File corruption

[bonalymac]

I have had some probs with my PC, with some malware.

Whilst it seems as if I have all the files on one hard disk intact, they appear not to be usable.

The text below shows the content of a text file titled

"We have now handled your order - Upgrade to 08.txt"​

The file name appears perfectly in Explorer, but when I open the text file in Notepad, this is what I see.

躥쓻ꃧ◎㷝⁗萡跻珔ݔ첗罔쐧媳賽㱃梴㘿ৄힵ寇궘릍圵◠�㮷鮥埦ꤵ㙰Ίၛ嗈鍠꼺於㉭ῢ〿㏁銯삆ﯶ묰ŷ鵐⅖멝뀖ᾎ첬咝솰吚稠旵᪕廕굿溗䐭䎚篭决ҥ던慪嫬풌柟ቇ뇮喇뿛萦䪲욻뎃愝荑弱䫐｀垲⾛ꙫ鏙錎뽻㵓汱餾ꂊ藪곸足ᩃ⵬⑁澴镺ꙥ淑튪笆햷䈻ˍ䟳夬࣑ꨈ뗂ᒊ넋 讻운狼进쉚挰鎹㵹饑½靣ﻢ랰죱Ӑ꫸੺ݛ컧浟ችꚌ菼厏랪迱侙⇗柴♔역繰ꐼ必퉳崿禹Ŭ끟᭴把奛ߓ䊝ꙝ샋淖䇷槍Ἐ빁ဟ텼咦뵼褱録沑߲̈́ꐈى蘑☛ﲦ离軋び떫䂱պ惲㜶敾ᒤ䡩ⱒᮬ拉珐빀℥얬㪤뗢䮃捩匌㼧豣꾰蚛귣훾盆㝯꼃ᾔ돡Ԍ⥻䣡Ф聅鮡坄蟍풬饎ࣖ鋓ᨸᯗ춟淹톫ﻉꭠ擷ݎ쨟赁ぱῙﱼ࣠了莽얓㉤ẝ핗狑磱짰甼䬉ㅳ瑼䊹넗꫋杏쪙駐謳辭婹뵷㿑鞀樺﫴땋秋ሻⲧ떘᧏떭禮Ἴ뛱拾瞻除辽炏뽏霴덌ﬗ삐涥詷ﶡ쩆䀟敝玓⿁ꅹ空먜患恂⨶ꈭ㢝䍒ȯ쐡ꈺꖎ췛飜欷⽫푘㔱⏷Ⳗ彰ﾮ䄝ࡧ낞曮櫹ǣ䗓﹒埨늗룼鿙㮼䤿絩ꓚ掶㷚㠹튛䂗ꑙׁ崆䚑홏앴⪢῝⎹⌗ໟ꒸甭固둁㜲ઈḝ㘏썻趍㉍寗曕궺➪븶뙿꟱゛褽釬雥귽䏭慇什흕ÄჁⶾꀻ덈횊觯퐐䬩䢐걠ଘ䇑ᴩᆋ洇忂쯦콪㼊ｦ㈨琇뇣그㰟ˀ밻筚陈죬ꤥ溤ᱯ飑糣浣倖⩧ᇥŃ蕥銠䊸ꅘ籙නѡ粅縭凵槤覈ㆈ樊≺串ꍝ탹莲ԙ帵ᴯ䘶䣌ế窦츑奔쇋ㄧ諭情욯轧盗ㅩ鱼櫾哞䯽ῄ徙쾬楀錋⠊烐赹쀤࣠䃹ઞ궞볾纣⏉탠횕≟ᤆᄼ᣹ꠚꧤ摎肬뿞ﭔ녁ꓒ玗箭譭㧽휌뮜⇌䖕易胍밯〼桖⇆赜ⶩ芗ⵐ惢䇖᫡ꂰ㘙앝ᕄⵤ돨淹粪虼ⴘࠋ⼏퉩渜뵕Ԩ艟⺹蹓෗⩆諞퉼磭㪜抹䉇螞ԅ璝䮤쇝缷Ⳏ❮⶘骯こ꥘뗨ꎇ⏣伓宆亏綹ì༑랢㮽㢽麟혌⽶훹Ꮄꁜ哽ᙚ烘մ降㖃锺晒䦺㢅胧ƪ磂붇保晷横쏌鮺슪⇼➫螄燁ᢧ䬼껯좟❸躥޵㡬靠좗㝩坞ⓞ⬎׷䵻䊺佢얂ἷ䙞誡橤ㅨ撩٘ﱢ敪↜᪵迖Ё鯵ᓭ堈왏昭咋㹢童竤寮탐덽煌担燹泻ᝳ姦ﻱ﫚넓頌泬ཾ湠펩⏨糟뱲펵ﱹ媰䈻ྗ梁㽦켂䆫컩䣱蜝鈜櫱ퟣ騻쮻኏畠풧☭퐣ᳮ荗ꡍ暑袨긑俷憪ㇵ矢Ჿ轖헆﻾땁㏱긫謆觰␉쌖峲ꙁ礵纂塚멫䖓�ﺏ憺锱檨쫟蠰梅ၭ넪ᖛ蒿ቯ嶣拾铰ቬ쵣﹍⩕䂴ᇒ砎鰙扲ꫣ䑷𥉉짭橱憉鈥⿊ףּ챰묟彰鸭祁魾捺虽�∧뀙

