Solved

excel - file extension is not valid format...

Posted on 2014-11-12
36
193 Views
Last Modified: 2015-01-26
Since yesterday, i get a prompt when clicking on excel file saying the file extension is a valid format.  I click yes to trust and it displays all gibberish in excel.  The new computer with the same documents transferred over does the same thing
excel1.PNG
excel.PNG
0
Comment
Question by:snoopaloop
  • 16
  • 6
  • 4
  • +4
36 Comments
 
LVL 19

Expert Comment

by:n2fc
ID: 40438905
You can try opening excel first and then using the "file" ==> "open" dialogue to see if the same results occur...

If so, your excel installation has become corrupt...

You will need to reinstall Microsoft Office or Excel  to correct this error.

This may be caused by a hardware failure of your hard drive or perhaps malware/virus infection...

You should run a scan for viruses/malware before attempting the reinstall.
0
 
LVL 23

Expert Comment

by:Michael74
ID: 40438916
In this case it looks like either the file has been corrupted. You can try this for recovery

http://www.officerecovery.com/excel/faq.htm

The other alternative is that the file extension is incorrect and this is not actually an excel file. trID can assist with this
http://mark0.net/soft-trid-e.html

Michael
0
 
LVL 11

Expert Comment

by:tel2
ID: 40438924
Hi snoopaloop,

Q1. Do you get the same problem with ALL Excel files?
Q2. What happens if you create a new workbook in Excel, then save it, and try to open that saved file, both from Excel and by double-clicking the file?
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40439143
This is a brand new refresh of a completely different computer with the other computer's files copied over.  The other computer originally had the problem.  So malware/virus is not the cause.  The file extension is xls.   The client has been using these excel files for payroll and timesheets for ever, ever.  Something went wonky with opening the files on the original computer two days ago.  
File, new excel, and saving the excel spreadsheet... Then close/open works fine.  Seems odd that all the excel files would become corrupt all at once.
0
 
LVL 11

Expert Comment

by:tel2
ID: 40439150
Hi snoopaloop,

What are the answers to Q1 & Q2 from my last post?

And:
Q3. What happens when you try to open any of those spreadsheets on a PC which has not had the problem?
0
 
LVL 23

Expert Comment

by:Michael74
ID: 40439170
Why not try the demo version of the recovery software from the link I posted to see if you are going to be able to recover these files.
0
 
LVL 85

Expert Comment

by:Rory Archibald
ID: 40439426
The error message mentions xlsx files but you say they are xls files - the two formats are completely different, so which is it?

Also, can you post a screenshot showing the first line of the 'gibberish' when you open it in Excel - it will often give a clue.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40441306
I tried the first program and it doesn't produce a fixed copy of the file.  Just an empty folder that it created on the desktop.  I randomly selected a file that dates back to mid october from the Mozy backup and downloaded to my computer, not the clients...  "Copy of GSAHTC  GR8 - Bank Queries Oct 2014 (3).xlsx"   The file downloaded completely fine.   I went back to the original computer and the completely refreshed computer with the transferred data and that file is not gibberish when it is open.  So at some point in between mid october and now, all the files became corrupt.
Capture.JPG
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40441313
The second program is not clear to me what to download beyond the original executable to get the definitions or whatever the library is called to work.  Beside Mozy backup clarifies that the extensions are in fact correct because the restore works with same file extension from a prior date.  The problem lies with grabbing the most recent data from mid october and beyond.  It seems to be all corrupt.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40441626
Correction to my prior comment  ***I went back to the original computer and the completely refreshed computer with the transferred data and THAT FILE IS GIBBERISH when it is open.  So at some point in between mid october and now, all the files became corrupt.
0
 
LVL 85

Expert Comment

by:Rory Archibald
ID: 40442079
Did you have an encrypted drive on your old computer? The first part of that file doesn't resemble an .xls or .xlsx format.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 40442877
Could you please open the file again so that it shows the gibberish again, and this time take a screenshot that shows the top left of the contents.

Edit: Whoops, I see that Rory Archibald asked for this earlier, and he is obviously also thinking along the same lines as me when I look at the contents of the file.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40443212
Is the snapshot at 2014-11-13 at 13:40:17 not good enough?  It's not an encrypted drive.  That file use to open in excel if you use a backup from mid october.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 40444565
Rory Archibald and I are both looking to see whether there is a 3 or 4 letter file type identifier on the first line.  It is usually right near the start of the first line, in cases where files have such an identifier, but it can also be a bit further along the first line or even a second line.  Part of the content is obscured by the error message dialog in your later screenshot, and the text of the error message has also been cut off.

Michael74 earlier suggested that you use the little standalone "TrID" program to try and identify the file, and given that this program currently has a database of 5409 file type definitions, it will probably do a better job than we would do of just looking at the text and trying to identify it.

