-
May 3rd, 2006, 03:09 AM
#1
Senior Member
Strange behaviour of MS Office
Hi All,
Today when i opened one of my word files it should me an error...
all the text was missing and a line was there saying Data Error...
DATA Error [47 0F 94 93 F4 K5]
Is it some virus? Can I recover my files?
All my word, powerpoint files are showing this line.
Please help.
Regards,
Riya
Now is the moment, or NEVER!!!
-
May 3rd, 2006, 03:24 AM
#2
Have a look at this:
http://www.microsoft.com/security/en...32/Mywife.E@mm
On the third day of every month the worm resets the content of files with specific extension. It searches for files on the hard disk with the following extensions and replaces their contents with "DATA Error [47 0F 94 93 F4 K5]":
The last bit of the article gives suggestions for recovery.
Good luck
-
May 3rd, 2006, 10:17 AM
#3
Hello Riya,
Where are your files? are they on a server or a local machine?
If they are on a server your system operators should be able to recover them from the daily backups..................if they are local, you should be able to recover them from your daily backups.
I am assuming, of course, that you do make backups?
If you do not, and you follow hesperus's link, you will find the files that you have lost.
As you are obviously running MS Office, there should be an option to automatically back up your work every "x" minutes to a separate file for each item (.bak files I think). You should be able to find these by looking for the document name in Windows Explorer.
Another possibility is if you have the version tracking and recovery option turned on. This will let you restore the files back to what they were before the worm amended them.
Unfortunately, this worm overwrites your files. I would guess that it just does that to the first part of it, and the rest of the data may well be still there, but it will be beyond the capabilities of simple (free) recovery software
-
May 3rd, 2006, 05:01 PM
#4
Senior Member
thanks for the link and advices guys...
this is my home PC... so no backups except which i took around a year back.
there are so many files, and i dont think the backup files will be available either...
no server was involved....
can anything be done?
Now is the moment, or NEVER!!!
-
May 3rd, 2006, 05:28 PM
#5
Greeting's
first thing you should do is to clean your system. Have you checked it with an updated anti-virus ? If not scan it online at either Trendmicro or Microsoft. Or at the least you can download and run a removal tool from :
http://securityresponse.symantec.com...oval.tool.html
If the removal tools cannot repair the file's i'm not sure if all the data can be recovered. If you use an anti-virus then scan with it and see if it can repair your file's. Be assured that you will get infected again if you dont update your office suit and/or OS.
Get more info from here :
http://securityresponse.symantec.com...kmal.e@mm.html
REMEMBER TO DISABLE YOUR SYSTEM RESTORE BEFORE YOU RUN THE REMOVAL TOOL.
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
May 3rd, 2006, 06:08 PM
#6
Hi there Riya,
What version of Microsoft Office are you running? I do think that you might have the MS Office backup running, possibly by default.
Now, as your files are still there, but have just been overwritten, it does not realise that there is a problem, so it will not offfer a restore at this point
You have until the third of June to fix the worm, apart from it spreading, of course
-
May 6th, 2006, 03:02 AM
#7
Senior Member
i ran the removal tool and removed the virus.... i cant see the traces of it now... so i am assuming it is not there... anyways, i will still rerun the tool and will verify the virus.... me going to install the upgraded version of my anti-virus....
Nihil, I have Ms Office 2000 in my system....
Now is the moment, or NEVER!!!
-
May 6th, 2006, 09:10 AM
#8
Hi Riya ,
there are so many files, and i dont think the backup files will be available either...
As I recall, these don't get deleted automatically, it is something that you have to do deliberately. These are not the "temporary files" that Office creates whilst you are using it, they are permanent ones that get updated when you update the original file through the Office applications.
Have a look in your Office, and see what "Save" options you have set, that should tell you if automatic backups is enabled.
Also you might use Windows explorer and look for files called *.bak
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|