Member Avatar for ezrael

hi, I have got a big problem, all my exe files are corrupted by virus I scanned my pc with kaspersky antivirus and detected as and the virus is removed but my files are not recovered. All MS office pakage documents are changed to Unreadable characters as shown below. Any one who has solution pls show me the way.

dulla^@204~__b_l_e_ _N_o_r_m_a_l______ö___4Ö___
_~dulla^@204~______
___(_k_ôÿÁ_(___________ _N_o_ _~dulla^@204~__________ù___________ÿÿÿÿ____________~dulla^@204~____*___J___K___L___m______”___•___Ø_~dulla^@204~__Ç___È___Ö___×___Ø___Ù___ç___÷___ø___~dulla^@204_______€___€__________˜___~dulla^@204~_€__________˜____0_______€___€______~dulla^@204~_____€___€__________˜____0_______€___€~dulla^@204~___0_______€___€______________ù ______~dulla^@204~____________ù __ ___ÿÿ______hM______Œ_~dulla^@204~__ï_ˆ___ˆ___û_______________“___“___û_~dulla^@204~__8_______*€urn:schemas-microsoft-com:~dulla^@204~_ags_€City_€9_______*€urn:schemas-micr~dulla^@204~_ice:smarttags_€place_€

  • 5 Contributors
  • 6 Replies
  • 583 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

OP reported that executable files and Office documents were left as unreadable data after a malware hit; replies from suggested extra anti‑malware scans and suggested System Restore. The situation described is consistent with two different outcomes: (A) the malware replaced or overwrote files, or (B) the files were damaged by the disinfection process. The immediate goal is to preserve whatever can still be recovered before writing more data to the affected disk.

At this stage the infected disk must not be written to and the machine should be isolated from networks. Create a full image (bit‑for‑bit) of the drive from a clean boot environment (Windows PE or a Linux live USB) or copy the entire user-data tree to an external drive if imaging is not possible. Imaging preserves deleted/older file data that recovery tools rely on. If unfamiliar with imaging, the safest step is to remove the drive and connect it to a known-clean system as a secondary disk for read-only access.

Check for easy restores before deep recovery: antivirus quarantine or “repair” stores sometimes keep backup copies, and Windows Volume Shadow Copy / Previous Versions can hold intact file versions. For Office files, inspect the file header to determine format integrity:

.doc  (OLE CF): D0 CF 11 E0 A1 B1 1A E1
.docx (ZIP   ): 50 4B 03 04  (starts with "PK")

If .docx begins with PK, try renaming to .zip and extraction; if headers are destroyed the file has likely been overwritten and is not repairable.

When backups/previous versions aren’t available, run recovery on the image using reputable recovery tools (examples: Recuva, PhotoRec/TestDisk, R‑Studio). Executables are safest to restore by reinstalling from original installers or known-good media rather than copying random .exe files. After recovery, perform full offline AV scans and validate recovered files (digital signatures where applicable). If critical data remains unrecoverable, consider professional data‑recovery/forensic services. Given ’s scan attempts, priority now should be imaging + checking shadow copies/backup sources before further on-disk changes.

Recommended Answers

All 6 Replies

Member Avatar for cohen

Welcome to Daniweb.

Pls do the following:

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - run and post the log

In your reply, post the following (in this order):
1. - Malware Bytes Log
2. - Hijackthis log

then we can continue :)

Cohen

Member Avatar for ezrael

thanks cohen for your support, i have done what u suggest me, but my documents are not recoverd. As u order me I attached the log files.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:33:12 AM, on 11/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\LckFldService.exe
C:\WINDOWS\system32\srvany.exe
C:\pvsw\bin\w3dbsmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\EZA\Application Data\U3\1101420C7A42EF67\LaunchPad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\EZA\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSN smart tags - {9DD4258A-7138-49C4-8D34-587879A5C7A4} - C:\PROGRA~1\MSN\smarttag\MSNBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Power Ge'ez 2005.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAF259AF-376F-442F-A266-1D5D959A2D03}: NameServer = 192.55.64.36 192.55.64.38
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Pervasive.SQL Workgroup Engine - Unknown owner - C:\WINDOWS\system32\srvany.exe

--
End of file - 4332 bytes
Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 2

11/20/2008 8:13:00 AM
mbam-log-2008-11-20 (08-13-00).txt

Scan type: Quick Scan
Objects scanned: 6
Time elapsed: 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Member Avatar for nsindian

have you tried a system restore?

Member Avatar for cohen

thanks cohen for your support, i have done what u suggest me, but my documents are not recoverd. As u order me I attached the log files.

OK, well nothing seems to going on with the hijackthis.... so i'm a bit stumped......

Might have to wait for one of the higher guys to come along... sorry

have you tried a system restore?

All a system restore does, it restores the system, it does nothing to the files or the anything....

and i'm not sure if it would get rid of the virus..... :?:

Cohen

Member Avatar for habesha_guy

I'm new gay, So Plz help me out about it!! i lost my file or my all most life. the only thing i have is your help, my boos want to out in my new job, so help me plZ!!!!!!!!

Member Avatar for jbennet

I'm new gay

?

plZ!!!!!!!!

no text speak

Please start your own thread instead of hikacking someone elses

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.