excel - file extension is not valid format...

Since yesterday, i get a prompt when clicking on excel file saying the file extension is a valid format.  I click yes to trust and it displays all gibberish in excel.  The new computer with the same documents transferred over does the same thing
excel1.PNG
excel.PNG
LVL 1
snoopaloopAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

n2fcCommented:
You can try opening excel first and then using the "file" ==> "open" dialogue to see if the same results occur...

If so, your excel installation has become corrupt...

You will need to reinstall Microsoft Office or Excel  to correct this error.

This may be caused by a hardware failure of your hard drive or perhaps malware/virus infection...

You should run a scan for viruses/malware before attempting the reinstall.
0
Michael FowlerSolutions ConsultantCommented:
In this case it looks like either the file has been corrupted. You can try this for recovery

http://www.officerecovery.com/excel/faq.htm

The other alternative is that the file extension is incorrect and this is not actually an excel file. trID can assist with this
http://mark0.net/soft-trid-e.html

Michael
0
tel2Commented:
Hi snoopaloop,

Q1. Do you get the same problem with ALL Excel files?
Q2. What happens if you create a new workbook in Excel, then save it, and try to open that saved file, both from Excel and by double-clicking the file?
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

snoopaloopAuthor Commented:
This is a brand new refresh of a completely different computer with the other computer's files copied over.  The other computer originally had the problem.  So malware/virus is not the cause.  The file extension is xls.   The client has been using these excel files for payroll and timesheets for ever, ever.  Something went wonky with opening the files on the original computer two days ago.  
File, new excel, and saving the excel spreadsheet... Then close/open works fine.  Seems odd that all the excel files would become corrupt all at once.
0
tel2Commented:
Hi snoopaloop,

What are the answers to Q1 & Q2 from my last post?

And:
Q3. What happens when you try to open any of those spreadsheets on a PC which has not had the problem?
0
Michael FowlerSolutions ConsultantCommented:
Why not try the demo version of the recovery software from the link I posted to see if you are going to be able to recover these files.
0
Rory ArchibaldCommented:
The error message mentions xlsx files but you say they are xls files - the two formats are completely different, so which is it?

Also, can you post a screenshot showing the first line of the 'gibberish' when you open it in Excel - it will often give a clue.
0
snoopaloopAuthor Commented:
I tried the first program and it doesn't produce a fixed copy of the file.  Just an empty folder that it created on the desktop.  I randomly selected a file that dates back to mid october from the Mozy backup and downloaded to my computer, not the clients...  "Copy of GSAHTC  GR8 - Bank Queries Oct 2014 (3).xlsx"   The file downloaded completely fine.   I went back to the original computer and the completely refreshed computer with the transferred data and that file is not gibberish when it is open.  So at some point in between mid october and now, all the files became corrupt.
Capture.JPG
0
snoopaloopAuthor Commented:
The second program is not clear to me what to download beyond the original executable to get the definitions or whatever the library is called to work.  Beside Mozy backup clarifies that the extensions are in fact correct because the restore works with same file extension from a prior date.  The problem lies with grabbing the most recent data from mid october and beyond.  It seems to be all corrupt.
0
snoopaloopAuthor Commented:
Correction to my prior comment  ***I went back to the original computer and the completely refreshed computer with the transferred data and THAT FILE IS GIBBERISH when it is open.  So at some point in between mid october and now, all the files became corrupt.
0
Rory ArchibaldCommented:
Did you have an encrypted drive on your old computer? The first part of that file doesn't resemble an .xls or .xlsx format.
0
BillDLCommented:
Could you please open the file again so that it shows the gibberish again, and this time take a screenshot that shows the top left of the contents.

Edit: Whoops, I see that Rory Archibald asked for this earlier, and he is obviously also thinking along the same lines as me when I look at the contents of the file.
0
snoopaloopAuthor Commented:
Is the snapshot at 2014-11-13 at 13:40:17 not good enough?  It's not an encrypted drive.  That file use to open in excel if you use a backup from mid october.
0
BillDLCommented:
Rory Archibald and I are both looking to see whether there is a 3 or 4 letter file type identifier on the first line.  It is usually right near the start of the first line, in cases where files have such an identifier, but it can also be a bit further along the first line or even a second line.  Part of the content is obscured by the error message dialog in your later screenshot, and the text of the error message has also been cut off.

