Removed Virus Now all Documents are corrupted

Have windows 7-64bit all patches applied.

Got Virus on computer....

Removed virus with Combofix

Now none of my documents are opening.

it says that the document is either in the wrong format or is Corrupted.


Please NOTE !!!!!

All Programs work Great..

All New Word Spreadsheets, powerpoints and acrobat Documents Work Great !!!!

It's only the Pre-Virus Documents that are not opening.

Note #2 User has no backup

Ran checkdisk and still same thing.

Tried opening documents on other computers same error
Please See attached.

is there software that can fix me....

Cjoego
2013-Blank-Vendor-Questionnaire-.xls
ADA-BATHROOM-VANITY-REQUIREMENTS.docx
A43CSCEG01-Finish-Plan.pdf
Joseph SalazarVice President - Senior IT ConsultantAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nick RhodeIT DirectorCommented:
Did you try a system restore to before the infection?

Perform a System Restore: Boot up in safe mode with command prompt.

Type rstrui.exe and restore your computer to a few days ago.
0
younghvCommented:
@Cjoego -
What was the name of the malware variant you removed?
Have you used anything in addition to ComboFix?

If your system was infected with one of the "Crypto" type ransomware ware variants, you are not going to be able to open the old documents.

@NRhode - please note that it was stated the docs will not open on another computer. Running "Restore" on the infected system will have no effect.
0
Nick RhodeIT DirectorCommented:
It states it wont work in general (local & another workstation).  Restoring the files back before the "ransom virus" could revert the old files back to their previous state before the ransomware.
0
Defend Against the Q2 Top Security Threats

Were you aware that overall malware worldwide was down a surprising 42% from Q1'18? Every quarter, the WatchGuard Threat Lab releases an Internet Security Report that analyzes the top threat trends impacting companies worldwide. Learn more by viewing our on-demand webinar today!

smckeown777Commented:
Yep...this is Cryptolocker...was hit by this 2 week ago - there currently is no way to recover documents infected by this virus

Hope you have a backup as its the only way(currently) to get back to where you were last week...
0
Brian PiercePhotographerCommented:
Sorry - chances of recovery are about zero.
Lesson learned - backups are essential.
0
younghvCommented:
@NRhode:
<<Restoring the files back before the "ransom virus" could revert the old files back to their previous state before the ransomware. >>

Are you under the impression that running a Windows System Restore will restore "data" files and documents to their prior state?
0
pmitllcCommented:
Windows System Restore Points may be able to restore your "data" files to their previous state, but as others have mentioned, this is not done through a "Windows System Restore".

You will need to use the "Restore previous versions" option if available.

See here for information:
http://www.precisesecurity.com/tools-resources/troubleshooting/recover-files-encrypted-by-crytolocker-using-previous-versions-of-windows
0
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
System Restore was turned off on Computer...

Anyone hear of a Fixt to Un-encrypt the Data???

Cjoego
0
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
I'be been watching since I cleared off the Virus and have not seen any fix

to un-encrypt the files.

Has anyone out there seen a fix for this?

Cjoego
0
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
fixes????

Anyone?????
0
smckeown777Commented:
There are no fixes...as already stated by multiple experts...

This report shows that the virus writers have created a new site to allow you to 'possibly' get your data back...I've no idea if it works or if its even worth taking a chance...

http://thehackernews.com/2013/11/CryptoLocker-Ransomware-Decryption-service-malware-keys.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Security+Blog%29&_m=3n.009a.388.hg0aof7ewf.8c1

Depending on how desperate you are its one road to try...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Joseph SalazarVice President - Senior IT ConsultantAuthor Commented:
Looks Like I'm going to have to wait till Someone comes up with a Fix.

Cjoego
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.