SD Just Deleted My Research Paper

cooldude7273 · #1 07-10-2007, 12:25 AM

About to send my research paper in, closed and saved... and what the hell does Spyware Doctor do? Blocks it as a malicious activity and now i HAVE NO ****ING RESEARCH PAPER!!!!!!!!!!!!!!!!!!!

It's not in the quarentine and I made it since my last backup last week.

Thanks for ****ing up the rest of my day as I rewrite this ****ing paper PC Tools...

Chippa · #2 07-10-2007, 12:35 AM

This seems abit odd, im just wondering why SD would pick this file up to see it as something malicious. Can you attach the history file so we can see whats going on.

Cheers,
Chippa

OliverK · #3 07-10-2007, 12:39 AM

This post fascinated me because I've had EXACTLY the same problem a few weeks ago.

I thought I was dreaming and because no one else mentioned anything like it on this forum I was sure it must have been something I've done.

I too was working on an important document (an affidavit). I went to save the document and I received a blocking notification from SD.

Because it was late at night and I was tired, it didn't register clearly until the following morning when I went to open the document and discovered that it was gone. No original, no backup, nothing.

I felt sick in my stomach when it hit me what had happened the night before (and the message from SD). I quickly went into SD hoping that there might be something in the quarantine. There wasn't. Nothing.
I had to redo the document from the beginning over the next two hours.

I have no idea what would have caused SD to do such a thing to a plain Microsoft Word (2007) document.

I was fuming and immediately disabled SD thereafter and have not used it since.

cooldude7273 · #4 07-10-2007, 12:44 AM

I'm glad, in a way, to see that someone else has experienced this Oliver - likewise, I have disabled SD

Quote:

7/9/2007 8:16:58 PM:529
OnGuard: System Event Blocked
Threat Name - Trojan.Downloader.Obfuscated
Details - Spyware Doctor has blocked an application attempting to close a file.
Risk Level - High
Infection - C:\Users\My Name\Desktop\Document Name.doc

^^ from history

Chippa · #5 07-10-2007, 01:12 AM

SD should not remove any *.doc file/s, it looks like the file hasn't been saved, So no file was deleted in the first place that's why it is not listed in the quarantine folder. Because if SD detected the save file as malicious, it would have went straight to the quarantine folder. It would be good to get this file to test around with. Just to see whats going on.

It is always advised to save your document on a regular basis, especially before doing a scan, incase something happens to your system.

Cheers,
Chippa

cooldude7273 · #6 07-10-2007, 01:37 AM

Yes, my file was already saved and very much so up to date.

In fact, I saved it, closed Word, the a warning came up that something tried to close Word and that it was blocked. Then I noticed that the saved file, which did exist on my desktop previously, was no more.

The mood I'm in right now because of this would be a very bad time to tell me that the file wasn't saved my friend.

Chippa · #7 07-10-2007, 01:49 AM

Judging from the info, it looks like something was interferring with your Word document and the infected .doc file was never saved. Infected .doc files are mostly macro viruses, so most probably removed by an AV. Did you run a scan with an AV app as well?

Cheers,
Chippa

Reodor · #8 07-10-2007, 03:10 AM

I have experienced similar when saving(office) xl-files directly on the desk-top and not in 'My Documents', but never seen a warning. It has been there -shut down comp -restarted next day and: gone!
Since then, changed my routine:
Save as soon as document is 'titeled' in My Documents, then save after finished. If I want it at the desk-top - make a shortcut.

OliverK · #9 07-10-2007, 04:11 AM

Chippa, I am 110% positive my experience had nothing to do with any virus - macro virus or otherwise. I was running NOD32 and Superantispyware (both brilliant programs and, I've decided, all one needs for a secure system that runs with no perceptible real-time scanning overhead) at the time and have been for years (in the case of NOD32) and 6 months (in the case of SAS). Neither of those programs flagged any virus or other nasty.

In addition, my document was created 'from scratch' - it was not taken from another (possibly infected) source.

I have no doubt there was no virus involved.

I did a full scan with both programs after this incident and they found nothing.

This one incident has made me realise that SD is just too dangerous for me. I cannot afford to have documents that I've been working on for hours just disappear when I hit the save button.

And your comment that "It is always advised to save your document on a regular basis ..." is, of course no comfort when the very attempt to "save as we go" resulted in the document vanishing for all time!!

This was a total deal breaker for me.

Oliver
(p.s. I was using the very latest version of SD5 at the time - it updated automatically)

revive40 · #10 07-10-2007, 06:37 AM

This is a very old bug in SD ver 5 OnGuard. It some time detects valid files and applications. No virus or any other third party process is causing it its just a bug but happen very rarely. Usually my winamp, msn etc gets blocked once in a while but never a document. I didnt realize SD can delete files as well and not qurantine. If this is happening then I am reverting back to SD 4.1