Results 1 to 8 of 8

Thread: Strange behaviour of MS Office

  1. #1
    Senior Member
    Join Date
    Jun 2003
    Posts
    219

    Strange behaviour of MS Office

    Hi All,

    Today when i opened one of my word files it should me an error...

    all the text was missing and a line was there saying Data Error...

    DATA Error [47 0F 94 93 F4 K5]

    Is it some virus? Can I recover my files?

    All my word, powerpoint files are showing this line.

    Please help.

    Regards,
    Riya
    Now is the moment, or NEVER!!!

  2. #2
    Senior Member hesperus's Avatar
    Join Date
    Jan 2005
    Posts
    416
    Have a look at this:

    http://www.microsoft.com/security/en...32/Mywife.E@mm

    On the third day of every month the worm resets the content of files with specific extension. It searches for files on the hard disk with the following extensions and replaces their contents with "DATA Error [47 0F 94 93 F4 K5]":
    The last bit of the article gives suggestions for recovery.

    Good luck
    .

  3. #3
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hello Riya,

    Can I recover my files?
    Where are your files? are they on a server or a local machine?

    If they are on a server your system operators should be able to recover them from the daily backups..................if they are local, you should be able to recover them from your daily backups.

    I am assuming, of course, that you do make backups?

    If you do not, and you follow hesperus's link, you will find the files that you have lost.

    As you are obviously running MS Office, there should be an option to automatically back up your work every "x" minutes to a separate file for each item (.bak files I think). You should be able to find these by looking for the document name in Windows Explorer.

    Another possibility is if you have the version tracking and recovery option turned on. This will let you restore the files back to what they were before the worm amended them.

    Unfortunately, this worm overwrites your files. I would guess that it just does that to the first part of it, and the rest of the data may well be still there, but it will be beyond the capabilities of simple (free) recovery software

  4. #4
    Senior Member
    Join Date
    Jun 2003
    Posts
    219
    thanks for the link and advices guys...

    this is my home PC... so no backups except which i took around a year back.

    there are so many files, and i dont think the backup files will be available either...

    no server was involved....

    can anything be done?
    Now is the moment, or NEVER!!!

  5. #5
    Greeting's


    first thing you should do is to clean your system. Have you checked it with an updated anti-virus ? If not scan it online at either Trendmicro or Microsoft. Or at the least you can download and run a removal tool from :

    http://securityresponse.symantec.com...oval.tool.html

    If the removal tools cannot repair the file's i'm not sure if all the data can be recovered. If you use an anti-virus then scan with it and see if it can repair your file's. Be assured that you will get infected again if you dont update your office suit and/or OS.

    Get more info from here :

    http://securityresponse.symantec.com...kmal.e@mm.html

    REMEMBER TO DISABLE YOUR SYSTEM RESTORE BEFORE YOU RUN THE REMOVAL TOOL.
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  6. #6
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hi there Riya,

    What version of Microsoft Office are you running? I do think that you might have the MS Office backup running, possibly by default.

    Now, as your files are still there, but have just been overwritten, it does not realise that there is a problem, so it will not offfer a restore at this point

    You have until the third of June to fix the worm, apart from it spreading, of course

  7. #7
    Senior Member
    Join Date
    Jun 2003
    Posts
    219
    i ran the removal tool and removed the virus.... i cant see the traces of it now... so i am assuming it is not there... anyways, i will still rerun the tool and will verify the virus.... me going to install the upgraded version of my anti-virus....

    Nihil, I have Ms Office 2000 in my system....
    Now is the moment, or NEVER!!!

  8. #8
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hi Riya ,

    there are so many files, and i dont think the backup files will be available either...
    As I recall, these don't get deleted automatically, it is something that you have to do deliberately. These are not the "temporary files" that Office creates whilst you are using it, they are permanent ones that get updated when you update the original file through the Office applications.

    Have a look in your Office, and see what "Save" options you have set, that should tell you if automatic backups is enabled.

    Also you might use Windows explorer and look for files called *.bak




Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •