What is the “incaseformat” virus?
On 13th January , 2021, 360 Security Center received a large number of user feedback that all disk files on the computer except the C drive were deleted, and “incaseformat” text files may be created in the disk. The 360 Security Center found that the virus copied itself to the C drive after it started, created a startup item to exit, and waited for the restart to run. The file will be automatically deleted after the next startup 20s later, which is simple violence.
The virus is different from common worms this time. It not only fakes the folder icon and hides the original folder, but also sets the logic to delete files regularly. Analysis found that the virus was detected every 20 seconds. The current year was greater than 2009, the month was greater than March, and the date was the 1st, 10th, 21st, and 29th, and the disk files were deleted. However, because of a bug in the virus, the startup of 1th April,2010 was switched to 13th January, 2021.
Attention Please:
The virus will attack on 23th January and 4th February, please check and kill before then!
*The reason that a large number of users have deleted files this time is because these users mistakenly added virus files to the trust zone, or did not install security software at all. The virus is likely to have been lurking in the user’s computer for more than ten years.
If you find that the file is missing but the space occupied is normal, do not restart it. After clearing 360 Total Security trust zone, you can completely kill the virus.
If you have restarted or the hard disk space is reduced, please cut off the power immediately, do not read or write to the hard disk, and seek help from professional data recovery personnel.