Removed Virus Now all Documents are corrupted

Have windows 7-64bit all patches applied.

Got Virus on computer....

Removed virus with Combofix

Now none of my documents are opening.

it says that the document is either in the wrong format or is Corrupted.


Please NOTE !!!!!

All Programs work Great..

All New Word Spreadsheets, powerpoints and acrobat Documents Work Great !!!!

It's only the Pre-Virus Documents that are not opening.

Note #2 User has no backup

Ran checkdisk and still same thing.

Tried opening documents on other computers same error
Please See attached.

is there software that can fix me....

Cjoego
2013-Blank-Vendor-Questionnaire-.xls
ADA-BATHROOM-VANITY-REQUIREMENTS.docx
A43CSCEG01-Finish-Plan.pdf
Joseph SalazarVice President - Senior IT ConsultantAsked:
Who is Participating?
 
smckeown777Connect With a Mentor Commented:
There are no fixes...as already stated by multiple experts...

This report shows that the virus writers have created a new site to allow you to 'possibly' get your data back...I've no idea if it works or if its even worth taking a chance...

http://thehackernews.com/2013/11/CryptoLocker-Ransomware-Decryption-service-malware-keys.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Security+Blog%29&_m=3n.009a.388.hg0aof7ewf.8c1

Depending on how desperate you are its one road to try...
0
 
Nick RhodeConnect With a Mentor IT DirectorCommented:
Did you try a system restore to before the infection?

Perform a System Restore: Boot up in safe mode with command prompt.

Type rstrui.exe and restore your computer to a few days ago.
0
 
younghvConnect With a Mentor Commented:
@Cjoego -
What was the name of the malware variant you removed?
Have you used anything in addition to ComboFix?

If your system was infected with one of the "Crypto" type ransomware ware variants, you are not going to be able to open the old documents.

@NRhode - please note that it was stated the docs will not open on another computer. Running "Restore" on the infected system will have no effect.
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
Nick RhodeConnect With a Mentor IT DirectorCommented:
It states it wont work in general (local & another workstation).  Restoring the files back before the "ransom virus" could revert the old files back to their previous state before the ransomware.
0
 
smckeown777Connect With a Mentor Commented:
Yep...this is Cryptolocker...was hit by this 2 week ago - there currently is no way to recover documents infected by this virus

Hope you have a backup as its the only way(currently) to get back to where you were last week...
0
 
Brian PierceConnect With a Mentor PhotographerCommented:
Sorry - chances of recovery are about zero.
Lesson learned - backups are essential.
0
 
younghvConnect With a Mentor Commented:
@NRhode:
<<Restoring the files back before the "ransom virus" could revert the old files back to their previous state before the ransomware. >>

Are you under the impression that running a Windows System Restore will restore "data" files and documents to their prior state?
0
 
pmitllcConnect With a Mentor Commented:
Windows System Restore Points may be able to restore your "data" files to their previous state, but as others have mentioned, this is not done through a "Windows System Restore".

You will need to use the "Restore previous versions" option if available.

See here for information:
http://www.precisesecurity.com/tools-resources/troubleshooting/recover-files-encrypted-by-crytolocker-using-previous-versions-of-windows
0
 
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
System Restore was turned off on Computer...

Anyone hear of a Fixt to Un-encrypt the Data???

Cjoego
0
 
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
I'be been watching since I cleared off the Virus and have not seen any fix

to un-encrypt the files.

Has anyone out there seen a fix for this?

Cjoego
0
 
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
fixes????

Anyone?????
0
 
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
Looks Like I'm going to have to wait till Someone comes up with a Fix.

Cjoego
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.