Login

**Partha** · (This post was last modified: 09-03-2016, 12:20 PM by Partha.)

(09-03-2016, 09:39 AM)george759 Wrote: i MEAN THAT THE NEWLY CREATED DATA (ON THE CD AND MORE SPECIFICALLY IN THE DIRECTORY 'AMA', ie D:\AMA
WILL BE DRAGGED AND DROPPED INTO ZEMANA IN ORDER TO BE CHECKED.
AFTER THAT AND IF ZEMANA'S CHECK, HAS BEEN CONCLUDED SUCCESSFULLY , THE CONTENT OF THIS CD (D:\AMA\*.*) ARE THEY SAFE TO BE OPENED ??

I understand now. Yes, you can either drag the contents and drop them into Zemana or you could simply right click the directory, and select "Scan with Zemana"

If Zemana does not detect any file, the folder should be safe to access

***Britec*** · 09-03-2016, 03:23 PM

This is your starting post question.

Quote:Here is my problem.

In the beginning of Nov 11, 2015, my motebook got somehow infected ( although I am very careful and I had installed an antivirus) form the CRYPTOWALL 3.0 Ransomware.
The ' funny ' thing was, that at that time, since I did not know that I was hit by this virus, I made a copy of some xlsx and accb files - that I used to work on them for over 4 years - to a usb stick as a backup. Unfortunately I backed up the infected files.
The notebook was eventually reformated. but the things I want to know is, if I can do anything with the usb stick - which I keep in tact -., in order to retrieve these files.
Is it dangerous if these usb stick files are transferred somewhere else ?
What about if these are written to a CD ?
There are some companies listed in the internet as Data Recovery Company. Do you beleive it is a lost cause ?
Thanks for your help and your assistance

I think we have answered all of these questions. The data you had on your USB drive seems to open OK and is not encrypted. Is there anything else we can help you with or can we close this thread and call it solved?

**george759** · 09-03-2016, 03:36 PM

(09-03-2016, 03:23 PM)Britec Wrote: This is your starting post question.

Quote:Here is my problem.

In the beginning of Nov 11, 2015, my motebook got somehow infected ( although I am very careful and I had installed an antivirus) form the CRYPTOWALL 3.0 Ransomware.
The ' funny ' thing was, that at that time, since I did not know that I was hit by this virus, I made a copy of some xlsx and accb files - that I used to work on them for over 4 years - to a usb stick as a backup. Unfortunately I backed up the infected files.
The notebook was eventually reformated. but the things I want to know is, if I can do anything with the usb stick - which I keep in tact -., in order to retrieve these files.
Is it dangerous if these usb stick files are transferred somewhere else ?
What about if these are written to a CD ?
There are some companies listed in the internet as Data Recovery Company. Do you beleive it is a lost cause ?
Thanks for your help and your assistance

I think we have answered all of these questions. The data you had on your USB drive seems to open OK and is not encrypted. Is there anything else we can help you with or can we close this thread and call it solved?

AT FIRST THANKS VERY MUCH FOR YOUR HOSPITALITY.
I AM NOW IN THE MIDDLE OF RUNNING THE Eaus PROGRAM. IT IS TAKING ABOUT 90 MINS FOR 2/3 OF ABOUT 42 MB. i WILL HAVE THE RESULTS VERY SOON.
MEANWHILE KINDLY KEEP THE THREAD OPEN UNTIL THEN. THE DECISION WHETHER MY USB DATA ARE 'OPENABLE' HAS NOT BEEN DETERMINED. THIS I BELIEVE CAN BE CONFIRMED ALSO BY PARTHA.

**Partha** · (This post was last modified: 09-03-2016, 04:00 PM by Partha.)

(09-03-2016, 03:36 PM)george759 Wrote: AT FIRST THANKS VERY MUCH FOR YOUR HOSPITALITY.
I AM NOW IN THE MIDDLE OF RUNNING THE Eaus PROGRAM. IT IS TAKING ABOUT 90 MINS FOR 2/3 OF ABOUT 42 MB. i WILL HAVE THE RESULTS VERY SOON.
MEANWHILE KINDLY KEEP THE THREAD OPEN UNTIL THEN. THE DECISION WHETHER MY USB DATA ARE 'OPENABLE' HAS NOT BEEN DETERMINED. THIS I BELIEVE CAN BE CONFIRMED ALSO BY PARTHA.

I've already advised you that there are ways to recover just the text from the Word documents, and that we can try to help you with that if you are interested.

I didn't hear back from you with respect to that.

