6 Replies Latest reply on Nov 28, 2013 8:04 AM by Peter M

    recent virus attack

    cenfin

      Hi all,

       

      I am after some assistance please urgently

       

      I recently got hit by a trojan that black banned my ip address. I cleaned up virus and resolved the issues I thought. Ip address is now not listed on banned list.

       

      A day later I went to open one of my excal and word docs (office 2013), and found that all files have been corrupted, including PDF's. The documents do not open and an error comes up stating file is corrupted or the program cannot open that type of file extension.

       

      With the PDFs, I have tryed using "PDF recover", with no success.

       

      for the excel and word docs, I have tried using SYSINFO Tools. This did repair the files, well so the program said but the files were still unable to be openned, or decoded.

       

      Unfortunately I had  my backup harddrive connected at the time and all the backups have been affected as well.

       

      Now I am inthe position of having, at the moment lost all data for my business, for the past 7 years.

       

      I have looked for info at sysmantec fro a solution (link below) with no success.

       

      http://www.symantec.com/connect/forums/some-virus-has-corrupted-many-our-microso ft-office-files-and-pdf-fileshttp://

       

      I can upload some examples of the damaged files if required.

       

      Can anyone advise how I can resulve this issue?

      .

        • 1. Re: recent virus attack
          Peter M

          That Symantec link is broken so have no idea what it's about or perhaps their forums are only visible to members?  You have no backups whatsoever and I assume a System Restore doesn't restore the documents anyway (it normally doesn't)?   In which case I would say those records are lost.  Unless there is some kind of professional service out there somewhere that decrypts files.  Was this trojan one of those Ransomware-type of things?

           

          If so there may be some help available on malware specialist forums such as BleepingComputer etc.  But I can't guarantee that.

           

          Run a Hijackthis log by one of those forums listed in the Hijackthis section of the last link in my signature below to see what they say.

           

          Meanwhile make sure that all parts of your system are totally up to date, especially Internet Explorer and its add-ons, whether or not you use it.

           

          What McAfee software are you using by the way?

           

           

           

          .

           

           

           

          Message was edited by: Ex_Brit on 28/11/13 6:45:17 EST AM
          1 of 1 people found this helpful
          • 2. Re: recent virus attack
            cenfin

            Thanks for your comments and advice. Restoral point is usless, the system apprears to be running ok now but just PDF's and Office docs corrupted.

             

            I am using "McAfee as a service", with the usual Virus and Spyware Protection, firewall and Browser protection.

             

            I will follow your advice with Hijackthis. about to do it now.

            • 3. Re: recent virus attack
              Peter M

              You mean McAfee SaaS (McAfee Total Protection Service)?   Then I will move this to that section.

               

              Message was edited by: Ex_Brit on 28/11/13 6:55:00 EST AM
              • 4. Re: recent virus attack
                Peter M

                I moved this provisionally to Malware Discussions > Corporate User Assistance (if you are using McAfee TPS).

                 

                BTW I joined Symantec Connect and still that link is broken.

                 

                Message was edited by: Ex_Brit on 28/11/13 7:19:06 EST AM
                • 6. Re: recent virus attack
                  Peter M

                  Just read it and although interesting, it's all been said before here and in other forums and isn't much help really.

                   

                  Your only hope I think is to right-click each affected file and go to Properties and see if there is a "Previous Versions" tab and hope that works.

                   

                  Meanwhile hopefully posting on an independent forum may find some answers for you.  (As in the HJT log suggestion).