Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Word, Excel, PDF, DWG, files are not opening


  • Please log in to reply
5 replies to this topic

#1 ravirajhn

ravirajhn

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:52 AM

Posted 23 May 2015 - 05:15 AM

Dear Techies,

 

Please help me to recover files.  I am unable to open PDF, Word, excel, DWG etc files.

 

There many folders shared from server but it has affected to my 4 shared folders.

 

There are some PDF files I can open.  i.e.  out of 20 files 2 to 3 files.

 

Not able to figure out what exactly causing this issue.

 

I have done Antivirus scanning, but nothing found.  (From Server as well as from Client --(Mapping share drive)  - )

 

Please find attached screenshot for more details.

 

I have gone many of forum, it says ransom virus.  cryptolocker.  Tried with Malware tools and antivirus nothing found and nothing could recover.

 

Tried recovery softwares also.

 

There is no option from server to store previous version so tried from client windows 7 machines but there also unable to restore

 

Copied files to freshly installed machine and with all updated of windows and antivirus tried to recover but not succeeds.

 

Please help me to diagnose this problem and let me know the solution.

 

If i check at what time it has affected.  Below is the files screen shot

 

I have tried all recovery softwares and ms tools and word excel repair tools but not worked


Edited by hamluis, 23 May 2015 - 07:40 AM.
Moved from Introductions to Gen Security - Hamluis.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,136 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:22 AM

Posted 23 May 2015 - 07:46 AM

Are there any file extensions appended to your files...such as .ecc, .ezz, .exx, .CTBL, .CTB2, .XTBL, .encrypted, .vault, .HA3 or 6-7 length extension consisting of random characters?

Did you find any ransom note? These infections are created to alert victims that their data has been encrypted and demand a ransom payment. Check your documents folder for an image the malware typically uses for the background note. Check the C:\ProgramData (or C:\Documents and Settings\All Users\Application Data) for a random named .html, .txt, .png, .bmp, .url file.

These are some examples.
HELP_DECRYPT.TXT, HELP_DECRYPT.HTML, HELP_DECRYPT.URL, HELP_DECRYPT.PNG
HELP_TO_DECRYPT_YOUR_FILES.bmp, HELP_TO_DECRYPT_YOUR_FILES.txt, HELP_RESTORE_FILES.txt
HELP_TO_SAVE_FILES.txt, HELP_TO_SAVE_FILES.bmp, RECOVERY_KEY.txt
DECRYPT_INSTRUCTION.TXT, DECRYPT_INSTRUCTION.HTML, DECRYPT_INSTRUCTION.URL
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 ravirajhn

ravirajhn
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:52 AM

Posted 24 May 2015 - 11:04 AM

Hi,

 

Thank you for your response.

 

I didn't find any file you mentioned and also note (log).

 

Tried online decryption of files.  Tried to find exact cause as why only 12500 files affected from 4 shared folder and rest many files other files are correct.

 

Whether it is ransom virus or something else . But even after scanning with anti virus and online ransom virus recovery file. (It says no virus or ransom infected files)

 

All infected files modified date is between 19 May 2015 6:15 pm to  7:30 pm.

 

How get back those to previous version or previous modified date and time.  ( Is there any possibility)  (Tried Windows Previous version but it was not configured)

 

Please help me to get these files back.

 

Regards,

Raviraj Nagenhatti



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,136 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:22 AM

Posted 24 May 2015 - 11:45 AM

The best solution for encrypted data is to restore from backups. Other possible options include...
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 ravirajhn

ravirajhn
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:52 AM

Posted 24 May 2015 - 12:57 PM

Thank You...  I will try this and will update you.



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,136 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:22 AM

Posted 24 May 2015 - 03:32 PM

You're welcome and good luck.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users