Link to home
Start Free TrialLog in
Avatar of snoopaloop
snoopaloopFlag for United States of America

asked on

excel - file extension is not valid format...

Since yesterday, i get a prompt when clicking on excel file saying the file extension is a valid format.  I click yes to trust and it displays all gibberish in excel.  The new computer with the same documents transferred over does the same thing
excel1.PNG
excel.PNG
Avatar of n2fc
n2fc
Flag of United States of America image

You can try opening excel first and then using the "file" ==> "open" dialogue to see if the same results occur...

If so, your excel installation has become corrupt...

You will need to reinstall Microsoft Office or Excel  to correct this error.

This may be caused by a hardware failure of your hard drive or perhaps malware/virus infection...

You should run a scan for viruses/malware before attempting the reinstall.
In this case it looks like either the file has been corrupted. You can try this for recovery

http://www.officerecovery.com/excel/faq.htm

The other alternative is that the file extension is incorrect and this is not actually an excel file. trID can assist with this
http://mark0.net/soft-trid-e.html

Michael
Hi snoopaloop,

Q1. Do you get the same problem with ALL Excel files?
Q2. What happens if you create a new workbook in Excel, then save it, and try to open that saved file, both from Excel and by double-clicking the file?
Avatar of snoopaloop

ASKER

This is a brand new refresh of a completely different computer with the other computer's files copied over.  The other computer originally had the problem.  So malware/virus is not the cause.  The file extension is xls.   The client has been using these excel files for payroll and timesheets for ever, ever.  Something went wonky with opening the files on the original computer two days ago.  
File, new excel, and saving the excel spreadsheet... Then close/open works fine.  Seems odd that all the excel files would become corrupt all at once.
Hi snoopaloop,

What are the answers to Q1 & Q2 from my last post?

And:
Q3. What happens when you try to open any of those spreadsheets on a PC which has not had the problem?
Why not try the demo version of the recovery software from the link I posted to see if you are going to be able to recover these files.
The error message mentions xlsx files but you say they are xls files - the two formats are completely different, so which is it?

Also, can you post a screenshot showing the first line of the 'gibberish' when you open it in Excel - it will often give a clue.
I tried the first program and it doesn't produce a fixed copy of the file.  Just an empty folder that it created on the desktop.  I randomly selected a file that dates back to mid october from the Mozy backup and downloaded to my computer, not the clients...  "Copy of GSAHTC  GR8 - Bank Queries Oct 2014 (3).xlsx"   The file downloaded completely fine.   I went back to the original computer and the completely refreshed computer with the transferred data and that file is not gibberish when it is open.  So at some point in between mid october and now, all the files became corrupt.
Capture.JPG
The second program is not clear to me what to download beyond the original executable to get the definitions or whatever the library is called to work.  Beside Mozy backup clarifies that the extensions are in fact correct because the restore works with same file extension from a prior date.  The problem lies with grabbing the most recent data from mid october and beyond.  It seems to be all corrupt.
Correction to my prior comment  ***I went back to the original computer and the completely refreshed computer with the transferred data and THAT FILE IS GIBBERISH when it is open.  So at some point in between mid october and now, all the files became corrupt.
Did you have an encrypted drive on your old computer? The first part of that file doesn't resemble an .xls or .xlsx format.
Could you please open the file again so that it shows the gibberish again, and this time take a screenshot that shows the top left of the contents.

Edit: Whoops, I see that Rory Archibald asked for this earlier, and he is obviously also thinking along the same lines as me when I look at the contents of the file.
Is the snapshot at 2014-11-13 at 13:40:17 not good enough?  It's not an encrypted drive.  That file use to open in excel if you use a backup from mid october.
Rory Archibald and I are both looking to see whether there is a 3 or 4 letter file type identifier on the first line.  It is usually right near the start of the first line, in cases where files have such an identifier, but it can also be a bit further along the first line or even a second line.  Part of the content is obscured by the error message dialog in your later screenshot, and the text of the error message has also been cut off.

Michael74 earlier suggested that you use the little standalone "TrID" program to try and identify the file, and given that this program currently has a database of 5409 file type definitions, it will probably do a better job than we would do of just looking at the text and trying to identify it.

The actual error message is probably the best clue.  It refers to an "invalid root" in the registry key:

HKEY_CLASSES_ROOT\CLSID\{AB8902B4-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

We cannot see anything after "AB8902B4" in your screenshot, hence the xxxx above.  Usually in these instances a repair install of the offending application will fix this type of error, but if you want to post the full registry key we can try and interpret what it is referring to.

Clearly the error is a "Script Error", which tends to imply that Excel is seeing something in the file that leads it to believe that there is embedded VBA code, but that it cannot decipher it.
I was trying to get that message to pop up but it wouldn't upon simple double clicking of the file.  It just open up the gibberish.  I tried again with in excel and I got the text import wizard displayed below...
Capture.JPG
I didn't know where to download the library files for triD.
Near the bottom of this page:
http://mark0.net/soft-trid-e.html
you will see a "Download" section containing these links:

Win32         TrID v2.10, 29KB ZIP
TrIDDefs.TRD package, 720KB ZIP (5409 file types, 04/11/14)

Unzip both ZIP files to the same folder and you will have the files:
readme_e.txt
readme_i.txt
trid.exe
triddefs.trd

You can delete "readme_i.txt", unless you are Italian.