**george759** · 09-03-2016, 11:14 PM

(09-03-2016, 03:52 PM)Partha Wrote:
(09-03-2016, 03:36 PM)george759 Wrote: AT FIRST THANKS VERY MUCH FOR YOUR HOSPITALITY.
I AM NOW IN THE MIDDLE OF RUNNING THE Eaus PROGRAM. IT IS TAKING ABOUT 90 MINS FOR 2/3 OF ABOUT 42 MB. i WILL HAVE THE RESULTS VERY SOON.
MEANWHILE KINDLY KEEP THE THREAD OPEN UNTIL THEN. THE DECISION WHETHER MY USB DATA ARE 'OPENABLE' HAS NOT BEEN DETERMINED. THIS I BELIEVE CAN BE CONFIRMED ALSO BY PARTHA.

I've already advised you that there are ways to recover just the text from the Word documents, and that we can try to help you with that if you are interested.

I didn't hear back from you with respect to that.

Well here are the results.
I ran the EaseUS program with output set to a new CD into a directory 'AMA". it took about 2 -2.5 Hours.
I scanned the resulted directory. There was nothing suspicious found.

The 'AMADEUS' directory it was 41.6 MB and had 84 files and 6 directories.
The 'AMA' directory it was 36.1 MB and had 64 files and 6 directories.

Trying to open the aacdb file, Result was negative --- Unrecognizable data format.

Trying to open the docx file, Result was negative with Word, with WPS it was opening the file, but with weird characters, about 3 lines per page, and many pages.

Trying to open the xlsx file, Result was negative with Excel but WPS it was opening the file, but with strange characters, making no sense, many lines, no columns indicated (it was the first time, these xlsx files were managed to be opened).

As I told you last time, my main-main concern was this accdb file.

The word files (I think there is only one file of some interest for - it is the manual for the company -, but because somehow I was lucky enough, I got a print out just before the infection took place. I believe it is very logical not to pursue your kind help for trying to open this file.

Now as far the xlsx files is concerned, I do not if you can assist me further. Please tell me .
If you want, I could send you to your e-mail, one xlsx file for you to check, otherwise no problem.

As a conclusion< I think all of us agree, that CRYPTOWALL did its 'job', and we cannot retrieve our files.

Again many thanks to you and to Brian.

***Britec*** · 09-04-2016, 01:11 AM

You might want to try this program to repair data base https://www.stellarinfo.com/access-database-repair.php

Repairs corrupt MDB or ACCDB database files
Restores tables, queries, indexes, and relations
Supports Linked tables and calculated data type
Retrieves password-protected forms and modules
Restores all objects including deleted records to a new database

**Partha** · (This post was last modified: 09-04-2016, 05:49 AM by Partha.)

You are welcome, and yes, after all that we have tried and tested till now, we can say that the files are corrupt. I don't see the point in you sending me the file

Like Brian suggested, you can try that program by Stellar to repair the access file and if that does not work, you can try Access Repair Toolbox

Its trial can be downloaded from https://www.repairtoolbox.com/accessrepair.html

I think the takeaway from this would be that we should be careful at all times and exercise extreme caution whenever in doubt

**george759** · 09-04-2016, 07:02 AM

(09-04-2016, 05:08 AM)Partha Wrote: You are welcome, and yes, after all that we have tried and tested till now, we can say that the files are corrupt. I don't see the point in you sending me the file

Like Brian suggested, you can try that program by Stellar to repair the access file and if that does not work, you can try Access Repair Toolbox

Its trial can be downloaded from https://www.repairtoolbox.com/accessrepair.html

I think the takeaway from this would be that we should be careful at all times and exercise extreme caution whenever in doubt

I ran the Stellar app. it looks as a very good app.
When selecting a non-infected file, it runs great.
When selecting the infected in question file(s), it responds with ' This is not a valid MS file ' .
I send an e-mail to Stellar regarding this and I am expecting a response from them regarding this problem/

I ran the Access Repair Toolbox, with no result.

**Partha** · (This post was last modified: 09-04-2016, 07:27 AM by Partha.)

Okay, that is nice to know and by the way, what exactly did you mean by "no result"? Did it fail with any particular message?

you may also write to their tech support at tech.support@repairtoolbox.com or send a feedback via https://www.repairtoolbox.com/support.html

**george759** · 09-04-2016, 07:42 AM

(09-04-2016, 07:11 AM)Partha Wrote: Okay, that is nice to know and by the way, what exactly did you mean by "no result"? Did it fail with any particular message?

you may also write to their tech support at tech.support@repairtoolbox.com or send a feedback via https://www.repairtoolbox.com/support.html

No, it did not fail in a general aspect.
Look both Stellar and the Toolbox are downloaded as Demo, which mean that when run in this mode, they create some preview of the file. If what you see, is something that looks close to the specs of your file, e.g it has so many tables, queries ,their names etc, then in order to get this restoring, you must purchase the app.

As far as the Stellar is concerned, I did not reach the point of preview.
As far as the Toolbox is concerned, I reached the point of preview, but its content was some degenerate table, with almost everything zeroed. So, it was not of my interest.