OT: Probable virus deleted the content of my Microsoft Word andWordPerfect files.

[Edward]

Ok, I know this is off topic, but I haven't gotten any answers anywhere
else. I have a P4P800-e, running RAID mirror with two Seagate 80 gig
SATA drives, and a Seagate ATA 160 as a backup drive.

Yesterday morning I tried to open a Word file and the file came up
blank. All of the file names are intact, they're just empty. I have
one file that is password protected, and it is fine. So far it appears
that the only files affected are/were in the directory (and
subdirectories) I have designated in Microsoft Word as my document
directory on my C drive. The same files on my backup hard drive are fine.

I don't think I lost much, because I had backed up everything recently.

The problem is, I can't find a virus to remove. I use Norton Antivirus
2005. I have scanned twice with it, once with McAfee, and once with
AVG. They have not found any viruses.

Thank you very much for any help.

 

[MrGrumpy]

Are you saying *all* files in My Documents are empty,
or that *all* *.doc files are empty?

 

[Edward]

One pdf file is intact, and one Microsoft Word password protected file
is intact. That's all out of 1069 files. If it matters, they are in a
directory I created, not the My Documents directory. Thanks.

 

[JohnR]

One pdf file is intact, and one Microsoft Word password protected file
is intact. That's all out of 1069 files. If it matters, they are in a
directory I created, not the My Documents directory. Thanks.

If possible copy them onto a CD and try to view them on another virus
protected PC with ms word, see if it works. I have no idea what could have
caused it though, sorry.

 

[MrGrumpy]

When you say they are empty do you mean in Explorer they are shown as 0kb or
do you mean empty if opened in Word.?
If empty in when opened in Word; I believe MS has a free Word viewer try
viewing a doc in that.

 

[Edward]

Both. In Explorer they are shown as 0kb, and in Microsoft Word, they
are blank. Thanks again for your help.

 

[MrGrumpy]

Word virus's are usually macro viri which should be detected by any decent
AV app.
The only thing similar I have seen was on a sys where a number of files had
there dos name changed, rendering them 'unopenable' it was simple, if
tedious, to rename them to origonal name.
eg somename.* became _xyzename.*
The Kaspersky AV app has a good reputation, you might try there for an
online scan

 

[Edward]

Thanks. I'll download the Kaspersky AV trial and scan my system. I
appreciate your suggestions.

 

[Jay T. Blocksom]

[Due to the utter mess repeated bass-ackwards upside-down top-posting has made
out of this thread, the following attributions may be screwed up; but with
luck, you'll get the gist...]

Ok, I know this is off topic, but I haven't gotten any answers anywhere
else. I have a P4P800-e, running RAID mirror with two Seagate 80 gig
SATA drives, and a Seagate ATA 160 as a backup drive.

Yesterday morning I tried to open a Word file and the file came up
blank. All of the file names are intact, they're just empty. [snip]
The problem is, I can't find a virus to remove. I use Norton Antivirus
2005. I have scanned twice with it, once with McAfee, and once with
AVG. They have not found any viruses.

[snip]

Well, you've picked the two *worst* possible choices in AV programs; but in
this particular case, that's probably a moot point, because...

[snip]
Both. In Explorer they are shown as 0kb, and in Microsoft Word, they
are blank. Thanks again for your help.

[snip]

At first blush anyway, this doesn't sound like a virus to me. You never
mentioned what version of Windows you're running; but especially if it is
DOS-based (i.e., Win9x/Me), the symptoms you report sound very much like a
badly "repaired" corrupted FAT -- IOW, the directory entries are still there,
but they point to empty allocation blocks on the disk; and at some point, some
brainless "auto-fix-it" utility (like ScanDisk, perhaps?) attempted to resolve
that contradiction by setting the filesizes in the directory entries to zero.

Hence, you need to take a very close look at the health of your filesystem,
and the system in general.

And finally...

Usenet Hygiene - Dave Learns All About Top-Posting
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Dave: Oh! Now it makes sense to me. Okay!
No more top-posting for me!

