Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Currpted Files Due to Virus

Posted on 2014-01-16
8
Medium Priority
?
505 Views
Last Modified: 2014-01-18
Corrupted Document Screenshot 1Corrupted Document Screenshot 2
I have an user whose PC was infected with "Crypto" virus on this computer last night and somehow so many WORD/EXECL files on the network drive (on Windows Server 2003/File Server) have been infected. When I try to open them, I see the screenshots.

Is there a simply program that will undo the damage?
0
Comment
Question by:sglee
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 4

Accepted Solution

by:
Kent Fichtner earned 668 total points
ID: 39786183
I am sorry to say but as far as I am aware those files are encrypted, not corrupted.  I have looked and there are a lot of other people with the same issue.  The only solution that I know of is to restore a backup.
0
 
LVL 84

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 668 total points
ID: 39786287
Pay the ransom, restore from shadow copies, restore from backup are the only solutions. I am very sorry to say.
0
 
LVL 85

Assisted Solution

by:Scott McDaniel (Microsoft Access MVP - EE MVE )
Scott McDaniel (Microsoft Access MVP - EE MVE ) earned 664 total points
ID: 39786299
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 

Author Comment

by:sglee
ID: 39786419
Excel ErrorUpon further investigation, I don't think it is an act of virus.
Reasons:
(1) I can open some WORD files.
(2) I can't open any of the EXCEL files so far. I tried to open 20 some excel files.
(3) All of those files that I can't open have older dates like 9/5/2011, 5/3/1009 ... etc. None of these have today's or yesterday's dates. If the virus opened/altered the contents of those files, they would have had recent dates, but that is not the case.

That leads me to think that maybe this problem is caused by something else. Maybe server hardware is failing? Windows updates (perhaps applied overnight) screwed things up? If the Windows update was the problem, that would have been on CNN by now.

I don't know what to make of it?

As to the backup, I found out they did not have good backup since 12/168/2013, so here is another problem.
0
 
LVL 85
ID: 39786462
Crypto may not have encrypted all of the documents, so it would be possible open some but not all. It's very obvious if Crypto was the culprit - the user should have seen the "ransom" screen on their machine at some point. It's an image that has "Your personal files are encrypted" at the top, a picture of a shield to the left, a countdown timer, etc etc.

If you know the machine was infected with Crypto. then AFAIK there's nothing you can do other than pay the ransom, restore from backup, or try to use the Shadow Copy workaround to get them back (as suggested earlier).
0
 

Author Comment

by:sglee
ID: 39786503
Viruses QuarantinedHere are the viruses in Quarantined.
0
 
LVL 4

Expert Comment

by:Kent Fichtner
ID: 39786598
I would say if it is that virus or not, if the files have been corrupted that means the data in the file has changed...then the only way to get it back is to restore it.  Either restore through system rollback or a restore though a backup.
0
 

Author Comment

by:sglee
ID: 39786617
I agree. Thanks for your help.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article investigates the question of whether a computer can really be cleaned once it has been infected, and what the best ways of cleaning a computer might be (in this author's opinion).
Windows Explorer lets you open cabinet (cab) files like any other folder. In VBA you can easily handle normal files and folders, but opening and indeed creating cabinet files takes a lot more - and that's you'll find here.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question