?
Solved

Network share

Posted on 2014-04-05
11
Medium Priority
?
333 Views
Last Modified: 2014-04-08
Hi

Since today morning I have a weird problem. On one of my network share when I try to open a .DOC .XLS or a .PDF I receive a message that says

The file format differs from the format that the file name extension specifies.

If I clic on OK the file is opening and all the text Inside is ASCII.

It is happening on the entire share. But only this share. The others share are OK.
0
Comment
Question by:jpmoreau
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980392
Check if the files are not encrypted. You could of been hit by CryptoLocker or similar.

I mean another computer with access to that share is infected.
If that's the case, remove it from the network, clean it, restore files from backup.

HTH,
Dan
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39980395
Are you sure there isn't spyware on the Pc your accessing it from?

Here are some apps to check it with
AdwCleaner
http://www.bleepingcomputer.com/download/adwcleaner/

Kaspersky TDSSKiller
http://www.bleepingcomputer.com/download/tdsskiller/

ESET online scanner
http://www.eset.com/us/online-scanner/

Malwarebytes Anti-Rootkit
http://www.bleepingcomputer.com/download/malwarebytes-anti-rootkit/

www.malwarebytes.org
www.superantispyware.com
www.hitmanpro.com
0
 

Author Comment

by:jpmoreau
ID: 39980439
It is happening from any of the pc's
0
Does Your Cloud Backup Use Blockchain Technology?

Blockchain technology has already revolutionized finance thanks to Bitcoin. Now it's disrupting other areas, including the realm of data protection. Learn how blockchain is now being used to authenticate backup files and keep them safe from hackers.

 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980441
You can post here a document that you know does not contain sensitive data so we can confirm it's encrypted.

In the mean time, check the local documents of the other computers. I bet at least one has all documents encrypted. That's the infected one...
0
 

Author Comment

by:jpmoreau
ID: 39980447
The documents that are in problem are on a server share. Here is one example

Thanks
Besoins-des-clients-2012.xls
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980451
Looks encrypted. No header, no identifiable content inside.

The way Cryptolocker works, it encrypts all documents on local folders and on accessible network shares.
0
 

Author Comment

by:jpmoreau
ID: 39980464
Ok

What is the best way to correct?

Is there an easy way?
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980467
Yup. Find the infected machine(s), remove it/them from the network, clean them, then restore all files from backups.

Read this if you're infected with CryptoLocker (you might have a different virus, as variants appeared): http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
0
 

Author Comment

by:jpmoreau
ID: 39980512
I cannot not determine if I'm infected or not. Ihave try the tools but nothings show me taht I'm infected
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39980515
If your files are encrypted, it means some software encrypted it. You just need to find it.
0
 
LVL 10

Accepted Solution

by:
cpmcomputers earned 2000 total points
ID: 39981095
In most cases the cryptolocker (and similar)
Infect from a client pc on the network not usually the server itself not the one necessarily you are logging in from
You need to check all the pc's on the network

Please also check this article

http://www.theregister.co.uk/2014/04/03/cryptodefense_rsa_private_key_on_disk/

A new variant is out
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With the internet and the ease of information transference, many professional jobs can be done anywhere today.  Why should it make a difference whether an x-ray is read in India or the United States as long as the radiologist is qualified?   Outso…
Determining the an SCCM package name from the Package ID
This video shows and describes the main difference between both orientations in Microsoft Word. Viewers will understand when to use each orientation and how to get the most out of them.
The view will learn how to download and install SIMTOOLS and FORMLIST into Excel, how to use SIMTOOLS to generate a Monte Carlo simulation of 30 sales calls, and how to calculate the conditional probability based on the results of the Monte Carlo …
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question