Help with a virus. Maybe?

[Breaker78]

OK, here is the deal. Its totally weird to me.
I have this file on a file server. Its an excel spread sheet, a pretty large and complex one, but I don't think that should really matter. Every week or so, something happens to the file. It goes from being called a normal name, like "My complex excel spredasheet.xls" to a garbage 8 characters with no extention like "94e40200". Now I'm not positive, but I think it always goes back to the same name. My first hunch was that its a virus, but inoculan and sophos both don't see anything. Both the client and the server are NT 4.0. It also sort of reminds me of an address on the hard disk in hex.

Has anyone ever seen anything like this, EVER!!??

Also the event logs look clean on both pc's.

Thanks for the help.
-Break~r

 

[Vegito]

when you try to save it creates that file ?

The way excel saves.

Loads a copy into your local computer.

Your original remails untouch

When you save, you can do refresh on explorer and see the size grow.

It takes the file in memory, puts it in a temp file, ie those 8 character.

Creates the temp file, when finish

Deletes the original file

Rename the temp to the original file name.

If your excel crashes while saving, that temp file is still there

 

[Breaker78]

Right, i think i understand what you are saying. I thought usually that file started with a ~ and had the extension .tmp and was hidden. None of those things happen to me. Also, the original file is no longer there. I can rename the file and open it in excel fine however.

 

[jeans2nd]

This sounds like what is a known problem (in MS Knowledgebase), for Excel files that are stored on a server. The Excel temp file is on the server, and especially for large spreadsheets, it wreaks havoc with saving the file. MS solution is, believe it or not, to copy the spreadsheet to your hard drive, and when you're finished updating copy it back to the server. Not very elegant, but it works.

 

[Breaker78]

Thanks for the help, I have been searching the KnowledgeBase but haven't been able to find anything yet. If anyone has a link that would be great. Probably not though. Thanks.
-Breaker

FOUND IT!!
Looks like it may be an issue with an older version of the Novell Client for NT.