SD Just Deleted My Research Paper

[cooldude7273]

About to send my research paper in, closed and saved... and what the hell does Spyware Doctor do? Blocks it as a malicious activity and now i HAVE NO ****ING RESEARCH PAPER!!!!!!!!!!!!!!!!!!! :mad:

It's not in the quarentine and I made it since my last backup last week.

Thanks for ****ing up the rest of my day as I rewrite this ****ing paper PC Tools...

[Chippa]

This seems abit odd, im just wondering why SD would pick this file up to see it as something malicious. Can you attach the history file so we can see whats going on.

Cheers,
Chippa

[OliverK]

This post fascinated me because I've had EXACTLY the same problem a few weeks ago.

I thought I was dreaming and because no one else mentioned anything like it on this forum I was sure it must have been something I've done.

I too was working on an important document (an affidavit). I went to save the document and I received a blocking notification from SD.

Because it was late at night and I was tired, it didn't register clearly until the following morning when I went to open the document and discovered that it was gone. No original, no backup, nothing.

I felt sick in my stomach when it hit me what had happened the night before (and the message from SD). I quickly went into SD hoping that there might be something in the quarantine. There wasn't. Nothing.
I had to redo the document from the beginning over the next two hours.

I have no idea what would have caused SD to do such a thing to a plain Microsoft Word (2007) document.

I was fuming and immediately disabled SD thereafter and have not used it since.

[cooldude7273]

I'm glad, in a way, to see that someone else has experienced this Oliver - likewise, I have disabled SD

7/9/2007 8:16:58 PM:529
OnGuard: System Event Blocked
Threat Name - Trojan.Downloader.Obfuscated
Details - Spyware Doctor has blocked an application attempting to close a file.
Risk Level - High
Infection - C:\Users\My Name\Desktop\Document Name.doc

^^ from history

[Chippa]

SD should not remove any *.doc file/s, it looks like the file hasn't been saved, So no file was deleted in the first place that's why it is not listed in the quarantine folder. Because if SD detected the save file as malicious, it would have went straight to the quarantine folder. It would be good to get this file to test around with. Just to see whats going on.

It is always advised to save your document on a regular basis, especially before doing a scan, incase something happens to your system.

Cheers,
Chippa

[cooldude7273]

Yes, my file was already saved and very much so up to date.

In fact, I saved it, closed Word, the a warning came up that something tried to close Word and that it was blocked. Then I noticed that the saved file, which did exist on my desktop previously, was no more.

The mood I'm in right now because of this would be a very bad time to tell me that the file wasn't saved my friend.

[Chippa]

Judging from the info, it looks like something was interferring with your Word document and the infected .doc file was never saved. Infected .doc files are mostly macro viruses, so most probably removed by an AV. Did you run a scan with an AV app as well?

Cheers,
Chippa

[Reodor]

I have experienced similar when saving(office) xl-files directly on the desk-top and not in 'My Documents', but never seen a warning. It has been there -shut down comp -restarted next day and: gone!
Since then, changed my routine:
Save as soon as document is 'titeled' in My Documents, then save after finished. If I want it at the desk-top - make a shortcut.

[OliverK]

Chippa, I am 110% positive my experience had nothing to do with any virus - macro virus or otherwise. I was running NOD32 and Superantispyware (both brilliant programs and, I've decided, all one needs for a secure system that runs with no perceptible real-time scanning overhead) at the time and have been for years (in the case of NOD32) and 6 months (in the case of SAS). Neither of those programs flagged any virus or other nasty.

In addition, my document was created 'from scratch' - it was not taken from another (possibly infected) source.

I have no doubt there was no virus involved.

I did a full scan with both programs after this incident and they found nothing.

This one incident has made me realise that SD is just too dangerous for me. I cannot afford to have documents that I've been working on for hours just disappear when I hit the save button.

And your comment that "It is always advised to save your document on a regular basis ..." is, of course no comfort when the very attempt to "save as we go" resulted in the document vanishing for all time!!

This was a total deal breaker for me.

Oliver
(p.s. I was using the very latest version of SD5 at the time - it updated automatically)

[revive40]

This is a very old bug in SD ver 5 OnGuard. It some time detects valid files and applications. No virus or any other third party process is causing it its just a bug but happen very rarely. Usually my winamp, msn etc gets blocked once in a while but never a document. I didnt realize SD can delete files as well and not qurantine. If this is happening then I am reverting back to SD 4.1

[Hawkeyelom]

If spywaredoctor can remove a file that has already been saved, god this is totally unaceptable. :p Must be fixed at once, no way should a file be delted period.

OK PCtools lets hear from you--If this happenned to me ( ex-researcher) and I lost a paper, you would be sued immediately.

Given all the problems with PC tools has and continues to have with SD 5, including removing the days remaining so I don't know when my subscription is up for sure, I doubt very much if I will renew when my subscription is up!

Fix SD 5 or continue to loose customers.

[debls]

Seems like the cure is becoming worse than the disease. I've heard of people taking all security off of thier PC's, using any other browser than IE, being careful of what sites they go to and not having a problem. I used to think this was a really stupid move. Makes you wonder now.
What's the bigger risk the infections or the security applications?

[tom.tdw]

don't worry, you can still get it back:)

try this:
http://www.recuva.com/

don't do anything at all to your pc untill you can recover the file or it might become irecoverable

[AChen]

Hi Guys,

We are sorry to hear of the problems.

We haven't come across this issue before and there have been no previous reports on this. We'll need to investigate this further.

Could you please confirm if you are using SD standalone or SD+AV?

[revive40]

don't worry, you can still get it back:)

try this:
http://www.recuva.com/

don't do anything at all to your pc untill you can recover the file or it might become irecoverable

lol... there is also FileRecover at www.pctools.com as well :D


To Anothony..... I was using SD Standalone

[OliverK]

I was using SD+AV.
Oliver

[cooldude7273]

Just SD 5.0.1.205

[cooldude7273]

I had already rewrote it - and got a 60/100 because I had to kinda rush through it to make the deadline...

:mad:

[tom.tdw]

I had already rewrote it - and got a 60/100 because I had to kinda rush through it to make the deadline...

:mad:ouch!!

spyware doctor clames another victim:(

[allibear]

Seems like the cure is becoming worse than the disease. I've heard of people taking all security off of thier PC's, using any other browser than IE, being careful of what sites they go to and not having a problem. I used to think this was a really stupid move. Makes you wonder now.
What's the bigger risk the infections or the security applications?

debls, I know quite a few PC user's who swear by the technique you have just mentioned and just occasionally run a scan and reformat regularly anyway. I'm a bit too paranoid to go with no real-time protection myself and wouldn't recommend it to most PC user's I know but many of the more advanced/careful user's who know what they are doing do survive without it.

[allibear]

I had already rewrote it - and got a 60/100 because I had to kinda rush through it to make the deadline...

:mad:

cooldude7273, I really felt for you when I read this. Tragic. If this had have happened to me there would not have been words available to express my anger.

[tvaz]

In PC Magazine's review of SD5, the reviewer reported that SD5 removed a simple text file that had a list of the spyware that he had on his test machines. I guess the potential has probably been there from the beginning. I just wonder if the Word file had any macros or other codes that SD5 might have interpreted as malicious?

http://i35.photobucket.com/albums/d186/LuvlyLass/Smileys/36_2_39.gif