Results 1 to 8 of 8
  1. #1
    New Lounger
    Join Date
    Nov 2004
    Location
    Sacramento
    Posts
    16
    Thanks
    0
    Thanked 0 Times in 0 Posts

    All word files converted (Word2003 SP2)

    I tried to open Word files this am and up popped the file conversion dialog box asking me to "select the encoding that will make your document readable". Each file in the preview pane was a series of the same letter, one a document of all capital F's, others lowercase c's, etc, and all showing a weird language encode in the preview pane. (some Japanese, some chinese, some cyrillic). Selecting the Windows(default) code for the document did not correct the problem-still a series of the same letter. Not every file was affected. Some PDF's and Excell files were also damaged. All appeared to be modified last sunday at 2PM when I was surfing the net. I run up to date SpywareBlaster, Avast! anti-virus, AdAware, and Spybot. I tried the MS knowledge base procedure and converted the file to RTF and back to word - no help. I did get a couple of intercepted viruses last sunday while surfing, now that I think of it -"MS06-001 WMF Exploit" is in the Avast Log.

    Any one heard of this or have suggestions??

  2. #2
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: All word files converted (Word2003 SP2)

    Could it be the "ransomware" mentioned in <post:=578,407>post 578,407</post:>?

  3. #3
    New Lounger
    Join Date
    Nov 2004
    Location
    Sacramento
    Posts
    16
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: All word files converted (Word2003 SP2)

    No, doesn't seem to be the Ransomware. It's probably the "MS06-001 WMF Exploit" virus, which was caught at the time by Avast! (twice). I'm having trouble finding out the details of the symptoms and traces of Exploit - What's the best source for virus info??

  4. #4
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: All word files converted (Word2003 SP2)

    Microsoft has some info in Microsoft Security Bulletin MS06-001: Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919). Do a Google search for more.

    Note: the WMF Exploit was made public in December of 2005, and Microsoft released a patch that disabled it on January 5, 2006. All major anti virus programs also protect against the exploit. How could you become infected almost half a year later?

  5. #5
    New Lounger
    Join Date
    Nov 2004
    Location
    Sacramento
    Posts
    16
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: All word files converted (Word2003 SP2)

    My WIndows Update is automatic and up to date, and yes I looked at that MS report, but didn't see anything about my Word/PDF/Excel file corruption problem.My Avast was up to date and their web site said that any update after Jan 06 would protect against Exploit. I did get an immediate notification when I opened a webpage that the virus was there, and I took action (remove virus to Chest) to fix it. The only mistake I may have made was that I closed the dialog box of the virus ("Do you want to download XXXX.wmf?) instead of first doing the Avast action (remove to chest). The virus was detected at about 12:30 pm on Sunday, and all the files that were (de) formatted happened at 2:01-2:04 pm. So some residual virus must have been there.
    I'm just wondering if I can recover the reformatted files, or just delete the corrupted files and start over. I tried to restore my computer to a time before the reformat happened, but the files were still corrupted...

  6. #6
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: All word files converted (Word2003 SP2)

    I fear that your documents are toast. You can create a backup of the files on the off chance that someone else has a suggestion for repair, then delete them. Restore the documents from a backup of your documents from before the weekend, if you have one.

    BTW, a system restore (if that's what you tried) will not restore any documents, only applications and system files.

  7. #7
    New Lounger
    Join Date
    Nov 2004
    Location
    Sacramento
    Posts
    16
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: All word files converted (Word2003 SP2)

    Yes , I realized that they were gone, but I had to try. I'm just puzzled that I cant find any mention of file corruption in connection with this virus...?

  8. #8
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: All word files converted (Word2003 SP2)

    If it is a new WMF exploit and if your system was vulnerable -- two big "ifs" -- then the "payload" could be something other than an immediate action. For example, it could open a back door out to the Internet for a person or zombie PC to then access your computer and do stuff at its convenience. In some cases, that can include anything the logged in user has the privileges to do. Which is why a lot of security experts now recommend reformatting an infected system and rebuilding it from scratch.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •