Answer

XLS, XLSX and CryptoLocker Virus

Mike Azar

10y

1.2k

One of our clients got infected by the "CryptoLocker Virus". Thousants of XLS, XLSX, PDF and DBF files were encrypted. We have restored from tape backups but some of the new files that were created after tape backup are still corrupted. I need to identify which files.

I created a c# form to loop thru all xls, xlsx files and try to open each one at the time to identify the corrupted ones but it is not working. What am I doing wrong?

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.IO;
using System.Collections;
using Microsoft.Office.Interop.Excel;

namespace MssFileValidator
{

    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
            textBox1.Text = @"c:\temp\cbb";
        }

        private void button1_Click(object sender, EventArgs e)
        {
            richTextBox1.Text = "";
            richTextBox2.Text = "";

            var exApp = new Microsoft.Office.Interop.Excel.Application();
            //exApp.Visible = true;

            string sDir = textBox1.Text;
            string sFilter = @"*.xls";

            //richTextBox1.Text = richTextBox1.Text + "---- Directory:" + d + Environment.NewLine;
            //Directory.GetFiles(textBox1.Text, "*.xls", SearchOption.AllDirectories).ToList()
            foreach (string f in Directory.GetFiles(sDir, sFilter, SearchOption.AllDirectories))
            {
                var spreadsheetLocation = Path.Combine(Directory.GetCurrentDirectory(), f);
                this.Text = spreadsheetLocation;

                //richTextBox1.Text = richTextBox1.Text + spreadsheetLocation + Environment.NewLine;

                try
                {
                    var exWbk = exApp.Workbooks.Open(f);

                    //            ,0, true, 5, "", "", true, "xlWindows", "\t", false, false, 0, true, 1, 0);
                    //var exWks = (Microsoft.Office.Interop.Excel.Worksheet)exWbk.Sheets["Sheet1"];
                    //exWbk.Close(false);
                    exApp.ActiveWorkbook.Close(false);

                    richTextBox1.Text = richTextBox1.Text + f + Environment.NewLine;
                }
                catch (Exception)
                {

                    richTextBox2.Text = richTextBox2.Text + f.Trim() + Environment.NewLine;

                }

            }
            //DirSearch(d);

            //exApp.Quit();
        }

        private void button2_Click(object sender, EventArgs e)
        {
            FolderBrowserDialog folderDlg = new FolderBrowserDialog();

            folderDlg.ShowNewFolderButton = true;

            // Show the FolderBrowserDialog.

            DialogResult result = folderDlg.ShowDialog();

            if (result == DialogResult.OK)
            {

                textBox1.Text = folderDlg.SelectedPath;

                Environment.SpecialFolder root = folderDlg.RootFolder;

            }
        }

    }
}