I live in the UK, and English is the only language installed on the PC, which has now been completely re-installed from a clean disk.

Notepad works fine with files from other Hdd's on the PC. The same file read on another PC also shows the same corrupted content, so the file contents seem to have been overwritten somehow.

I'm guessing that the disk contents are hosed (CHKDSK, Manufacturers utility and SMART tests tell me the disk is fine), so my prob seems to be with data, not the physical disk.

I have back-ups for the bulk of the contents, but as always, about 10% is probably not backed up. But before I re-format, I though I'd just ask the experts to see if there is anything that might rescue the contents.

Thanks

Colin

 

[tom982]

Hello Colin and welcome to the forums

First of all we need to make sure that there is no malware left on your system:

1. Download and install Malwarebytes Anti-Malware and run a full scan:

Download MalwareBytes'

Attach the log with your next post


2. Download and run DDS:
http://forums.whatthetech.com/index.php?autocom=downloads&req=download&code=confirm_download&id=16
Download DDS

This will then open two text files (dds.txt and attach.txt) which you will need to upload with your next post.


Let me know how this goes, and upload all 3 text files with your next post please

Tom

 

[bonalymac]

Hi Tom

Colin here in Edinburgh. Thanks for your help.

I've attached all three files as requested

Colin

 

[tom982]

Hello Colin,

Everything (well on the malware front) seems in order which is brilliant.

Now that we've cleared that up, we need to sort out your problem. Can you do this for me please:

SFC Scan:

1. Open the start menu
2. In the search box, type cmd
3. Right click on command prompt and select Run as administrator
4. In command prompt, type:

sfc /scannow

5. Let it run and let me know if it finds any Integrity Violations




Tom

 

[richc46]

Per Toms sage advice
http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html

 

[bonalymac]

sfc /scannow

5. Let it run and let me know if it finds any Integrity Violations

Tom

It just run and did not find any integrity violations

 

[tom982]

Ok, can you do the following for me please:

1. Open the start menu
2. In the search box, type Notepad and run it
3. Click File > Open...
4. This will then open up a dialogue box as shown below

As you can see, I have put a box around the Encoding menu, mine says ANSI but what does yours say?

Tom

 

[bonalymac]

Mine says ANSI as well.

Colin

 

[tom982]

Would you mind sending me the text file please? If it contains any sensitive material then I can try and make do without it

Tom

 

[bonalymac]

Hi Tom

The attached file should show the problem. As far as I can see,there are over 130 txt files on this disk, many with receipts for purchased software - all are corrupt!

