excel and word files will not open
Today a number of staff reported to me that in the afternoon they could not open some excel and word files because the "file format or file extension is not valid...verify no corruption" This does not apply to all files. Some excel files modified and saved this morning still open in the same network folder where others do not. I hope this is not a virus. Help
ASKER
Malwarebytes spends a lot of time in the windows installer folders on all of the workstations.
What version of Office (2003, 2007, 2010, etc.)?
What happens if you copy one of those files to a local drive?
What happens if you copy one of those files to a local drive?
OK let's be pessimistic.
This could be encrypting malware - if so the source machine will still be able to open the files that everyone else sees as corrupted because the affected machine is running on-the-fly decryption to hide its presence from the user. That ability will help you confirm it (when you find it)
Encryption malware can damage any data files that the infected machine has read/write access to.
Are you seeing changes to file extensions with a common but random string being appended to the file name?
How many users? Any unusual traffic? Bear in mind one machine will be sending all the read write instructions.
Most importantly do you have back up? Crypto's can usually disable ShadowCopy so that alone isn't helpful.
This could be encrypting malware - if so the source machine will still be able to open the files that everyone else sees as corrupted because the affected machine is running on-the-fly decryption to hide its presence from the user. That ability will help you confirm it (when you find it)
Encryption malware can damage any data files that the infected machine has read/write access to.
Are you seeing changes to file extensions with a common but random string being appended to the file name?
How many users? Any unusual traffic? Bear in mind one machine will be sending all the read write instructions.
Most importantly do you have back up? Crypto's can usually disable ShadowCopy so that alone isn't helpful.
ASKER
I have found that is it Cryptowall 3.0 with a ransom note for payment in every folder. Apparently it actually started last week, disabled shadowcopy and messed up our Thursday and Friday tape backup jobs. Is there any way to unencrypt some very important excel and word files.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER