Something deleted the contents of the files in at least one directory

[Edward]

I have two Sata Seagate drives in a RAID Mirror configuration. In one
directory in which I store all of my Microsoft Word files and older
WordPerfect files, the file names are intact, but the files are empty.
If I open one in Word, it is blank. They show as zero kb. Some zipped
files of WordPerfect files are also empty. Is this a virus? Can I
recover them somehow? Any help?

 

[Eric Gisin]

Yes, there is a virus that does this. What did your anti-virus scan report?

 

[Edward]

I use Norton 2005 antivirus, and it did not detect anything.

 

[Edward]

I should also have mentioned that I periodically backup my important
files to another hard drive in my computer, and those Word files appear
to be fine. If I do have a virus, it only infected my C drive. Is that
possible?

 

[Zvi Netiv]

I have two Sata Seagate drives in a RAID Mirror configuration. In one
directory in which I store all of my Microsoft Word files and older
WordPerfect files, the file names are intact, but the files are empty.
If I open one in Word, it is blank. They show as zero kb. Some zipped
files of WordPerfect files are also empty. Is this a virus? Can I
recover them somehow? Any help?

There's a family of VB script malware (Love Letter was the most known) that did
that. When active, the worm would sweep through all write-enabled drives across
the network, "open" for writing every DOC (and JPG) file then close it, actually
converting these files to 0 byte length files.

In FAT partitions, some of the files could be recovered on the following
conditions:

a. The drive use was stopped immediately after the incident to prevent the OS
from writing to the space that was deallocated by the decapitated files.

b. Only contiguous files at the time of disaster could be recovered.

VB script viruses are rather old and are rarely seen these days. From your
description, seems that your archives date from long ago, when these viruses
were still common.

Regards, Zvi

 

[Edward]

Thanks for the response, but many of the files are new; also, Word and
WordPerfect files on another hard drive are fine.

 

[Edward]

Three anti-virus programs did not find anything (Norton 2005, AVG, and
McAfee online scan. After that post I found that pdf files in the same
directory were also empty. And strangely, the only password protected
file in that directory was intact; it was the ONLY file that was intact.

 

[JohnZ]

Edward,

Did you ever figure this out???

I am encountering the same problem with a system (XP Home w/SP2,
running Norton Internet Security 2005).

Scanned with multiple anti-virus & anti-spyware programs but
didn't turn up ANYTHING. Yet the files continue to go to zero
bytes.

Any ideas?

Thanks!

John -Z-

Three anti-virus programs did not find anything (Norton 2005, AVG, and
McAfee online scan. After that post I found that pdf files in the same
directory were also empty. And strangely, the only password protected
file in that directory was intact; it was the ONLY file that was

intact. [/b]

 

[Edward]

No, I didn't. I never found a virus or spyware. I formatted my drive
and started over.

Edward,

Did you ever figure this out???

I am encountering the same problem with a system (XP Home w/SP2,
running Norton Internet Security 2005).

Scanned with multiple anti-virus & anti-spyware programs but
didn't turn up ANYTHING. Yet the files continue to go to zero
bytes.

Any ideas?

Thanks!

John -Z-

Three anti-virus programs did not find anything (Norton 2005, AVG,
and

McAfee online scan. After that post I found that pdf files in the
same

directory were also empty. And strangely, the only password
protected

file in that directory was intact; it was the ONLY file that was

intact. [/b]