Expert: Lorry - 9/15/2006

Question
thank you very much, I am about to follow all your instructions but I have one more question.  I don't know exactly when the virus struck, but if I go back to a restore point when I know I was able to use the files, might that restore them.  (I back up all data every night, but to my dismay I backed up the empty files because I did'nt know they were empty yet.  I run a virus scan everyweek and have auto update, so  I gather its still possible for a virus to sneak through?  again, thank you
-------------------------

Followup To

Question -
about ten days ago I discovered that the text was completely deleted from almost all of my Word files.  So far, all I have been able to find out is that this is a "macro" virus that infects documents and then on a time delayed schedule deletes all the text in the documents and then saves the documents.   But I don't know what to do (I have MacAfee already and have updated and scanned regularly).  How can I detect and remove whatever is doing this, and is there any way to recover my files?  

thank you,

cathy lorber














Answer -
Hi Cathy,

Even though you have McAfee installed, using Internet Explorer go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

I would also suggest downloading Spybot - Search & Destroy 1.4, a program that removes spyware, available from:

http://www.pcworld.com/downloads/file_description/0,fid,22262,00.asp

Once installed, enable Tea Timer. Open the Spybot Search & Destroy, click  the "+" sign next to Tools on the left side of the screen, click System Startup, then on the right side of the page check HK_CU Run Spybot Tea Timer.

The Resident TeaTimer is a new tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future.

Check for updates before running. If you have trouble getting the updates, near the top of the Update Window, click the little arrow next See-Cure  #1(Europe), highlight the next one on the list, See-Cure #2 and try to download the updates. If that doesn't work, try the next one the list. until you get one you can download from. Being a free program, if too many people are using the same site to download the updates, some people will not get them.

I think you lost the files, sorry. No matter which AV program you use, it's important not to only update it once a week but equally important to run a virus scan after updating.

Hope this helps!
Lorry

Answer
Hi Cathy,

You could try System Restore but they might not be there but it's sure worth the try!

Viruses are sneaky little things. For exaple, if your computer got infected by the ABC virus on Monday and McAfee puts out protection for that virus on Wednesday, it will not see that ABC virus until you run a scan. That's why I suggest running a scan after updating.

Hope this helps!
Lorry