Solved

Network share

Posted on 2014-04-05
11
325 Views
Last Modified: 2014-04-08
Hi

Since today morning I have a weird problem. On one of my network share when I try to open a .DOC .XLS or a .PDF I receive a message that says

The file format differs from the format that the file name extension specifies.

If I clic on OK the file is opening and all the text Inside is ASCII.

It is happening on the entire share. But only this share. The others share are OK.
0
Comment
Question by:jpmoreau
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980392
Check if the files are not encrypted. You could of been hit by CryptoLocker or similar.

I mean another computer with access to that share is infected.
If that's the case, remove it from the network, clean it, restore files from backup.

HTH,
Dan
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39980395
Are you sure there isn't spyware on the Pc your accessing it from?

Here are some apps to check it with
AdwCleaner
http://www.bleepingcomputer.com/download/adwcleaner/

Kaspersky TDSSKiller
http://www.bleepingcomputer.com/download/tdsskiller/

ESET online scanner
http://www.eset.com/us/online-scanner/

Malwarebytes Anti-Rootkit
http://www.bleepingcomputer.com/download/malwarebytes-anti-rootkit/

www.malwarebytes.org
www.superantispyware.com
www.hitmanpro.com
0
 

Author Comment

by:jpmoreau
ID: 39980439
It is happening from any of the pc's
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980441
You can post here a document that you know does not contain sensitive data so we can confirm it's encrypted.

In the mean time, check the local documents of the other computers. I bet at least one has all documents encrypted. That's the infected one...
0
 

Author Comment

by:jpmoreau
ID: 39980447
The documents that are in problem are on a server share. Here is one example

Thanks
Besoins-des-clients-2012.xls
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980451
Looks encrypted. No header, no identifiable content inside.

The way Cryptolocker works, it encrypts all documents on local folders and on accessible network shares.
0
 

Author Comment

by:jpmoreau
ID: 39980464
Ok

What is the best way to correct?

Is there an easy way?
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980467
Yup. Find the infected machine(s), remove it/them from the network, clean them, then restore all files from backups.

Read this if you're infected with CryptoLocker (you might have a different virus, as variants appeared): http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
0
 

Author Comment

by:jpmoreau
ID: 39980512
I cannot not determine if I'm infected or not. Ihave try the tools but nothings show me taht I'm infected
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980515
If your files are encrypted, it means some software encrypted it. You just need to find it.
0
 
LVL 10

Accepted Solution

by:
cpmcomputers earned 500 total points
ID: 39981095
In most cases the cryptolocker (and similar)
Infect from a client pc on the network not usually the server itself not the one necessarily you are logging in from
You need to check all the pc's on the network

Please also check this article

http://www.theregister.co.uk/2014/04/03/cryptodefense_rsa_private_key_on_disk/

A new variant is out
0

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If, like me, you have a lot of Dell servers in the estate you manage this article should save you a little time. When attempting to login to iDrac on any server I would be presented with two errors. The first reads "Do you want to run this applicati…
Microsoft Office Picture Manager was included in Office 2003, 2007, and 2010, but not in Office 2013. Users had hopes that it would be in Office 2016/Office 365, but it is not. Fortunately, the same zero-cost technique that works to install it with …
This video shows where to find templates, what they are used for, and how to create and save a custom template using Microsoft Word.
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question