help - unreadable files with same modified date

[Guest]

I recently tried to open a document and found that it was filled with symbols
looking like a 'y'. I finally determined that I had a large number of similar
documents (word, excell, jpegs, publisher files) that were all unreadable.
The file names are all ok (e.g. mydoc.doc for a word file).

1. They were scattered in many folders adjacent to readable files.
2. All unreadable files had the modified date of 05/01/2007 3:35 am (any
file with another date was readable; any file of any type with this date was
not).
3. The word documents of this type were unreadable with 'recovery' software
or word's own recovery system.
4. I have had continuously running and updated virus software with daily
'clean' scans.
5. I did a Dell diagnostics on the computer and their extensive hard disk
scan - no problems.
6. I do have online back up software but it, unfortunately, backed up the
corrupted files since they were "modified."
7. My windows event log doesn't show anything happening at the time of this
mass file modification.
8. Though the files (per word) have 1 character, their windows xp explorer
size is normal for the file type so I suspect that the contents are still
there.

Any ideas on what might have happened and how I can recover from this? Thanks!

 

[HeyBub]

I recently tried to open a document and found that it was filled with
symbols looking like a 'y'. I finally determined that I had a large
number of similar documents (word, excell, jpegs, publisher files)
that were all unreadable. The file names are all ok (e.g. mydoc.doc
for a word file).

1. They were scattered in many folders adjacent to readable files.
2. All unreadable files had the modified date of 05/01/2007 3:35 am
(any
file with another date was readable; any file of any type with this
date was not).
3. The word documents of this type were unreadable with 'recovery'
software or word's own recovery system.
4. I have had continuously running and updated virus software with
daily 'clean' scans.
5. I did a Dell diagnostics on the computer and their extensive hard
disk scan - no problems.
6. I do have online back up software but it, unfortunately, backed up
the corrupted files since they were "modified."
7. My windows event log doesn't show anything happening at the time
of this mass file modification.
8. Though the files (per word) have 1 character, their windows xp
explorer size is normal for the file type so I suspect that the
contents are still there.

Any ideas on what might have happened and how I can recover from
this? Thanks!

The "y" business is, I bet, the best rendition of a hex "FF", that is, all
bits on in a byte.

This is one method by which files are rendered unreadable, or "wiped." If
this is the case, some program has over-written every byte in the file with
a binary '1111 1111' to erradicate whatever information was there.

If this is the case, your only recourse is retrieval from a backup.

 

[Guest]

The "y" business is, I bet, the best rendition of a hex "FF", that is, all
bits on in a byte.

This is one method by which files are rendered unreadable, or "wiped." If
this is the case, some program has over-written every byte in the file with
a binary '1111 1111' to erradicate whatever information was there.

If this is the case, your only recourse is retrieval from a backup.

Unfortunately, I think you are right. I checked...the character, a y with an
two dots over it (umlot or something like that) has code '00FF' in the
Microsoft Word symbol table. Given I've had no indication of a virus (and
daily clean scans), I wonder what did this and how to prevent it from
happening again.

Thanks for your help!