Hello. Hopefully, I am posting this in the appropriate forum.
I've been attempting to help a friend with some malware issues. Basically, he had the FBI Moneypak bit that runs fullscreen and won't let you do much of anything. This is on a system running Vista Ultimate SP2. The problem is no longer the malware, as I've reloaded the OS and restored his data. The problem is that most of his user-created data files appear to be corrupt somehow. Here are some brief details on what I've already done:
1. Removed hard drive from his system, installed it in another system as a secondary drive (I have one of those USB adapters that lets you connect an internal hard drive to a USB port), ran MalwareBytes from there on it. I actually still have that MalwareBytes log and can post it if anyone is curious, but the only thing it found was this:
G:\Users\Owner\AppData\Local\Temp\hevns\hevns.dll (Trojan.Tracur.s) -> Quarantined and deleted successfully.
2. Put drive back in his system, verified that it at least boots and seems to get to his desktop without the ugly FBI window taking over.
3. Backed up all his data that I could find (Documents, IE Favorites, various files he had scattered around his desktop, etc) to an external USB drive. Also ran a quick Belarc Advisor profile and saved that.
4. Installed a new hard drive (he had a bigger one that he'd been wanting to use as his main boot drive) and installed Vista on that drive. Copied his data to the appropriate locations (My Documents, etc).
Problem is, when you attempt to open pretty much any file that's located in the Documents folder, it fails. All give various different error messages that basically say the file is corrupt and can't be opened. There is a big mix of various different file types from Word/Excel/PowerPoint files to PDF files to .mpeg videos that open with QuickTime, and they won't open. Some other facts:
- This only seems to be happening with stuff in the My Documents folder. He had some various folders files scattered around on his Desktop, and I can still open all of those fine.
- Some .txt files in My Documents seem to open and display their contents okay, but out of like 2000 various file types, a few txt files seem to be the only ones that open.
- I've attempted to open the problem files from a couple of other systems and get the same thing.
- I have done quite a bit of Google searching and found a tool called decrypt_mdlblock.exe that is supposed to help if the files were actually encrypted in some way, but it didn't find any problems.
I apologize for the lengthy post but didn't want to leave out anything. Has anyone seen anything similar or maybe have some ideas on how to regain access to those files? Apparently, his habits of running backups weren't the greatest (I imagine that's going to change from here on), so restoring from backup won't be an option. I do still have his original hard drive in an unaltered state and haven't reformatted it yet, if that could potentially help anything. I have a feeling those files are probably history, but I'm just curious if there's any hope for him at all. As mentioned above, he had quite a lot of stuff (around 2000 files) in that My Documents folder.
Edited by zarudert, 12 November 2013 - 06:53 PM.