Jump to content
Whelp

Malware change my excel files name and remove the extention urgent please.

Recommended Posts

Hello everyone.

Sorry to bother you with my problem .but a unique virus hit my computer that attacks only excel files and changes their names.and erase their extension.for exemple (file name malaga.xls becomes 162C2200) .if their anything you can help me with it would be appreciated thank you very much best wishes.

Share this post


Link to post
Share on other sites

Hi @Whelp       :welcome:

What you describe would appear to be like an encrypting ransomware.   I take it that you are absolutely not able to open any of those Excel files ?

 

We very very much need the reports from Farbar  that are listed on this pinned topic

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

NOTE:  Files encrypted by a encrypting ransomware cannot be "cured".    But after I have your reports & after an initial review, I will have additional advice.

 

QUESTION:  Do you have a complete backup of this system  ( of recent vintage ) ?

Backup is your best friend.

 

QUESTION:   Prior to this incident, did you download or install any sort of "freebie"  off the internet ?  a game or tool or program ?

Share this post


Link to post
Share on other sites

Hello thank you very much for your time and reply .to answer your question sadly I didn't make any backup .and didn't install anything,BUT what I suspect after I entered the recent files folder I found a bunch of updates with navigator Opera in it.so I don't know if this any good lead but that all I have.thanks again

Share this post


Link to post
Share on other sites

Hi.

Please be very aware, that if this is a case of a actual encrypting ransomware,  that there is very little we can do.

And if you will run this report, I can review to see whether there are more real details about the file names of Excel files.

I would like to have you run a report tool known as FRST. This has no personal information. It is a well-known & widely used &safe.
FRST will help provide me with a list of installed programs and other information about your computer that will help me see if there are any other problems that are not being detected. Please follow the steps below to run FRST.


1: Please download FRST from the link below and save it to your desktop:

"Download link for 32-Bit version Windows"



"Download link for 64-Bit Version Windows"



Please wait and look toward the top or bottom of your browser for the option to Run or Save.
Click Save to save the file version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Run report with FRST

Right-click on FRST icon and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run.
 

_Windows 8 or 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen._

Click YES when prompted by Windows U A C prompt to allow it to run.
Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway.


Approve the Windows UAC prompt on Windows Vista and newer operating systems by clicking on Continue or Yes. 

Click Yes when the* disclaimer* appears in FRST.
The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use.

Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked).
Press Scan button and wait.




The tool will produce 2  logfiles on your desktop: FRST.txt , Addition.txt 
Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files.

Please attach these 2 files to your next reply.

Thank you.

.

Share this post


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.