someone to help me through this?

[Rich]

---

@Pbovat2979 wrote:

rem barok -loveletter(vbe) <i hate go to school>

---

Wow! I haven't seen that in a long time. What you're seeing there is a virus that originated 24 years ago, known as the LoveLetter virus, the ILOVEYOU worm or the Love Bug worm. Take a look at the this page for more information, and I'd suggest a Google search as well.

You'll want to make sure your computers are cleaned with a well known antivirus. If your files were altered recently you may be able to recover them using your Deleted Files or previous versions, but I suspect the infection happened a long time ago and went unnoticed. If that's the case, Dropbox wouldn't be able to recover the files.

[Pbovat2979]

I don't understand I have a virus Software that is up-to-date, Webroot I run it often. I just scanned and nothing found? Is it possible that this happened on drop box? I went to try and "restore" but it shows nothing to restore.