File type and modified date altered on NAS drive

Hello - a number of files on our NAS drive are showing their file type as APPLICATION instead of their correct file type plus their last modified dates have all been changed to the same date / time - 15/02/2015 18:10. This is some form of virus I guess. Any ideas what tool to use to fix it? We are using PCs, a number of which have the NAS as a mapped drive.
TedMoreyAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

rindiCommented:
Disconnect the PC's from the LAN and scan them for malware using malwarebytes. What type of extensions do the files get?
0
TedMoreyAuthor Commented:
Hello Rindi

Thanks for getting in touch. I went with your suggestion + purchased a license for Malwarebytes, here's what I've learned...

1. The drive is infected with Win32 Crytor virus.
2. All file names have had '.exe' appended to them - i.e. mydocument.docx has become mydocument.docx.exe.
3. Malwarebytes only offers me the option to quarantine the affected files - no option to repair them.
4. I was incorrect describing this as a NAS drive - it is a Windows 2008 file server.

Any ideas on how to proceed - to a) remove the virus + b) restore the files?

Thanks
Ed
0
rindiCommented:
First make sure you have scanned all of the PC's that connect to the server, as it is most likely at least one of them that is infected, and not the server. Then remove all the malware found first.

Once none of the PC's nor the server is infected anymore, I would just delete those renamed files and restore them from your backups.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TedMoreyAuthor Commented:
Hello Rindi - thanks for your input on this problem. We have scanned all of the machines currently in the office and no problems were found, which is a relief. This leads me to believe that maybe one of our remote users that only comes into the office once in a while may be the root of the problem - we'll monitor that. However it does not solve the problem of the infected server and we have reluctantly decided to turn it off until such time we can decide on a resolution.
0
rindiCommented:
Why is restoring the files from your backups a problem?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.