Bob: It's annoying because it reverses the
normal order of conversation. In fact,
many people ignore top-posted articles.

Dave: What's so wrong with that?

Bob: That's posting your response *before*
the article you're quoting.

Dave: People keep bugging me about "top-posting."
What does that mean?

[The preceding educational opportunity was provided by Adam Brower.]


A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet?

<http://linux.sgms-centre.com/misc/netiquette.php>


--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet02[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this domain is expressly prohibited under
47 USC S227 and State Law. Violators are subject to prosecution.

 

[Edward]

[Due to the utter mess repeated bass-ackwards upside-down top-posting has made
out of this thread, the following attributions may be screwed up; but with
luck, you'll get the gist...]

Ok, I know this is off topic, but I haven't gotten any answers anywhere
else. I have a P4P800-e, running RAID mirror with two Seagate 80 gig
SATA drives, and a Seagate ATA 160 as a backup drive.

Yesterday morning I tried to open a Word file and the file came up
blank. All of the file names are intact, they're just empty. [snip]
The problem is, I can't find a virus to remove. I use Norton Antivirus
2005. I have scanned twice with it, once with McAfee, and once with
AVG. They have not found any viruses.

[snip]

Well, you've picked the two *worst* possible choices in AV programs; but in
this particular case, that's probably a moot point, because...

MrGrumpy wrote:

Are you saying *all* files in My Documents are empty,
or that *all* *.doc files are empty?

[snip]
Both. In Explorer they are shown as 0kb, and in Microsoft Word, they
are blank. Thanks again for your help.

[snip]

At first blush anyway, this doesn't sound like a virus to me. You never
mentioned what version of Windows you're running; but especially if it is
DOS-based (i.e., Win9x/Me), the symptoms you report sound very much like a
badly "repaired" corrupted FAT -- IOW, the directory entries are still there,
but they point to empty allocation blocks on the disk; and at some point, some
brainless "auto-fix-it" utility (like ScanDisk, perhaps?) attempted to resolve
that contradiction by setting the filesizes in the directory entries to zero.

Hence, you need to take a very close look at the health of your filesystem,
and the system in general.

And finally...

Usenet Hygiene - Dave Learns All About Top-Posting
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Dave: Oh! Now it makes sense to me. Okay!
No more top-posting for me!

Bob: It's annoying because it reverses the
normal order of conversation. In fact,
many people ignore top-posted articles.

Dave: What's so wrong with that?

Bob: That's posting your response *before*
the article you're quoting.

Dave: People keep bugging me about "top-posting."
What does that mean?

[The preceding educational opportunity was provided by Adam Brower.]


A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet?

<http://linux.sgms-centre.com/misc/netiquette.php>

Thanks. I'm using XP Pro, and just formatted and reinstalled the
operating system last night. Through all of my research, I did not find
a virus that would affect the files in only one directory, and affect
both Word and WordPerfect and pdf files. The really strange part is
that it left the only password protected file intact.

What are some of the better anti-virus programs you would suggest?

 

[Edward]

snipped . . .

At first blush anyway, this doesn't sound like a virus to me. You never
mentioned what version of Windows you're running; but especially if it is
DOS-based (i.e., Win9x/Me), the symptoms you report sound very much like a
badly "repaired" corrupted FAT -- IOW, the directory entries are still there,
but they point to empty allocation blocks on the disk; and at some point, some
brainless "auto-fix-it" utility (like ScanDisk, perhaps?) attempted to resolve
that contradiction by setting the filesizes in the directory entries to zero.

Hence, you need to take a very close look at the health of your filesystem,
and the system in general.

I was able to use XP's restore to a date when I know the files were
intact, but it did not restore the files. I'm sure XP's system restore
is not the best; can you suggest another stand alone program (other than
backing up frequently which I do already)?

