Dealing with the obnoxious PianoMan virus

Garikai Dzoma Avatar


I treat all my computers with the same respect a horse racer would treat his horse, the same way a Tour de France contestant would treat his bike and an astronaut his telescope. Some people however do things differently, to them a computer is just a toy.

My cousin Sue is one of them. After borrowing my computer for the weekend, officially so she could do her homework, she never bothered to update the antivirus, plugged in any USB memory stick she could find and clicked on all the wrong links.

The inevitable happened and the machine became infected by a virus. This was not one of those stealthy crafty Russian creations that lie in wait so it can steal your banking details or turn your computer into part of a herd.

This was a conspicuous virus that corrupted all Office Documents and appended the words “PianoManCorrupt” to every infected file’s name. Now her 15 page college report was ruined and this was the apocalypse-the very end of the world! Oh why was life unfair to her? I know what you are thinking: classic Narcissism meets Borderline Personality Disorder.

Anyway after receiving my beloved laptop and scouring the internet for a solution which I am happy to share here with you, I was finally able to recover the document. I wish I could say it was worth the effort but my cousin is not the world’s most brightest scholar. Most importantly I was able to fix my beloved laptop and rid it of the offending virus.

  • First you need to update your antivirus and perform a complete scan of your system
  • I have always been contemptuous of the inbuilt Windows Defender, if this is your preferred antivirus then for the purposes of this clean up exercise you need to download Sophos Virus Removal tool, Eset Rogue Application Remover and Microsoft’s Malicious Software Removal Tool. Launch and scan using each of these tools to completely remove the malware and any leftovers from your computer.
  • For any of these tools select the delete option to get rid of the malware instead of the quarantine option.
  • The above steps will not bring back your files, they merely remove the software. To recovery the corrupted files download the Data Recovery Tool here. Obviously you will need to select the PianoMan fixer.
  • Extract the Zip file and install the fixer.
  • Click on the batch processing button and select the folder which contains the corrupted files.
  • Once the process has completed open the recovered files to confirm that they have been correctly recovered. If so, type PianoMan in the Explorer search box and delete all the corrupted files.

NB I recommend putting all the office documents in their own folder and syncing them to Google Documents thus averting these types of catastrophes from happening to you. Today it might PianoMan and tomorrow it might be CryptoLocker or some other non recoverable virus.

Image Credit: DreamsTime

Source Credit: Malware Fixes

A special thanks to the guys at Viral Suppressor for providing a local fix for this virus.


  1. an0n

    Well, seems to me, your computer isnt as precious as you claim. That’s a very old virus(2013). You were out of date and did not have enough protection by way of software. My advice to you, every year read antivirus reviews for both commercial and non-commercial antivirus. There are usually the top 5 who are never unseated but every year the new virus engine releases puts one on top of the other.
    You dont love your computer at all

    1. Garikai

      Oh, I am always up-to-date. The problem is that it seems these virus looks domestic and seems to have eluded the folks at Avira labs. It also seems curious that the only data recovery software that I could find was local.

      1. unsung hero

        I agree with an0n but what I noticed with you Mr Garikai (with all due respect sir) is you did the unknown mistake of going to to Avira…. nothing against Avira dude but from my experience Avira is a bit behind in updating virus definitions. I had Avira Internet Security on my laptop and AVG Internet Security (my trusted friend for the past 5 years) on my desktop both fully updated. Guess what happened? Avira got attacked by pianoman but AVG was there for me as always.

        1. Farai

          How far behind was GZ when he got infected with a 2013 virus? I doubt it is definitions but I believe this virus got through somehow. I use Microsoft Security Essentials on all my home computers. Works wonders!

          Also way back in the days of Windows 95/98 and DOS software, I supported Pastel V4, the DOS version on Windows 98. One day the “server” got hit by some boot sector virus. Me being trying to be clever started a scan with Dr Solomons. In less than 5 minutes, the drive was gone. The virus destroyed the MBR and all files including Pastel were gone! Back then one could say anything technical to the bosses as to why it happened but nobody was happy over the loss of their accounts.

  2. The King

    I wish you had used the locally developed solution. I’m not sure if you are aware of it

  3. EC

    Are Android phones susceptible to viruses?

    1. Farai

      I think to malware not viruses.

  4. mwana wevhu

    You these guys who apparently developed the solution to pianoman are the creators of the virus which spread around compasses a year or two ago. It should not surprise you then to find that the solution is found only here. One question, where else in the world did the piano man virus hit except here in Zim?

    1. Tawanda

      It was made locally, but i didnt make it. Just studied the files and figured out how it was corrupting then just made a reversal. A FREE one!