Michael74 earlier suggested that you use the little standalone "TrID" program to try and identify the file, and given that this program currently has a database of 5409 file type definitions, it will probably do a better job than we would do of just looking at the text and trying to identify it.

The actual error message is probably the best clue.  It refers to an "invalid root" in the registry key:

HKEY_CLASSES_ROOT\CLSID\{AB8902B4-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

We cannot see anything after "AB8902B4" in your screenshot, hence the xxxx above.  Usually in these instances a repair install of the offending application will fix this type of error, but if you want to post the full registry key we can try and interpret what it is referring to.

Clearly the error is a "Script Error", which tends to imply that Excel is seeing something in the file that leads it to believe that there is embedded VBA code, but that it cannot decipher it.
0
snoopaloopAuthor Commented:
I was trying to get that message to pop up but it wouldn't upon simple double clicking of the file.  It just open up the gibberish.  I tried again with in excel and I got the text import wizard displayed below...
Capture.JPG
0
snoopaloopAuthor Commented:
I didn't know where to download the library files for triD.
0
BillDLCommented:
Near the bottom of this page:
http://mark0.net/soft-trid-e.html
you will see a "Download" section containing these links:

Win32         TrID v2.10, 29KB ZIP
TrIDDefs.TRD package, 720KB ZIP (5409 file types, 04/11/14)

Unzip both ZIP files to the same folder and you will have the files:
readme_e.txt
readme_i.txt
trid.exe
triddefs.trd

You can delete "readme_i.txt", unless you are Italian.

Download this Windows batch file and save it to the same folder:
TridScan.cmd
Copy your Excel file into that folder and drag and drop it onto the batch file "TridScan.cmd".

Alternatively, you can upload your Excel file to the online scanner:
http://mark0.net/onlinetrid.aspx
but, given the name of your Excel file, I am not sure that you should be uploading it anywhere for privacy reasons.
0
snoopaloopAuthor Commented:
It says it's unknown file as displayed the attachment...
unknown.JPG
0
snoopaloopAuthor Commented:
Office recovery wrote back...

Dear Michael,

Thank you for using our software.

I have the results of analysis of your data.
Unfortunately, your file is damaged beyond recovery. I am really sorry for bringing bad news.

If you have any further questions, please do not hesitate to contact us.

Best regards,

Ekaterina Danilova
OfficeRecovery.com Technical Support
techsupport@officerecovery.com
0
BillDLCommented:
That's a great pity.  Although I have never used their services or recovery applications, I would tend to believe that OfficeRecovery.com are expert enough in that field to have recovered the file if it were at all possible.  It might be possible for a digital forensic expert to find at least some of the content in one or more of the affected files, given that they dig extremely deeply in an effort to prove the guilt or innocence of people, but I doubt that any fragments of the contents would be worth the very expensive service.

I believe that the only other course of action might be to remove the hard drive from the affected computer, attach it to another functional Windows computer, and run a data recovery program to see whether it can find any other versions of this file that were deleted.  Microsoft Office creates hidden temporary files when an Office file type is opened.  It does so so that the automatic autosave can work, and also as an emergency backup should the application crash half-way through editing but between saves.

If the computer has been in continual use since discovery of the corrupted file, or the hard drive has been formatted, then it is highly improbable that any of the previously deleted file versions will have survived.  A hard drive stores its data in fixed-size little spaces.  If the file is small enough to fit into one of these storage pockets, then it obviously only occupies one of them with wasted space, however a larger file will be spread across as many storage slots as is necessary, and these aren't always adjacent to each other.  The hard drive has an index of where on the drive all of these storage slots for each file are located.  When a file is deleted, these storage slots are marked as free to have other data written to them, but the file is still there on the drive and recoverable until overwritten.  A Data Recovery program scans the drive and does its best to cross-reference all of the data that it finds, and then has to try and reassemble all the file fragments again.  Normal user activity creates and deletes files all over the place, so it is often just pure luck if data can be recovered.

If you want to have a go at this you could try using GetDataBack (https://www.runtime.org/data-recovery-software.htm).  You can download, install, and run it in "trial mode", but when it comes to actually copying the recovered data out to another drive, you then have to buy a licence.  Remember, you should never install the software to the drive you are trying to recover data from.  Disconnect the affected drive and temporarily connect it as a "slave drive" to another computer and run the software on the hosting computer.

Even if you were successful in recovering other previously deleted versions of the affected file, you would then have the task of trying to compare them with the damaged files in an effort to find any that are undamaged.  That could be a time-consuming task.