The actual error message is probably the best clue.  It refers to an "invalid root" in the registry key:

HKEY_CLASSES_ROOT\CLSID\{AB8902B4-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

We cannot see anything after "AB8902B4" in your screenshot, hence the xxxx above.  Usually in these instances a repair install of the offending application will fix this type of error, but if you want to post the full registry key we can try and interpret what it is referring to.

Clearly the error is a "Script Error", which tends to imply that Excel is seeing something in the file that leads it to believe that there is embedded VBA code, but that it cannot decipher it.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40445148
I was trying to get that message to pop up but it wouldn't upon simple double clicking of the file.  It just open up the gibberish.  I tried again with in excel and I got the text import wizard displayed below...
Capture.JPG
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40445150
I didn't know where to download the library files for triD.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 40445557
Near the bottom of this page:
http://mark0.net/soft-trid-e.html
you will see a "Download" section containing these links:

Win32         TrID v2.10, 29KB ZIP
TrIDDefs.TRD package, 720KB ZIP (5409 file types, 04/11/14)

Unzip both ZIP files to the same folder and you will have the files:
readme_e.txt
readme_i.txt
trid.exe
triddefs.trd

You can delete "readme_i.txt", unless you are Italian.

Download this Windows batch file and save it to the same folder:
TridScan.cmd
Copy your Excel file into that folder and drag and drop it onto the batch file "TridScan.cmd".

Alternatively, you can upload your Excel file to the online scanner:
http://mark0.net/onlinetrid.aspx
but, given the name of your Excel file, I am not sure that you should be uploading it anywhere for privacy reasons.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 1

Author Comment

by:snoopaloop
ID: 40448522
It says it's unknown file as displayed the attachment...
unknown.JPG
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40450578
Office recovery wrote back...

Dear Michael,

Thank you for using our software.

I have the results of analysis of your data.
Unfortunately, your file is damaged beyond recovery. I am really sorry for bringing bad news.

If you have any further questions, please do not hesitate to contact us.

Best regards,

Ekaterina Danilova
OfficeRecovery.com Technical Support
techsupport@officerecovery.com
0
 
LVL 38

Expert Comment

by:BillDL
ID: 40452026
That's a great pity.  Although I have never used their services or recovery applications, I would tend to believe that OfficeRecovery.com are expert enough in that field to have recovered the file if it were at all possible.  It might be possible for a digital forensic expert to find at least some of the content in one or more of the affected files, given that they dig extremely deeply in an effort to prove the guilt or innocence of people, but I doubt that any fragments of the contents would be worth the very expensive service.

I believe that the only other course of action might be to remove the hard drive from the affected computer, attach it to another functional Windows computer, and run a data recovery program to see whether it can find any other versions of this file that were deleted.  Microsoft Office creates hidden temporary files when an Office file type is opened.  It does so so that the automatic autosave can work, and also as an emergency backup should the application crash half-way through editing but between saves.

If the computer has been in continual use since discovery of the corrupted file, or the hard drive has been formatted, then it is highly improbable that any of the previously deleted file versions will have survived.  A hard drive stores its data in fixed-size little spaces.  If the file is small enough to fit into one of these storage pockets, then it obviously only occupies one of them with wasted space, however a larger file will be spread across as many storage slots as is necessary, and these aren't always adjacent to each other.  The hard drive has an index of where on the drive all of these storage slots for each file are located.  When a file is deleted, these storage slots are marked as free to have other data written to them, but the file is still there on the drive and recoverable until overwritten.  A Data Recovery program scans the drive and does its best to cross-reference all of the data that it finds, and then has to try and reassemble all the file fragments again.  Normal user activity creates and deletes files all over the place, so it is often just pure luck if data can be recovered.

If you want to have a go at this you could try using GetDataBack (https://www.runtime.org/data-recovery-software.htm).  You can download, install, and run it in "trial mode", but when it comes to actually copying the recovered data out to another drive, you then have to buy a licence.  Remember, you should never install the software to the drive you are trying to recover data from.  Disconnect the affected drive and temporarily connect it as a "slave drive" to another computer and run the software on the hosting computer.

Even if you were successful in recovering other previously deleted versions of the affected file, you would then have the task of trying to compare them with the damaged files in an effort to find any that are undamaged.  That could be a time-consuming task.

To be perfectly honest, I seriously doubt that this last ditch attempt will provide anything fruitful.

In trying to assess how the damage was caused to the files, my first suspicion would be the health of the drive on which they existed when they became damaged.  I would probably never trust the integrity of that drive, even if it passed the tests run by a hard drive diagnostics program offered by the drive's manufacturer.

