Browsers forum: Internet Explorer favorites

What's that? It's documented at http://www.opennet.ru/docs/formats/xls.txt

The BOF was easy to spot the corruption and whatever pest/virus/malware that did this is not one I've seen. It may be possible to rebuild such a file but if this is worth it, companies like DRIVESAVERS and Kapersky may know exactly which pest it was and how to get the files back.

I see many of the other Excel information is intact but I stopped as soon as I could figure out the BOF and EOF.

I had hopes of finding a name of the pest but without it, I can't find a cure. BUT THERE IS SOME HOPE HERE. You only need to find the right person and I bet those folk are at an antivirus company or drivesavers.
Bob

This used to be a .XLS file. A .XLSX or XML version from Office 2007 would be another matter entirely.

Yes they are both xls files from Office 2000.

Colin

Sadly, without a name of the pest I can't offer more.

On Kaspersky is a thread about the same Ransomeware, they are calling it Ukash Virus with the files encryted by trojancryptor.

Is that of any help?

Colin

look anything like this?
http://www.youtube.com/watch?v=Qb8Rv0Xu60s

Scroll the video forward to 0:19 seconds to see the message and pause it. The wording may be different depending what police force or security agency the malware pretended to be.

But if the message looked like that then there is more hope.

You may want to wait until Bob posts, but in the meantime you can visit the site below and read the discussion there;
http://www.bleepingcomputer.com/forums/topic452920.html

The type of file lock seems similar to yours eg Locked-newfile.doc.ngh

That discussion offers a link to a Kaspersky utility for decrypting files affected by this malware here;
http://support.kaspersky.com/faq/?qid=208286527

If you do intend to try this utility I would strongly suggest you back up those infected personal files first. If that utility fails for you and corrupts the files, then at least you still have those backups.

Any other locked files on the system is a risk, so be prepared for the worst, as in, reinstall the OS.

Follow those Kaspersky instructions carefully.

Mark

aah, yes it was similar to that!!!

I will have a look at the rest of yout thread when I get home.

Colin

Sorry, your advice that I concur with!

This needs to go to the Kapersky forum (others might do?) since I think Kapersky has taken a liking to figuring out RANSOM WARE.

It looks like a simple corruption. I was able to open the file in a hex editor and a lot of the records looked OK with obvious corruption of the BOF and EOF records. But the corruption didn't look obvious to me.

That is, I write apps and embedded code that involves bit manipulation such as X'ORING this and that, shift left, right but it was beyond the simple stuff I saw years ago.

Time for Kapersky to peek at it.

In closing I did try an online Excel recovery system and it almost recovered the file. If it was closer or without errors I would have written that it was a solution but for now, off to the Kap Forums.
Bob

I believe nilocp should now post in the Kasperksy forums and check if their utility is suitable in this case.

I downloaded those files you know, and just opened them in Notepad, but they were just Chinese to me. I mean, the character set looked Chinese!

I figured you would have a better idea.

Mark

for all you have done. You say you have nearly recovered the file. Is it in a form I might be abkle to read some of it? It may help me get back to where I was!!

And` Mark thanks to you as well!

Colin

That should have been thanks to Bob as well!!

https://online.officerecovery.com/excel/

BUT it was partial in it's recovery but it was worth trying.

A final many thanks to everyone who has tried, albeit uinsucessfully, to solve this issue.

A friend of mine has had his techies looking at it , and they have used Kaspersky RannohDecryptor to decode the files. The virus may be called Trojan-Ransom.Win32.Rannoh.

I have not spoken to him yet so do not know what was involved but it worked!!!!

Thanks once again

Colin