To be perfectly honest, I seriously doubt that this last ditch attempt will provide anything fruitful.

In trying to assess how the damage was caused to the files, my first suspicion would be the health of the drive on which they existed when they became damaged.  I would probably never trust the integrity of that drive, even if it passed the tests run by a hard drive diagnostics program offered by the drive's manufacturer.

Perhaps the other experts may have some other suggestions, but I think it is the end of the road for those files.
0
snoopaloopAuthor Commented:
The data restore looks to be fine from mid october.  While this isn't best solution, it's sufficient for our needs.  I will keep this open a little longer just to see if the documents somehow become corrupt again on the new computer.  I think you're right, I think it's best to stop using the hard drive regardless of the hard drive integrity tests.  Have you heard of a trojan virus rendering files useless?
0
BillDLCommented:
There is the CryptoLocker virus that encrypts your files and renders them useless until a "key" is used to "unlock" them again.
http://en.wikipedia.org/wiki/CryptoLocker
http://www.bbc.co.uk/news/technology-28661463

The whole purpose of this malware, however, is to extort money from people to get their files back, and if the user has never seen any "ransom" messages then I doubt that this would have been the cause.

I don't know of any other malware that deliberately messes up MS Office files, but it is probable that there will be something out there.

Edit:  I have just seen the following question that relates to a Word document:
http://www.experts-exchange.com/Q_28564570.html
It is hard to know whether the file has the same pattern of gobbledegook (if there is such a thing).

LATER EDIT:
The author of the OTHER question now states that the damage to his Word documents has been caused by the CryptoWALL virus.  I don't know how he confirmed this, but perhaps you might want to read the comments in his question from his latest comment in case any experts offer useful advice:
http://www.experts-exchange.com/Software/Office_Productivity/Office_Suites/MS_Office/Q_28564570.html#a40454588
0
tel2Commented:
I wonder if this could be the result of some Office macro virus (i.e. VBA).  Could be from a Word doc, Excel file, etc.
    http://support2.microsoft.com/kb/187243
    https://nakedsecurity.sophos.com/2014/07/07/remember-macro-viruses-infected-word-and-excel-files-theyre-back/
0
snoopaloopAuthor Commented:
Shoot.  I was just at the client today.  I didn't review this post until now.   I will ask them to place the old machine online to see if that's indeed the issue.
0
Martin LissOlder than dirtCommented:
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
tel2Commented:
Hi Martin,

I think there are several possible answers which have not yet been proved to be unapplicable.  For example, the last posts from BillDL and myself, have not yet had final responses.  Also, several experts have put plenty of work into this, and for them to receive no points for effort which has not been proved unapplicable, and could also be of use to future page visitors, seems unfair to me.

Depending on what we hear back form snoopaloop (if anything), maybe points could simply be split evenly over each expert post, exept for my first 2 which were not answers as such.  Unless anyone has any better ideas.

snoopaloop, any updates on this?

tel2
0
snoopaloopAuthor Commented:
I agree.  I like to postpone until the client agrees for me to pick up and investigate the computer more.  I will try again after the holidays.
0
snoopaloopAuthor Commented:
I have the computer in my possession.  I will see if I can resolve the issue with the suggestion provided later today or tomorrow.
0
snoopaloopAuthor Commented:
Found this BROKEN URL below on the computer.  It's defintiely Cryptowall virus.  The Norton provided solution did not work.  Any better solutions?

c:\users\user_name\DECRYPT_INSTRUCTIONS.URL
decrypt_instruction.html
0
Michael FowlerSolutions ConsultantCommented:
Depending on the version Cryptowall virus you may be able to restore the files by using a file restore application to recover deleted files. This is because Crytowall creates an encrypted version and deletes the original. Definitely worth a try

http://community.spiceworks.com/how_to/show/85802-how-to-recover-files-from-cryptowall-ransomeware-infection
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
snoopaloopAuthor Commented:
The utility immediately errored out.  I'm going to close out this ticket now that I know what it is and I restored the data from backups unless anyone has some final input to resolve this particular version of Cryptowall.
0
Michael FowlerSolutions ConsultantCommented:
It is not unlikely that the virus seeks to prevent running these tools. Did you remove the drive and then run the file recovery software from another computer
0
snoopaloopAuthor Commented:
I'll let you know if and when I ever get around to scanning that hard drive outside the box.
0
BillDLCommented:
Thank you snoopaloop
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Excel

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.