Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I have two Sata Seagate drives in a RAID Mirror configuration. In one
directory in which I store all of my Microsoft Word files and older
WordPerfect files, the file names are intact, but the files are empty.
If I open one in Word, it is blank. They show as zero kb. Some zipped
files of WordPerfect files are also empty. Is this a virus? Can I
recover them somehow? Any help?

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Yes, there is a virus that does this. What did your anti-virus scan report?

"Edward" <Edward@nospamatall.com> wrote in message
news:sZa6e.16992$Xp.7986@tornado.texas.rr.com...
> I have two Sata Seagate drives in a RAID Mirror configuration. In one
> directory in which I store all of my Microsoft Word files and older
> WordPerfect files, the file names are intact, but the files are empty.
> If I open one in Word, it is blank. They show as zero kb. Some zipped
> files of WordPerfect files are also empty. Is this a virus? Can I
> recover them somehow? Any help?

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I use Norton 2005 antivirus, and it did not detect anything.

Eric Gisin wrote:
> Yes, there is a virus that does this. What did your anti-virus scan report?
>
> "Edward" <Edward@nospamatall.com> wrote in message
> news:sZa6e.16992$Xp.7986@tornado.texas.rr.com...
>
>>I have two Sata Seagate drives in a RAID Mirror configuration. In one
>>directory in which I store all of my Microsoft Word files and older
>>WordPerfect files, the file names are intact, but the files are empty.
>>If I open one in Word, it is blank. They show as zero kb. Some zipped
>>files of WordPerfect files are also empty. Is this a virus? Can I
>>recover them somehow? Any help?
>
>
>

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I should also have mentioned that I periodically backup my important
files to another hard drive in my computer, and those Word files appear
to be fine. If I do have a virus, it only infected my C drive. Is that
possible?

Eric Gisin wrote:
> Yes, there is a virus that does this. What did your anti-virus scan report?
>
> "Edward" <Edward@nospamatall.com> wrote in message
> news:sZa6e.16992$Xp.7986@tornado.texas.rr.com...
>
>>I have two Sata Seagate drives in a RAID Mirror configuration. In one
>>directory in which I store all of my Microsoft Word files and older
>>WordPerfect files, the file names are intact, but the files are empty.
>>If I open one in Word, it is blank. They show as zero kb. Some zipped
>>files of WordPerfect files are also empty. Is this a virus? Can I
>>recover them somehow? Any help?
>
>
>

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Edward <Edward@nospamatall.com> wrote:

> I have two Sata Seagate drives in a RAID Mirror configuration. In one
> directory in which I store all of my Microsoft Word files and older
> WordPerfect files, the file names are intact, but the files are empty.
> If I open one in Word, it is blank. They show as zero kb. Some zipped
> files of WordPerfect files are also empty. Is this a virus? Can I
> recover them somehow? Any help?

There's a family of VB script malware (Love Letter was the most known) that did
that. When active, the worm would sweep through all write-enabled drives across
the network, "open" for writing every DOC (and JPG) file then close it, actually
converting these files to 0 byte length files.

In FAT partitions, some of the files could be recovered on the following
conditions:

a. The drive use was stopped immediately after the incident to prevent the OS
from writing to the space that was deallocated by the decapitated files.

b. Only contiguous files at the time of disaster could be recovered.

VB script viruses are rather old and are rarely seen these days. From your
description, seems that your archives date from long ago, when these viruses
were still common.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks for the response, but many of the files are new; also, Word and
WordPerfect files on another hard drive are fine.

Zvi Netiv wrote:
> Edward <Edward@nospamatall.com> wrote:
>
>
>>I have two Sata Seagate drives in a RAID Mirror configuration. In one
>>directory in which I store all of my Microsoft Word files and older
>>WordPerfect files, the file names are intact, but the files are empty.
>>If I open one in Word, it is blank. They show as zero kb. Some zipped
>>files of WordPerfect files are also empty. Is this a virus? Can I
>>recover them somehow? Any help?
>
>
> There's a family of VB script malware (Love Letter was the most known) that did
> that. When active, the worm would sweep through all write-enabled drives across
> the network, "open" for writing every DOC (and JPG) file then close it, actually
> converting these files to 0 byte length files.
>
> In FAT partitions, some of the files could be recovered on the following
> conditions:
>
> a. The drive use was stopped immediately after the incident to prevent the OS
> from writing to the space that was deallocated by the decapitated files.
>
> b. Only contiguous files at the time of disaster could be recovered.
>
> VB script viruses are rather old and are rarely seen these days. From your
> description, seems that your archives date from long ago, when these viruses
> were still common.
>
> Regards, Zvi
> --
> NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
> InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Three anti-virus programs did not find anything (Norton 2005, AVG, and
McAfee online scan. After that post I found that pdf files in the same
directory were also empty. And strangely, the only password protected
file in that directory was intact; it was the ONLY file that was intact.

Eric Gisin wrote:

> Yes, there is a virus that does this. What did your anti-virus scan report?
>
> "Edward" <Edward@nospamatall.com> wrote in message
> news:sZa6e.16992$Xp.7986@tornado.texas.rr.com...
>
>>I have two Sata Seagate drives in a RAID Mirror configuration. In one
>>directory in which I store all of my Microsoft Word files and older
>>WordPerfect files, the file names are intact, but the files are empty.
>>If I open one in Word, it is blank. They show as zero kb. Some zipped
>>files of WordPerfect files are also empty. Is this a virus? Can I
>>recover them somehow? Any help?
>
>
>

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Edward,

Did you ever figure this out???

I am encountering the same problem with a system (XP Home w/SP2,
running Norton Internet Security 2005).

Scanned with multiple anti-virus & anti-spyware programs but
didn't turn up ANYTHING. Yet the files continue to go to zero
bytes.

Any ideas?

Thanks!

John -Z-

>
> Three anti-virus programs did not find anything (Norton 2005, AVG,
and
> McAfee online scan. After that post I found that pdf files in the
same
> directory were also empty. And strangely, the only password
protected
> file in that directory was intact; it was the ONLY file that was
intact. [/b]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

No, I didn't. I never found a virus or spyware. I formatted my drive
and started over.

JohnZ wrote:
> Edward,
>
> Did you ever figure this out???
>
> I am encountering the same problem with a system (XP Home w/SP2,
> running Norton Internet Security 2005).
>
> Scanned with multiple anti-virus & anti-spyware programs but
> didn't turn up ANYTHING. Yet the files continue to go to zero
> bytes.
>
> Any ideas?
>
> Thanks!
>
> John -Z-
>
>
>>Three anti-virus programs did not find anything (Norton 2005, AVG,
>
> and
>
>>McAfee online scan. After that post I found that pdf files in the
>
> same
>
>>directory were also empty. And strangely, the only password
>
> protected
>
>>file in that directory was intact; it was the ONLY file that was
>
> intact. [/b]
>