Save problem - Help!

    We recently had a rash of viruses run through our offices (both Nimdas and W32/Datom). Everything has been fixed except for three machines. They read virus free, but any new excel documents cannot be saved. In fact, several buttons are disabled, and File>Properties does not work.


    All three machines originally ran Office 97, but I upgraded two to Office 2000 in an attempt to fix. The same problems occur in Excel 2000. I've tried extracting the riched20.dll file, but that didn't help.


    I'm at the end of my rope! Any suggestions???

    Hi Aldin and welcome to the board :)


    Since You appear to be rather desperate I make a note in the thread so You know that You got our attention :coolwink:


    I´ve sent a message to Jack in the UK to have alook on this thread in case he miss to read it :)


    No, You´not in the end of the rope - Only in the beginning :thumbup:

    I sure appreciate it! Should I call you Dennis or XL-Dennis? I've been trying to figure this out for a week. Not that I know anything, but I'm starting to think it may have something to do with wherever Excel derives it's blank worksheets from. :rolleyes:

    Aldin


    YES i have received a U2U from XL-Dennis , and big warm Excel to Dennis for this heads up.


    Nasty stuff, i will read you post and advise my opinion from there.


    OK what Windows version and Excel / Office version?


    Networked i guess??


    Do you now run Anti Virus software? if so what manufactor and version , you need to check the update files know commomly as DAT files.


    What id you do to clean the attack, did teh software report any file damaged or unrepairable?




    Try the help files in that application for details


    Jack

    Hey Jack!


    Running Win98se with the problem originating on Excel97 (from Office97). Upgrading to Excel2000 (from Office2000) did not help.


    Peer-to-peer network. Shared drives.


    We were (and are) running McAfee. We are now much more stringent about forcing everyone to keep the VShield running than we had been. It's version 5.21 running the latest engine (4.6?) and the most recent DAT files.


    None of the three viruses was actually McAfee fixable. We used Symantec's Nimda.A & Nimda.E fix utils. Nothing was listed as damaged or unrepairable. Fixing W32/Datom was a bit stranger. I simply followed Symantec's removal instructions. Namely, deleted msvxd.exe, msvxd16.dll & msvxd32.dll from c:\windows\system and removed refrences to them in the registry, win.ini and startup.


    All the above fixes were done with the machines physically disconnected from the network, and all machines scanned clean before reattachment.


    The Nimda info said Word might get screwed up and that extracting the riched20.dll file from the start disk would fix it. Word seems fine (as best I can tell), but I tried the extraction knowing Word and Excel are closely related.


    I may try contacting McAfee again, but I hope someone can help me without such a time-intensive and money costing event.


    Aldin

    Sorry this is hardly a tidy post, but i wanted to get this up posted ASAP so beg forgiveness for shortcommings, its packed with dos and donts, and my opinions.


    Let me know if you need more


    Kindest possable regards


    Jack in the UK


    >>>>>>>>>>
    Save problem - Help! ||| Virus Attack |||||
    Feed :
    http://www.ozgrid.com/forum/viewthread.php?tid=774



    Running Win98se with the problem originating on Excel97 (from Office97). Upgrading to Excel2000 (from Office2000) did not help. >>>>


    No I would not have suggest that just yet, I guess you up graded, ??? I say that as you might not have correctly removed Office 97, so effetely files will remain from prior install. A very common error. How ever the Upgrade versions will take care of this issue of cause. Full will not, that’s why it’s possible to multi session Office in versions.


    Peer-to-peer network. Shared drives.
    >>> Say no more, I’ve nothing to say you system will be damaged and data shattered all over the shop, this kind of set up is weak in defence and always is problematic.


    I suggest a full correct rebuild of all software – windows removed and reload and up wards, sadly I have never yet got a system that’s had all this run for long without other issues rearing their ugly head.



    We were (and are) running McAfee.
    >> This attack I s impossible if you [as i pointed out n above posts] running Mcafee, the definitions cover this / theses attacks, unless this was a very long time ago, this can not be infected if the configuration is correct and the software was running, of the product is at fault, which I have never know.


    We are now much more stringent about forcing everyone to keep the VShield running than we had been.
    >> OK that answers my above issues, you can lock the software so a password is needed to open the GUI and so can not be turned off or re configured, I guess not the case here.


    I know Anti Virus Software is a pain, I hate them, but are needed in to days aggressive virus world.



    It's version 5.21 running the latest engine (4.6?) and the most recent DAT files.
    >> OK from that it must have been switched off.


    None of the three viruses was actually McAfee fixable. We used Symantec's Nimda.A & Nimda.E fix utils. Nothing was listed as damaged or unrepairable. Fixing W32/Datom was a bit stranger. I simply followed Symantec's removal instructions. Namely, deleted msvxd.exe, msvxd16.dll & msvxd32.dll from c:\windows\system and removed refrences to them in the registry, win.ini and startup.
    >> Mcafe shold have fixes also, these are old virus ??? from email, ninda is a space hugger, I have been called to such attacks, and I had 1.9mb files all over the server. And had to repair files and re jig the registry.



    All the above fixes were done with the machines physically disconnected from the network, and all machines scanned clean before reattachment.
    >> Have you scanned the server prior o reconnecting, you must I might well stink!!!! I will have been attacked over the LAN.


    The Nimda info said Word might get screwed up and that extracting the riched20.dll file from the start disk would fix it. Word seems fine (as best I can tell), but I tried the extraction knowing Word and Excel are closely related.
    >> Yes funny Nimda did effect IE and Word and Excel, funny bugger it is.


    I may try contacting McAfee again, but I hope someone can help me without such a time-intensive and money costing event.
    >>> So what do I say….


    The PC the source was I would format and re build, but there are some ticks for this one I can offer.


    The PC all need disconnecting and scanning and then repair as Mcfee say on the homepage and if so reload damage application to refresh just in case other have been juggled.


    The server need a DEEP full ALL files scan this might take a full day and really hammers the server but hey must be done


    Without seeing the PC its harder to say exactly, but feel free to popst more if you need


    Please stay on this feed do not start a new one, many thanks


    BTW the rebuild, do not even start UNLKESS you are very able to do so without a single thought of how to this is done.


    What I’m saying is unless its second nature – like to me, do not try, your need a few things many MANY got caught out. I say this just in case. I’m sure you understand


    Jack in the UK

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login