How to recover files with size of 0 bytes [Win32.Drefir.E]

Hello,

I see you are hdd recovery experts so mayby you can help me too.
Worm Win32.Drefir.E set size of all files on my hdd to 0 bytes. If I connect this disk to other PC I can see all files and catalog structure but all files have size 0 bytes.
I tried few "standard" recovery programs but with no success because they can only receover deleted files:/

Do you now how to recover files with size set to 0 bytes?

I will be very appreciative of any help.

Greetings,
Smith

Sounds like the worm chewed into your File Allocation table.
Some tools out there can restore files only where they still have a full reference in the File Allocation table. You need to use a tool which can identify your files by header and perform a raw file recovery.

Some tools that come to mind are:

- Stellar Phoenix RAW File Recovery
- R-Studio
- Fast File Finder
- Easy Recovery Professional

Jst google for RAW File Recovery and you should find plenty of tools.
In most cases you can download a free demo to test before you purchase the software.

Virus description - http://www3.ca.com/securityadvisor/viru ... x?id=57208

You are not a first person who get this virus
And bad news are - "This worm also overwrites files. If the local system time is above 30 seconds and the date is the 29th of the month, this worm scans fixed and network drives and replaces all accessible files with zero-byte duplicate names."
In this case if files were fragment - you lost these files
Good luck!