Word Files Keep Disappearing...

[CJK]

There is a small p2p network that is having an issue that MS Word docs sparatically keep dissappearing. This has been happening for 5 months and today they finally deside to call me. Here are my deductions on this problem before I actually go over there:

1. User error.
2. Virus.

Does anybody else have any possible cause that is not listed?

[NooNoo]

3. file not saved where they think....

[CJK]

Originally posted by NooNoo
3. file not saved where they think....

Yeah... that is why I listed user error (or misunderstanding) on the top. Ughhh users...

[NooNoo]

VIRUS!!!

Name: Worm/ExplorerZip.E
Alias: W32/ExploreZi-N
Type: Internet Worm (UPX packed)
Discovered: January 8, 2003
Size: 91.048KB
Platforms: Windows

Description:

Worm/ExplorerZip.E is a mass mailing Internet worm that spreads through the use of stored e-mail addresses.

The worm arrives through e-mail in the following format:

Subject: RE: <random text>
Body:

Hi <email name> !
I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
bye.

Attachment: zipped_files.exe

If executed, the worm copies itself in the \windows\%system% directory under the filenames "_setup.exe", "<random filename>,exe" and "Explorer.exe".

Additionally, the "Win.ini" file in C:\Windows will also get modified:

- C:\Windows\Win.ini
run=
run=C:\Windows\system\_setup.exe or
run=C:\Windows\system\explore.exe


So that it gets run each time a user restart their computer the following registry key gets added:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
"run"="C:\\WINNT\\System32\\Explore.exe"

** Registry key created only with Microsoft Windows NT/2000/XP

Worm/ExplorerZip.E will then zero out the lengths of files with the following extensions:

- *.asm,
- *.c
- *.cpp
- *.doc
- *.h
- *.ppt
- *.xls

That one is gonna keep us very very busy....