 

[\Outback\ Jon]

Thanks. I'm using XP Pro, and just formatted and reinstalled the
operating system last night. Through all of my research, I did not find
a virus that would affect the files in only one directory, and affect
both Word and WordPerfect and pdf files. The really strange part is
that it left the only password protected file intact.

What are some of the better anti-virus programs you would suggest?

www.free-av.com

Their AntiVir program has found a lot of trojans that Norton was missing
on my computers. Also used it on a friend's computer that was a mess of
spyware, trojans, etc. and it did a wonderful job of cleaning up.
(along with the usual Spybot S&D and AdAware)

Oh, and the price is right too...

--
"Outback" Jon |
1986 Kawasaki Concours |1976 Honda CB750F (needs work)
2003 Kawasaki Concours (wreck)|1972 Yamaha DS7 (project)
(e-mail address removed)|CQ CQ CQ de KC2BNE
ASHI Certifed CPR / First Aid Instructor
______________________________|______________________________
AMD XP 2400+ @ 2.18 GHz and 3.5GHz of other AMD power...
http://folding.stanford.edu - got folding? Team 33432

 

[abc]

snipped . . .

I was able to use XP's restore to a date when I know the files were
intact, but it did not restore the files. I'm sure XP's system restore is
not the best; can you suggest another stand alone program (other than
backing up frequently which I do already)?

errrm, System Restore only works for system files, not program data, you
need to restroe the files from a backup (that you have hopefully been
keeping).

You don't say if you are using NTFS or FAT32, but as a poster suggested it
could be you had a corrupted directory and chkdsk recovered what it could.
Does chkdsk report bad sectors on the disk?

 

[notritenoteri]

why are you using USenet to advertise?
BTW more than half the world reads and writes other than top to bottom and
left to right but I guess your AMerican so it isn't important?
message : Jay T. Blocksom
: --------------------------------
: Appropriate Technology, Inc.
: usenet02[at]appropriate-tech.net
:
: "They that can give up essential liberty to obtain a little temporary
: safety deserve neither liberty nor safety."
: -- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
: Unsolicited advertising sent to this domain is expressly prohibited under
: 47 USC S227 and State Law. Violators are subject to prosecution.

 

[Jay T. Blocksom]

[snip]Thanks. I'm using XP Pro,

[snip]

Ouch.

That's a problem, in and of itself. There are quite a number of XP-specific
issues you need to be aware of:

<http://www.hevanet.com/peace/microsoft.htm>
or <http://www.futurepower.net/microsoft.htm>

and (read all three):
<http://www.infoworld.com/article/03/03/14/11winman_1.html>
<http://www.infoworld.com/article/03/03/21/12winman_1.html>
<http://www.infoworld.com/article/03/03/28/13winman_1.html>

and finally:

and just formatted and reinstalled the operating system last night.

[snip]

Well, that's certainly effective, if perhaps overkill.

Through all of my research, I did not find
a virus that would affect the files in only one directory, and affect
both Word and WordPerfect and pdf files.

[snip]

Like I said, from the symptoms you described, it didn't sound like a virus.

The really strange part is
that it left the only password protected file intact.

[snip]

There could be a reason for that, or it could just be a coincidence. At this
point, it doesn't matter.

What are some of the better anti-virus programs you would suggest?

I particularly like the stuff from Frisk Software (F-Prot/F-Secure). Sophos
has a very good rep; but it's aimed squarely at the larger corporate customer.
AVG offers a truly free Windows version; but I find it clunky and inconvenient
to use. Kaspersky also has a semi-decent rep, in at least some ways; but it's
been reported as a system-killer a little too often for my taste.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet02[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this domain is expressly prohibited under
47 USC S227 and State Law. Violators are subject to prosecution.

 

[Jay T. Blocksom]

[snip]

I was able to use XP's restore to a date when I know the files were
intact, but it did not restore the files. I'm sure XP's system restore
is not the best; can you suggest another stand alone program (other than
backing up frequently which I do already)?