This one should be just plain text.

The exe files (lots of downloaded shareware etc) do not run. I usually get a flash of a DOS window, then nothing. As I now have a clean PC, I'm reluctant to run anything on these now, but I have a few licences missing from html and text files, but I can live without them.

I also have a load of tutorial videos and sample images for photoshop. The images won't open, the vids won't play. I didn't bother backing this up either!

So I'm pretty sure the data is wasted, and not worth wasting more time on.

Colin

 

[tom982]

Hi Tom

The attached file should show the problem. As far as I can see,there are over 130 txt files on this disk, many with receipts for purchased software - all are corrupt!

This one should be just plain text.

The exe files (lots of downloaded shareware etc) do not run. I usually get a flash of a DOS window, then nothing. As I now have a clean PC, I'm reluctant to run anything on these now, but I have a few licences missing from html and text files, but I can live without them.

I also have a load of tutorial videos and sample images for photoshop. The images won't open, the vids won't play. I didn't bother backing this up either!

So I'm pretty sure the data is wasted, and not worth wasting more time on.

Colin

I was hoping that it was a problem with your computer reading the files, but I'm sorry to say that now I think that the data is corrupted.

Unless anyone has any other suggestions, I don't think that you will be able to get this data back without spending a lot of money on data recovery services.

I'm sorry that I couldn't have been more helpful,

Tom

 

[richc46]

The best the membership at the forum can do is offer the potentially correct advice based on the information given. That being said here is my take
Restore .EXE File Association in Windows 7/Vista After Incorrectly Associating it With Another Program - The Winhelponline Blog
The above appears to be your problem
I DO NOT suggest that you make the registry changes suggested, but rather use System Restore to go back a week before the problem began.
System Restore should not touch your personal stuff, only the OS should be changed.
System Restore - How to

If that does not work, I will get you our tutorial on Associations.

.txt association may have to be changed.

 

[tom982]

The best the membership at the forum can do is offer the potentially correct advice based on the information given. That being said here is my take
Restore .EXE File Association in Windows 7/Vista After Incorrectly Associating it With Another Program - The Winhelponline Blog
The above appears to be your problem
I DO NOT suggest that you make the registry changes suggested, but rather use System Restore to go back a week before the problem began.
System Restore should not touch your personal stuff, only the OS should be changed.
System Restore - How to

If that does not work, I will get you our tutorial on Associations.

.txt association may have to be changed.

Thanks for your help Rich

I did consider advising a system restore, but it appears to be a problem with the files themselves doesn't it? That's why I asked the OP to upload the text file and it comes up with the chinese writing for me aswell which makes me think that the file is bust, not the os.

I'm sorry if that sounds rude, trust me I didn't mean it to, I am just trying to learn from someone who is more experienced than me

Tom

 

[richc46]

I agree, but you went that route
So time for a different road.
I also mentioned changing associations if necessary.
Lets wait and see what happens.

 

[bonalymac]

I think it's time to darw a line under the problem, for a couple of reasons

When I first posted, the problem, it was exacerbated by the fact that I had a Trojan infection as well which may or may not have had anything to do with the problem. I was strongly advised to wipe the disk and re-install. This was advice I agreed with (although I knew nothing about the trojan side of things) and I accepted that advice quite happily.

So at that stage, I lost any restore options.

I also said that other txt files and exe files ran perefctly on the infected PC, and that the "bad" files still were bad files on a different/clean pc.

I'm very grateful for everyone's input. I think that now, the offending disk will be formatted by the manufacturers software, and then I'll test it before deciding whether to use it. It does pass all SMART and similar tests currently, so I don't think hardware has anything to do with it.

90% of the data was backed up the rest will be down to experience. I already am a regular backer up of really important files. I have my own batch files running every night, which is why I have so many physical disks. I have to think about increasing the extent of that.

So thanks again to everyone.

Colin