Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Files Changing Tybe By Their Selves


  • Please log in to reply
6 replies to this topic

#1 Wendy K. Walker

Wendy K. Walker

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:09:41 AM

Posted 08 June 2007 - 01:29 AM

Hi everyone,

I'm running Windows XP with SP2 and all updated installed. I just had a strange thing happen while saving a document in Micro Soft Works Word.

I've been working on updating a saved document that contains nothing but text. I clicked the "Save" on my document several minutes ago because I needed to restart my PC.

After it restarted I went back to my document and when I tried to open it found that it is now called "A File" and no longer has the .wps file extension that it's supposed to have. :thumbsup:

Q) Does anyone know how\why that happened? Q) Does anyone know what I can do to get it back to .wps document?

I've also found a couple of my other files that have had their extensions changed one of them had something added after the .wps. I had tried removing that but it didn't help and I still cant open that document either.

Any help will be appreciated. :flowers:

Thanks,
Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

BC AdBot (Login to Remove)

 


#2 Nikas

Nikas

  • Members
  • 650 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Singapore
  • Local time:05:41 PM

Posted 09 June 2007 - 10:42 AM

Hi Wendy K. Walker

Please go HERE to run Panda's ActiveScan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
Let me know the result.

Edited by Nikas, 09 June 2007 - 10:43 AM.


#3 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:09:41 AM

Posted 09 June 2007 - 04:01 PM

Hi Nikas,

Thanks for the reply. My anti virus program wont let me run that panda thing, it tells me that it found a virus and breaks the connection.

I go to the 'start here' page for posting HJT logs every couple of weeks and run through all of their recommended steps. I also run SpyBpt S&D, AdAware, SuperAntiSpy, Stinger,AVG, ATF, CleanUp and Crap Cleaner every couple or three days.

Nothing is jumping out at me though. But I'm finding strange files starting to appear, one that I just shredded was a file in my document folder titled "LETS F*C* NOW" spelled without the '*'.

I also found that a new limited user account had been setup on my machine. It doesn't show up on the welcome screen or in safe mode though. I only found it when I had opened the user acccounts wendow to change a password.

Shoot something has even changed just about everything in my add\remove programs window too.

How do I track something like that down when all of my scans keep coming back clean?

Oh and I know there's no virus at that panda site, its just that my AV program doesn't like pandas way of doing things.

Thanks,

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#4 Nikas

Nikas

  • Members
  • 650 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Singapore
  • Local time:05:41 PM

Posted 09 June 2007 - 11:08 PM

Would you mind turning off your antivirus and go for a scan?

Just curious, what's your antivirus ?

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:41 AM

Posted 10 June 2007 - 07:27 AM

Try downloading a few free antivirus programs to your desktop, then boot into Safe Mode and run them there.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:09:41 AM

Posted 16 June 2007 - 07:03 PM

Hi Nikas,

Oh no, I don't turn my AV off for anything. I use Avast! mainly but also have a couple of others that I run from time to time.

Hi usasma,

I have Avast!, AVG, SuperAntiSpyware, Stinger, SpyBot Search & Destroy and a couple of other things and I make a habit of running them all in safe mode from time to time.

The last thing that I found was a decompression bomb that was several Gig's in size but it never got past my temp files.

Other than that nothing else is turning up.

Thanks,

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:41 AM

Posted 17 June 2007 - 07:39 AM

I was suggesting that you try a new antivirus program. If (and this is pure conjecture) your current antivirus apps have been compromised by a virus - then a brand new installation (in Safe Mode) is more likely to detect things.

You can also try some of the free command line scanners (google for them) in Safe Mode - it'll achieve the same result.

Most viruses are (IMO) designed to attack the average user. So, if the average user resorts to using (for example) HiJackThis - then the virus writers will adapt to block HiJackThis. So I look for ways to get around this. One such way that we use at work is running command line scanners from a PE environment. In really severe cases we won't even let the registry hives load so that we're able to get the entire disk scanned. I believe that the BartPE disk has this capability (you may have to add some plugins tho')
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users