"Cannot open the file because the file format or extension is invalid" opening Office files
UPDATE:
 |
Upon further analysis of the files that have been submitted to us for investigation, the analysts have determined that the files are encrypted with a private and public key. Unless the private key is available, the files will not be able to be recovered. The private key is more than likely held by the attacker.The premise of ransom ware such as this is that if a person pays the ransom, a key is provided to unlock the files. The best course of action is to clean up the malware and then restore files from a backup. |
We have identified the malware as a new family of ransomware
Definition Information:
The signatures are now updated. You should be able to use Safety Scanner to detect and clean it. It does NOT clean your documents, so you will want to restore from a backup after cleaning the malware from your system.
|
Latest public Endpoint AM defs: 1.157.1542.0 (Expect several hours later for 1.157.1559.0 or higher) 
More Information:
We are currently investigating an ongoing situation where users may encounter an error when trying to open Office documents.
The error can happen opening any Office file type, not just Excel files as shown in the image below. The error says:
"Cannot open the file ... because the file format or extension is not valid. Verify, that the file has not been corrupted and that the file extension matches the format of the file."
It's recommended you update the definitions in your antivirus software and run a complete scan of the affected machine(s).
When opening binary Word (.DOC) files that are attributed with this issue, Word does not know how to open, so you receive a dialog for File conversion as shown below.
We've had reports of it affecting Word documents, Excel files, PowerPoint files and Access databases.
Other Support Blog links
_____________________________________________________________________________
Microsoft Security Essentials https://www.microsoft.com/security/pc-security/mse.aspx
Comments
Anonymous
January 01, 2003
Any solution with this Cryptolocker yet? can we recover the files? have any tool from Microsoft to decrypt yet??? I do need the solution on this now... :(Anonymous
January 01, 2003
Unfortunately until you can clean up the affected machine, restoring from backup will become corrupt as you have described. We are still working with our security teams and hope to have a signature available soon to detect the malware. We will continue to update this blog as new information becomes available.Anonymous
January 01, 2003
If it happens completely randomly, does it happen more often to the same group of people? Perhaps an update malfunctioned?
Reinstall Office? Try XLSX Open File Tool for recovery your documents (http://www.xlsx.openfiletool.com/)Anonymous
January 01, 2003
Any solution with this Cryptolocker yet? can we recover the files? have any tool from Microsoft to decrypt yet??? :(Anonymous
January 01, 2003
Signatures Updated. See Update section in blog...Anonymous
January 01, 2003
go to
c:/user/appdata/roaming/microsoft/excel/xlstart
delete all excel filesAnonymous
September 09, 2013
The comment has been removedAnonymous
September 09, 2013
I have also run into the problem today. Restores seem futile and scans show nothing.Anonymous
September 10, 2013
Ran updated scan. It found nothing. Anyone else?Anonymous
September 10, 2013
I used security essentials after the update and was able to remove it. Stuck with a bunch of encrypted/corrupted files at the moment though :Anonymous
September 11, 2013
We're in the same boat with our file server. If anyone works on a decryption, please let me know!Anonymous
September 22, 2013
The comment has been removedAnonymous
October 02, 2013
We have a client that has no backup, pressures on!Anonymous
October 10, 2013
I have a client who started having the issue where they cannot open excel or word document that is store on the server. The network drive is mapped on users' computer. Whenever they try to open lets say spreadsheet, they get the same error as shown above under "More Information". When i restored the file from backup, it got corrupted again. However if i restored the backup by redirecting the location, it restored just fine and I was able to open it up just fine. I have not been able to isolate the location of corruption but this is really a pain. Any updates?Anonymous
October 17, 2013
Any news on this? I just had the same problem...Anonymous
October 17, 2013
Having the same issue here when opening Microsoft office extensions ending with x (eg. .docx, .xlsx) We are using the business version of 2013. Found a workaround to get these open by removing the x and using the old extension (eg. .doc, .xls) This is another nuisance in Microsoft's products and needs to be fixed. If you want us to be using this new format, you should have a fix for this! Hope this helps the ones the don't have a workaround yet. As for Microsoft, quit changing everything and just make sure it works, the amount of time and money we have spent troubleshooting these issues, we are going to start charging you for our time!Anonymous
November 15, 2013
Do we know how this exactly spreads?Anonymous
January 15, 2014
The comment has been removedAnonymous
January 21, 2014
Facing same problem on all office files and JEPG...Please let me know if get the solution anyone...Anonymous
January 28, 2014
I got the same problem as everyone in this forum. Like Sebastian, my pc is clean, but all my files are still encrypted or corrupted. I have tried so many decrypter but nothing is working. PDF, DOC, DOCX, XLS, XLSX are corrupted. Please if someone find a solution, write it down.Anonymous
January 28, 2014
The comment has been removedAnonymous
March 03, 2014
should we stop using Microsoft windows .more than 6 months with no solution only Microsoft can sale us bad product when it reach supports we will see them totally silent we will change our file server to linuxAnonymous
May 20, 2014
Please let us know if you found any solution we are affected
fadishaya@gmail.comAnonymous
May 20, 2014
Please let us know if you found any solution we are affected
fadishaya@gmail.comAnonymous
July 30, 2014
Try changing the file extension to older version eg. .pptx to .ppt .docx to .docAnonymous
September 02, 2014
The comment has been removedAnonymous
October 03, 2014
This problem spread world wide and still microsoft has no idea how to fix this?Anonymous
October 16, 2014
C:/User/Appdata/Roaming/microsoft/Excel/Xlstart
delete all excel fileAnonymous
December 04, 2014
still no luck guys?Anonymous
January 18, 2015
The comment has been removedAnonymous
January 20, 2015
The comment has been removedAnonymous
March 05, 2015
Firewall should protect from this no?Anonymous
March 10, 2015
i hope any one can fine any way to decrypt the files we need our files to be back as soon as possibleAnonymous
March 27, 2015
any one tell me please how to solve this problemAnonymous
April 05, 2015
"Cannot open the file ... because the file format or extension is not valid. Verify, that the file has not been corrupted and that the file extension matches the format of the file." when you transfer the file to other comp. same error message but files in the comp. can open without errorAnonymous
July 07, 2015
Has anyone for the solution for this problem. Any way to repair those damage files ? Thanks heapsAnonymous
July 27, 2015
excel file not open because of Kaspersky antivirus what is the problem?
sort it outAnonymous
October 06, 2015
open file with notepad++. search for ">" replace with ">" save as ".xmlAnonymous
January 26, 2016
Thank you Microsoft support team; you helped me clean my PC :)