Got something to say or just want fewer pesky ads? Join us... 😊

Desperate help needed from PC experts



Wilko

LUZZING chairs about
Sep 19, 2003
9,921
BN1
Something I downloaded onto my PC has caused a virus meaning that I cannot open any microsoft documents, this is all my work in the last year in the form of word documents and powerpoints. It seems they have been corrupted by a company who is now asking for between 500-1000usd to decrypt them:

http://paytoc4gtpn5czl2.balzakoptions.com/1b0R8tp

It has not impacted the microsoft package as I can still make and save new documents with no problems. I have tried running my anti-virus software but it detects no problem.

I am getting really desperate as this is all my work. Any bright sparks got any ideas on how to save my files from death? Tried googling but no luck so far.

Thanks in advance.
 




madinthehead

I have changed this
Jan 22, 2009
1,751
Oberursel, Germany


Gazwag

5 millionth post poster
Mar 4, 2004
30,093
Bexhill-on-Sea
I cannot help much but we had that at work three weeks ago, somebody opened a CV which contained the virus. Every word or excel directory had an extra two files one of which directed you to a decrypt site. We have a hosted server so our IT people got rid of the virus but had to restore to the day before so we lost a days work. They were amazed (and embarrassed) that the virus got through.

Hope you take regular backups.
 


HalifaxSeagull

Active member
Aug 24, 2010
772
Surely its illegal for them to do that? In which case go to the police

Im not sure that would help in retrieving his lost files though. Unless they can put him I touch with others who have reported the same and have found a solution... My guess is you'd end up with a crime number and the incident will be 'filed at time of recording'

Probably best to join a few 'techy' forums and ask the same question to them?
 






Wilko

LUZZING chairs about
Sep 19, 2003
9,921
BN1
I cannot help much but we had that at work three weeks ago, somebody opened a CV which contained the virus. Every word or excel directory had an extra two files one of which directed you to a decrypt site. We have a hosted server so our IT people got rid of the virus but had to restore to the day before so we lost a days work. They were amazed (and embarrassed) that the virus got through.

Hope you take regular backups.

Thank you for your advice, this sounds like exactly the same thing. Do you know how they got rid of the virus? When I run virus software it does not identify any problem?
 






deletebeepbeepbeep

Well-known member
May 12, 2009
20,888
Thank you for your advice, this sounds like exactly the same thing. Do you know how they got rid of the virus? When I run virus software it does not identify any problem?

Can you do a system restore as [MENTION=22906]GingerBeerMan[/MENTION] suggested?
 


Gazwag

5 millionth post poster
Mar 4, 2004
30,093
Bexhill-on-Sea
Thank you for your advice, this sounds like exactly the same thing. Do you know how they got rid of the virus? When I run virus software it does not identify any problem?
Sorry i don't know what they did its all done remotely by the hosting company. It did take them a day to sort it out though, i think most of that time was running some scan to ensure the server was clean before they restored the backup.

I hope the people who write these viruses rot in hell.
 


Wilko

LUZZING chairs about
Sep 19, 2003
9,921
BN1




Wilko

LUZZING chairs about
Sep 19, 2003
9,921
BN1








Triggaaar

Well-known member
Oct 24, 2005
49,989
Goldstone
they have been corrupted by a company who is now asking for between 500-1000usd to decrypt them:
Firstly, don't ever pay anything to one of these companies. I wouldn't care if they were asking for $10, I wouldn't be paying. It's not like you can trust them to help you once paid.

I wouldn't try and open any of your important documents until the problem is resolved. You can test with a document that isn't important.

Do you have a backup of these documents? You should, and if you haven't, try and learn from this and make sure you get one from now on (you need a backup for when your hard drive fails, not just for viruses). That doesn't mean you can't fix the problem though.

I would offer to help if you brought it round, but you don't seem too local, and I am a local shop, for local people.
 


happypig

Staring at the rude boys
May 23, 2009
7,935
Eastbourne
I'm no expert on M$ products but I have to use it at work.
Some thoughts:
Could it be that a template has got corrupted/altered ? Check file timestamps to see if your files have actually been altered.
Try opening a file in google docs.
Download a "Live" linux distro, burn to cd/dvd and run that, then see if your files can be opened with the built in package (I've used http://www.knopper.net/knoppix/index-en.html) a few times.
 


Dick Head

⭐⭐⭐⭐⭐
Jan 3, 2010
13,612
Quaxxann
If you can get hold of and boot into a Linux live CD (I would recommend Puppy Linux) you should be able to save all your files to a flash drive/external drive.
 


Dec 29, 2011
8,014
Can you post a few screenshots of what happens when you attempt to open documents? Also right click on a document, go to properties and make sure it's opening with Microsoft Word, the file associations may have been changed to a malicious program. Finally, if you create and save a new document, and then close and re-open it, is it fine?
 




Lethargic

Well-known member
Oct 11, 2006
3,456
Horsham
This does look like a know scam google "CBT Locker Virus" or Cryptlocker virus" and see if this matches your problem I think it will. There are 2 types of attacks 1 which simply hides the real files and another that actually encrypts the files if you have the later then you will be screwed if you do not have the files backed up elsewhere. Remember that if you do have the active virus installed it could encrypt an files you copy/restore also I would suggest disconnecting the PC from the internet until its clean you do not know what else has been infected.

Do not restore the files until you have removed the virus and do not pay the ransom.
 


Wilko

LUZZING chairs about
Sep 19, 2003
9,921
BN1
Can you post a few screenshots of what happens when you attempt to open documents? Also right click on a document, go to properties and make sure it's opening with Microsoft Word, the file associations may have been changed to a malicious program. Finally, if you create and save a new document, and then close and re-open it, is it fine?

Will try and get some screenshots later. In answer to your second question - yes, any new files made after the virus opn, close and reopen without an issue. It just seems to have affected files prior to the virus being downloaded.
 



Paying the bills

Latest Discussions

Paying the bills

Paying the bills

Paying the bills

Albion and Premier League latest from Sky Sports


Top
Link Here