Does my neighbor have ransomeware?

[cosrocket]

My neighbor told me that today all of a sudden when he would open some documents they were gibberish , which made me think he might have gotten ransomware. I went over and saw  that he had quite a few WPS files which are old Works files I believe and they would open to a blank page with a window that says “file encoding, select the text that makes your files readable” with Windows (Defaiult), MS-DOS or Other Encoding being the choices and what looks like gibberish in a preview window. All of the WPS files opened like this but most of his Word files opened without a problem, only a few Word files opened to gibberish, actually that had readable text but with a lot gibberish on the page but when I went to print one only readable text showed in the printer preview window. Really strange.

Does anyone have any idea what this is? I’d say about 30% of his docs are coming up like this with 70% opening without an issue, If it were ransomeware would’ve they all look encrypted?

[+Warwagon MVC]

Download libre office. WPS files open as gibberish on a lot of stuff. Libre seems to open them just fine. My guess is that his default program for WPS may have gotten changed.

 

https://www.libreoffice.org/

 

If he had ransomware they probably wouldn't end in .wps anymore they would usually end in some other extension.

 

[cosrocket]

Thanks, I’ll have him try it.

[goretsky Supervisor]

Hello,

Usually ransomware comes with some kind of extortion demand, like a text file on the desktop, the desktop wallpaper being changed with a message, and so forth.

I recall that WPS files are (or were) files for Microsoft Works, a consumer-focused competitor to Microsoft Office.  Given the age of that file format, could your neighbor be using similarly old hardware?  If so, perhaps the storage device (HDD or SSD) has begun to fail.

 

Regards,

Aryeh Goretsky