Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Files Corrupted after removing FBI virus


  • Please log in to reply
3 replies to this topic

#1 sage19

sage19

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:01:17 AM

Posted 15 November 2013 - 06:51 PM

Another user posted something about this in the Logs forum, figured this was a more appropiate place to discuss it.

Just ran into this on a system after removing FBI from it. After full removal of the FBI virus and cleaning other infections from a system we noticed that we could no long open a large number of the users files. At first we thought we had run into the Crypto virus, but soon realized that this wasn't the case.

From what I'm seeing its corrupting the files deleting the first so many bytes from each file located in the normal users folders. (Ie Documents, Pictures) If a user had a folder stored in say C:\Users\MyUserName\mypic it won't touch it, however a subfolder on the desktop will be affected.

I realized what had happened when I opened a newly created docx file and a corrupted docx file in notepad.  All intact docx files have a certain header to the file. All of the corrupted ones for my user were missing that header.  It looked as if the virus simply deleted the first so many bytes at the beginning of each file.  Not sure if it deletes parts of the end of the file though.

Ran the users damaged photos through Stellar Phoenix's JPEG repair utility and we've been able to recover many of their photos.  No such luck repairing the documents so far, but the user was more worried about her photos than her documents so we haven't spent a lot of time on that yet.

 

I'm not at work right now so I don't have any example files with me to post.

 

Anyone have suggestions on how to recover damaged Office 2007/2010 files? Pretty sure the damage also occured to PDF files also.



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,937 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 15 November 2013 - 09:17 PM

How to restore encrypted files from Shadow Volume Copies using native Previous Versions and Shadow Explorer
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 sage19

sage19
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:01:17 AM

Posted 16 November 2013 - 08:00 AM

Yeah forgot to mention that we tried the at but system restore was off on that system so there were no shadow copies to use. Any other suggestions?

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,937 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 19 November 2013 - 06:52 PM

Those are the only solutions which I am aware of.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users