Well, there's really no substitute for a rigorous backup regimen. However, to
*augment* that (as opposed to replacing it, even in part), I often use an
older version of Norton Ghost to take virtual "snapshots" of freshly
installed/configured systems, thus establishing easily restorable reference
points, should things go *really* wrong. The basic drill works like this:

- Build new system
Partition drive with separate C: ("Commands"), D: ("Data") and E:
("Extras" -- i.e., the Windows swap file, temp file directories, etc.)
logical drives
- Install OS to Drive C:
- Install all necessary OS patches and tweak OS settings
- Take baseline Ghost "snapshot" of "C:" drive, and burn to CD-R
- Install application programs to Drive C:
- Tweak application program settings and install all necessary patches
- Take final Ghost "snapshot" of "C:" drive, and burn to CD-R
- Deliver system

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet02[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this domain is expressly prohibited under
47 USC S227 and State Law. Violators are subject to prosecution.

 

[Jay T. Blocksom]

why are you using USenet to advertise?

[snip]

Well, to
begin with...

I'm not, troll.

*plonk*

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet02[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this domain is expressly prohibited under
47 USC S227 and State Law. Violators are subject to prosecution.

 

[Edward]

[snip]Thanks. I'm using XP Pro,

[snip]

Ouch.

That's a problem, in and of itself. There are quite a number of XP-specific
issues you need to be aware of:

<http://www.hevanet.com/peace/microsoft.htm>
or <http://www.futurepower.net/microsoft.htm>

and (read all three):
<http://www.infoworld.com/article/03/03/14/11winman_1.html>
<http://www.infoworld.com/article/03/03/21/12winman_1.html>
<http://www.infoworld.com/article/03/03/28/13winman_1.html>

and finally:

and just formatted and reinstalled the operating system last night.

[snip]

Well, that's certainly effective, if perhaps overkill.

Through all of my research, I did not find
a virus that would affect the files in only one directory, and affect
both Word and WordPerfect and pdf files.

[snip]

Like I said, from the symptoms you described, it didn't sound like a virus.

The really strange part is
that it left the only password protected file intact.

[snip]

There could be a reason for that, or it could just be a coincidence. At this
point, it doesn't matter.

Over 1000 files were affected and one password protected file was not.
I don't think it was a coincidence. If it was not a virus, maybe a
password protected file is formatted slightly differently, or the FAT
information is stored differently so that it wasn't affected?

I particularly like the stuff from Frisk Software (F-Prot/F-Secure). Sophos
has a very good rep; but it's aimed squarely at the larger corporate customer.
AVG offers a truly free Windows version; but I find it clunky and inconvenient
to use. Kaspersky also has a semi-decent rep, in at least some ways; but it's
been reported as a system-killer a little too often for my taste.

Thanks. I've seen F-Prot, but never used it. I tried Kaspersky before
reformatting, and it locked up my system three times, so I'd have to
agree about it.

 

[Edward]

[snip]

I was able to use XP's restore to a date when I know the files were
intact, but it did not restore the files. I'm sure XP's system restore
is not the best; can you suggest another stand alone program (other than
backing up frequently which I do already)?

Well, there's really no substitute for a rigorous backup regimen. However, to
*augment* that (as opposed to replacing it, even in part), I often use an
older version of Norton Ghost to take virtual "snapshots" of freshly
installed/configured systems, thus establishing easily restorable reference
points, should things go *really* wrong. The basic drill works like this:

- Build new system
Partition drive with separate C: ("Commands"), D: ("Data") and E:
("Extras" -- i.e., the Windows swap file, temp file directories, etc.)
logical drives
- Install OS to Drive C:
- Install all necessary OS patches and tweak OS settings
- Take baseline Ghost "snapshot" of "C:" drive, and burn to CD-R
- Install application programs to Drive C:
- Tweak application program settings and install all necessary patches
- Take final Ghost "snapshot" of "C:" drive, and burn to CD-R
- Deliver system

Thanks. I actually have an older copy of Ghost. Sound like a good idea.