Perhaps the other experts may have some other suggestions, but I think it is the end of the road for those files.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40453478
The data restore looks to be fine from mid october.  While this isn't best solution, it's sufficient for our needs.  I will keep this open a little longer just to see if the documents somehow become corrupt again on the new computer.  I think you're right, I think it's best to stop using the hard drive regardless of the hard drive integrity tests.  Have you heard of a trojan virus rendering files useless?
0
 
LVL 38

Assisted Solution

by:BillDL
BillDL earned 125 total points
ID: 40454284
There is the CryptoLocker virus that encrypts your files and renders them useless until a "key" is used to "unlock" them again.
http://en.wikipedia.org/wiki/CryptoLocker
http://www.bbc.co.uk/news/technology-28661463

The whole purpose of this malware, however, is to extort money from people to get their files back, and if the user has never seen any "ransom" messages then I doubt that this would have been the cause.

I don't know of any other malware that deliberately messes up MS Office files, but it is probable that there will be something out there.

Edit:  I have just seen the following question that relates to a Word document:
http://www.experts-exchange.com/Q_28564570.html
It is hard to know whether the file has the same pattern of gobbledegook (if there is such a thing).

LATER EDIT:
The author of the OTHER question now states that the damage to his Word documents has been caused by the CryptoWALL virus.  I don't know how he confirmed this, but perhaps you might want to read the comments in his question from his latest comment in case any experts offer useful advice:
http://www.experts-exchange.com/Software/Office_Productivity/Office_Suites/MS_Office/Q_28564570.html#a40454588
0
 
LVL 11

Assisted Solution

by:tel2
tel2 earned 125 total points
ID: 40456169
I wonder if this could be the result of some Office macro virus (i.e. VBA).  Could be from a Word doc, Excel file, etc.
    http://support2.microsoft.com/kb/187243
    https://nakedsecurity.sophos.com/2014/07/07/remember-macro-viruses-infected-word-and-excel-files-theyre-back/
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40482218
Shoot.  I was just at the client today.  I didn't review this post until now.   I will ask them to place the old machine online to see if that's indeed the issue.
0
 
LVL 45

Expert Comment

by:Martin Liss
ID: 40520983
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
LVL 11

Expert Comment

by:tel2
ID: 40520984
Hi Martin,

I think there are several possible answers which have not yet been proved to be unapplicable.  For example, the last posts from BillDL and myself, have not yet had final responses.  Also, several experts have put plenty of work into this, and for them to receive no points for effort which has not been proved unapplicable, and could also be of use to future page visitors, seems unfair to me.

Depending on what we hear back form snoopaloop (if anything), maybe points could simply be split evenly over each expert post, exept for my first 2 which were not answers as such.  Unless anyone has any better ideas.

snoopaloop, any updates on this?

tel2
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40521057
I agree.  I like to postpone until the client agrees for me to pick up and investigate the computer more.  I will try again after the holidays.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40536935
I have the computer in my possession.  I will see if I can resolve the issue with the suggestion provided later today or tomorrow.
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40565449
Found this BROKEN URL below on the computer.  It's defintiely Cryptowall virus.  The Norton provided solution did not work.  Any better solutions?

c:\users\user_name\DECRYPT_INSTRUCTIONS.URL
decrypt_instruction.html
0
 
LVL 23

Accepted Solution

by:
Michael74 earned 250 total points
ID: 40565484
Depending on the version Cryptowall virus you may be able to restore the files by using a file restore application to recover deleted files. This is because Crytowall creates an encrypted version and deletes the original. Definitely worth a try

http://community.spiceworks.com/how_to/show/85802-how-to-recover-files-from-cryptowall-ransomeware-infection
0
 
LVL 1

Author Comment

by:snoopaloop
ID: 40565569
The utility immediately errored out.  I'm going to close out this ticket now that I know what it is and I restored the data from backups unless anyone has some final input to resolve this particular version of Cryptowall.
0
 
LVL 23

Assisted Solution

by:Michael74
Michael74 earned 250 total points
ID: 40565578
It is not unlikely that the virus seeks to prevent running these tools. Did you remove the drive and then run the file recovery software from another computer
0
 
LVL 1

Author Closing Comment

by:snoopaloop
ID: 40569769
I'll let you know if and when I ever get around to scanning that hard drive outside the box.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 40570334
Thank you snoopaloop
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

A little background as to how I came to I design this code: Around 5 years ago I designed an add-in that formatted Excel files to a corporate standard, applying different cell colours and font type depending on whether the cells contained inputs,…
Improved? Move/Copy Add-in Replacement - How to avoid the annoying, “A formula or sheet you want to move or copy contains the name XXX, which already exists on the destination worksheet.” David Miller (dlmille)  It was one of those days… I wa…
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.
This Micro Tutorial will demonstrate how to create pivot charts out of a data set. I also added a drop-down menu which allows to choose from different categories in the data set and the chart will automatically update.

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now