Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Virus.. Cant open my word, excel.....

Created: 30 Aug 2014 • Updated: 03 Sep 2014 | 7 comments
This issue has been solved. See solution.

I have one computer that have been infected by a virus and when ever i open any forlder, i get i file in it that is called Decrypt-Instruction , 2 web file and one note file asking money to open the files, how can i detect if this virus is spread on othere system and will my symantic endpoint 12.1 detect it, i cant afford losing more files.

any update should i install or its auto.

I have attaeched the files that came and one execle sheet witht the error, if any one can help..

Thanks

Wael Hilal

<< Attachment File deleted - Mithun Sanghavi >>

Operating Systems:

Comments 7 CommentsJump to latest comment

James007's picture

I think it's new variants you can submit submission file symantec Security Response Team.But you can't recover that files

See some of mick2009 good articles

Recovering Ransomlocked Files Using Built-In Windows Tools

https://www-secure.symantec.com/connect/articles/recovering-ransomlocked-files-using-built-windows-tools

https://www-secure.symantec.com/connect/articles/day-after-necessary-steps-after-virus-outbreak

https://www-secure.symantec.com/connect/articles/two-reasons-why-ips-must-have-your-network

Additional information about Ransomware threats

Article:TECH211589  | Created: 2013-10-16  | Updated: 2014-01-09  | Article URL http://www.symantec.com/docs/TECH211589

See same issue related thread

https://www-secure.symantec.com/connect/forums/some-virus-has-corrupted-many-our-microsoft-office-files-and-pdf-files

.Brian's picture

Do you have a backup of your these files that were infected and/or your system? If not these are likely gone, however, this is a new site that just came up to possiblly recover files:

https://www.decryptcryptolocker.com/

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

AJ_01's picture

Have you check in add or remove program, is their any sw install with related this encryption?

Regard

AJ

Mick2009's picture

Hi waelhilal,

If the .rar file you have attached to this thread contains a suspicious/malicious file, please delete it immediately!  Today's malware has enough ways to spread.  It does not need the Connect forum as well.  &: )

The only way to get a sample to Security Response is through the official portals.  For details please see

Symantec Insider Tip: Successful Submissions!
https://www-secure.symantec.com/connect/articles/symantec-insider-tip-successful-submissions
 

Please do update this thread once you have submitted your undetected suspicious file and have a tracking number.

From your description it does sound like a cryptolocker / cryptowall type of infection.  Recovery from a known-good backup is the way to go.

With thanks and best regards,

Mick

With thanks and best regards,

Mick

Mick2009's picture

Hi waelhilal,

Just a ping to check if you submitted that file to Security Response?  Please do update this thread when time allows.

Many thanks,

Mick

With thanks and best regards,

Mick

waelhilal's picture

Hello, Thanks for the respond, actually i formated the system and my file are not opining in no way, well i think its gone already, but just want to ask you, syamtec already have this in control right ? thank God my other system are fine.

Yes i have already submited the Thread, i will update it now.

Thanks

Wael Hilal

Mobile: 00966531377132

SOLUTION
waelhilal's picture

Sorry for the late, i was out for internet connection 

Wael Hilal

Mobile: 00966531377132