Download this Windows batch file and save it to the same folder:
TridScan.cmd
Copy your Excel file into that folder and drag and drop it onto the batch file "TridScan.cmd".

Alternatively, you can upload your Excel file to the online scanner:
http://mark0.net/onlinetrid.aspx
but, given the name of your Excel file, I am not sure that you should be uploading it anywhere for privacy reasons.
It says it's unknown file as displayed the attachment...
unknown.JPG
Office recovery wrote back...

Dear Michael,

Thank you for using our software.

I have the results of analysis of your data.
Unfortunately, your file is damaged beyond recovery. I am really sorry for bringing bad news.

If you have any further questions, please do not hesitate to contact us.

Best regards,

Ekaterina Danilova
OfficeRecovery.com Technical Support
techsupport@officerecovery.com
That's a great pity.  Although I have never used their services or recovery applications, I would tend to believe that OfficeRecovery.com are expert enough in that field to have recovered the file if it were at all possible.  It might be possible for a digital forensic expert to find at least some of the content in one or more of the affected files, given that they dig extremely deeply in an effort to prove the guilt or innocence of people, but I doubt that any fragments of the contents would be worth the very expensive service.

I believe that the only other course of action might be to remove the hard drive from the affected computer, attach it to another functional Windows computer, and run a data recovery program to see whether it can find any other versions of this file that were deleted.  Microsoft Office creates hidden temporary files when an Office file type is opened.  It does so so that the automatic autosave can work, and also as an emergency backup should the application crash half-way through editing but between saves.

If the computer has been in continual use since discovery of the corrupted file, or the hard drive has been formatted, then it is highly improbable that any of the previously deleted file versions will have survived.  A hard drive stores its data in fixed-size little spaces.  If the file is small enough to fit into one of these storage pockets, then it obviously only occupies one of them with wasted space, however a larger file will be spread across as many storage slots as is necessary, and these aren't always adjacent to each other.  The hard drive has an index of where on the drive all of these storage slots for each file are located.  When a file is deleted, these storage slots are marked as free to have other data written to them, but the file is still there on the drive and recoverable until overwritten.  A Data Recovery program scans the drive and does its best to cross-reference all of the data that it finds, and then has to try and reassemble all the file fragments again.  Normal user activity creates and deletes files all over the place, so it is often just pure luck if data can be recovered.

If you want to have a go at this you could try using GetDataBack (https://www.runtime.org/data-recovery-software.htm).  You can download, install, and run it in "trial mode", but when it comes to actually copying the recovered data out to another drive, you then have to buy a licence.  Remember, you should never install the software to the drive you are trying to recover data from.  Disconnect the affected drive and temporarily connect it as a "slave drive" to another computer and run the software on the hosting computer.

Even if you were successful in recovering other previously deleted versions of the affected file, you would then have the task of trying to compare them with the damaged files in an effort to find any that are undamaged.  That could be a time-consuming task.

To be perfectly honest, I seriously doubt that this last ditch attempt will provide anything fruitful.

In trying to assess how the damage was caused to the files, my first suspicion would be the health of the drive on which they existed when they became damaged.  I would probably never trust the integrity of that drive, even if it passed the tests run by a hard drive diagnostics program offered by the drive's manufacturer.

Perhaps the other experts may have some other suggestions, but I think it is the end of the road for those files.
The data restore looks to be fine from mid october.  While this isn't best solution, it's sufficient for our needs.  I will keep this open a little longer just to see if the documents somehow become corrupt again on the new computer.  I think you're right, I think it's best to stop using the hard drive regardless of the hard drive integrity tests.  Have you heard of a trojan virus rendering files useless?
SOLUTION
Avatar of BillDL
BillDL
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Shoot.  I was just at the client today.  I didn't review this post until now.   I will ask them to place the old machine online to see if that's indeed the issue.
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
Hi Martin,

I think there are several possible answers which have not yet been proved to be unapplicable.  For example, the last posts from BillDL and myself, have not yet had final responses.  Also, several experts have put plenty of work into this, and for them to receive no points for effort which has not been proved unapplicable, and could also be of use to future page visitors, seems unfair to me.

Depending on what we hear back form snoopaloop (if anything), maybe points could simply be split evenly over each expert post, exept for my first 2 which were not answers as such.  Unless anyone has any better ideas.

snoopaloop, any updates on this?

tel2
I agree.  I like to postpone until the client agrees for me to pick up and investigate the computer more.  I will try again after the holidays.
I have the computer in my possession.  I will see if I can resolve the issue with the suggestion provided later today or tomorrow.
Found this BROKEN URL below on the computer.  It's defintiely Cryptowall virus.  The Norton provided solution did not work.  Any better solutions?

c:\users\user_name\DECRYPT_INSTRUCTIONS.URL
decrypt_instruction.html
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The utility immediately errored out.  I'm going to close out this ticket now that I know what it is and I restored the data from backups unless anyone has some final input to resolve this particular version of Cryptowall.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I'll let you know if and when I ever get around to scanning that hard drive outside the box.
Thank you snoopaloop