"Cannot open the file because the file format or extension is invalid" opening Office files

 

 UPDATE:

We have identified the malware as a new family of ransomware Infection: Trojan:Win32/Bumat!rts AVSubmit Detectable with AM definitions version:  1.157.1559.0 or laterhttps://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3aWin32%2fBumat%21rts&ThreatID=-2147341227   Infection: Trojan:Win32/Crilock.A.  Detectable with AM definitions version:  1.157.1542.0 or laterhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fCrilock.A   Definition Information:     Latest public Endpoint AM defs:  1.157.1542.0 (Expect several hours later for 1.157.1559.0 or higher)      https://www.microsoft.com/security/portal/definitions/whatsnew.aspx     Latest Prerelease AM defs: 1.157.1542.0 (Expect several hours later for 1.157.1559.0 or higher)      https://www.microsoft.com/security/portal/shared/prereleasesignatures.aspx The signatures are now updated. You should be able to use Safety Scanner to detect and clean it. It does NOT clean your documents, so you will want to restore from a backup after cleaning the malware from your system. Microsoft Safety Scanner https://www.microsoft.com/security/scanner/en-us/default.aspx

---

---

 

Upon further analysis of the files that have been submitted to us for investigation, the analysts have determined that the files are encrypted with a private and public key. Unless the private key is available, the files will not be able to be recovered. The private key is more than likely held by the attacker.The premise of ransom ware such as this is that if a person pays the ransom, a key is provided to unlock the files. The best course of action is to clean up the malware and then restore files from a backup.

 

More Information:

 

We are currently investigating an ongoing situation where users may encounter an error when trying to open Office documents.

The error can happen opening any Office file type, not just Excel files as shown in the image below. The error says:

"Cannot open the file ... because the file format or extension is not valid. Verify, that the file has not been corrupted and that the file extension matches the format of the file."

 

With PowerPoint binary files (.PPT) , you will see a dialog similar to the following screenshot. We don't have OOXML samples yet but will post images once we have these.

 

---

 

Other Support Blog links

• Excel
  https://blogs.technet.com/b/the_microsoft_excel_support_team_blog/archive/2013/09/07/quot-cannot-open-the-file-because-the-file-format-or-extension-is-invalid-quot-opening-office-files.aspx

 

• Word
  https://blogs.technet.com/b/wordonenotesupport/archive/2013/09/09/quot-cannot-open-the-file-because-the-file-format-or-extension-is-invalid-quot-opening-office-files.aspx

 

_____________________________________________________________________________

 Microsoft Security Essentials  https://www.microsoft.com/security/pc-security/mse.aspx

Comments

• Anonymous
  January 01, 2003
  Signatures Updated. See Update section in blog...

• Anonymous
  January 01, 2003
  Yes. Security Essentials should have these definitions. Just make sure your definition version matches the ones listed in the Updated section.

• Anonymous
  September 09, 2013
  It also is affecting Powerpoint

• Anonymous
  September 10, 2013
  Will Security Essentials be updated with these definitions?

• Anonymous
  October 24, 2013
  What about the files? once the ransomeware removed, will we be able to reopen them?

• Anonymous
  April 05, 2015
  "Excel cannot open the file 'data.xlsx' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file." ,, only this file others are okay,,,