Unable to open files in shared folders

We are facing a strange behavior on our file server. Suddenly some users were unable to open any file from the shared folders. Below are the errors they got when trying to open doc, xls, ppt and pdf files:

Opening PDF files:
Acrobat could not open file.pdf because it is either not a supported file type or because the file has been damaged (for example it was sent as an email attachment and wasn't correctly decoded). To create an Adobe PDF document, go to the source application then print the document to adobe pdf

opening word files: the file is corrupted and cannot be opened. Microsoft office cannot open this file because some parts are missing or invalid

opening excel: The file you are trying t open 'file.xls', is in a different format than specified by the file extension. Verify the file is not cirrupted and is from a trusted source before opening the file.

opening power point:
This error can be caused by the following conditions:

-Your hard drive or floppy drive has a corrupt section (damaged track or sector).
-A temporary operating system or network failure has occurred.
-Your network is unavailable, slow, or is corrupting data packets (failure of a router, network card, or noise on the network transmission line).
-Your antivirus program may be causing problems accessing certain files.
In the case of a damaged disk, you must save the file to another location (for example, a different drive).

In the case of a failure of the operating system, this can be caused by various memory management problems, viruses, incorrect usage of a UNC, alias, or invalid permissions to the share where the file is stored.
If the network is experiencing problems, it is usually a temporary condition and if you wait a short period of time and try again, you can usually save the file. If the problem persists, consult your network administrator.
A known condition with an antivirus program can cause a similar condition. Check with the manufacturer of your antivirus program to see if an update exists.

On another front, we are able to open the files from the backup copy that was created on another server in the same network.

We are scanning the main server now for viruses using different tools. Kaspersky didn't find any virus so far!!!

Appreciate your help!!
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Grayhat7Author Commented:
A small update!
We have 5 shared folders containing data on the same volume. Files in 2 of them only are not accessible. Files in the other 3 shared drives can be accessed normally.
Thanks -
Had a client with a similar issue that turned out to be a machine infected with the crypto locker virus which trashed the files in connected network shares.
Grayhat7Author Commented:
Exactly!!!I found that virus on a machine!!!! Any idea on how to remove it? Also, would it be possible to gain access to the shared folder again?
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Thomas Zucker-ScharffSolution GuideCommented:
Crypto locker is not an easy one.  I have not tried the solutions on these pages, but they look promising:


Before you do anything make sure you have a full backup.
Malware bytes should be able to remove the virus. What server is the shared folder on? Depending on the os you should be able to right click on that shared folder and go to the previous versions tab and restore the folder from there. You will have to delete existing content being that they are encrypted.
You may also have to manually clear the user accounts temp folder and manually change the desktop wallpaper.
Thomas Zucker-ScharffSolution GuideCommented:
If you are going to use Malwarebytes (an excellent piece of software, IMHO), then use the Chameleon version.  This will run as a differently named process to fool malware, then kill known malware processes, then update and run MBAM.

Check out this forum post for instructions (for a different malware, but still applies):

Grayhat7Author Commented:
Thank you guys, i used the tools described in the following link: http://malwarefixes.com/remove-cryptolocker-virus/ to clean the user machine.

Do you have any idea how it propagates?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It searches your computer and mapped drives and encrypts all msoffice PDF and photo files.
@ITguy850 I successfully opened several files of image types JPG, BMP, and PNG on a file share infected by this malware.  Perhaps the one my team identified is a variant of the one most folks are reporting.
Grayhat7Author Commented:
Full details to remove the virus
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.