Question
-
Topic
-
Calling all virus detectives – Is it a virus ?
LockedMy computer specs are AMD K62 500 MHz ,192 MB RAM running Win 98 SE version 4.10.2222 A. I have installed latest update of Avast Home user edition 4.7 antivirus program.I use Zone Alarm as a firewall.
I use Mozilla firefox v2.0 as my web browser
My system has 2 hardisks. The first harddisk hosts Windows and Linux on separate partitions. The second hardidsk contains 3 Windows partitions(volume labels: Docs,Swap and Media) and 1 linux partition. In these partitions I normally store data like word documents,mp3 files.One of the partition I have assigned as windows swap.
The system has shown the following abnormal symptoms(in chronological order):
1. I visited 2 sites http://www.compareindia.com and downloaded a pdf from http://www.isb.edu2. After say a few minutes after step 1, I discovered that all my data files had been erased. There were only 2 Windows partitions left and the volume labels had been renamed to some unintelligible words.For e.g. the swap volume label was renamed as Swaq !!.
3.The swap partition now contained an unknown folder named Recycmee containing files with names in gibberish characters. The partition contained a copy of windows swap file under some gibberish name.
4. On launching MS Word I discover foll. problems – in first attempt MS Word seems to be stuck at the splash screen. After killing it and rebooting the system, MS word says it finds Normal.dot as corrupt and attempts recovery.
5. On rebooting I lost all my partitions on my second hard drive. I am unable to see any of the partitions in linux as well as windows.
6. The windows and linux partitions on the first hard drive remain untouched. This is a surprise !!
7. The Avast antivirus program has remained silent throughout this sordid drama. This is also a surprise!!
Please note that the only external access to the system was through internet. I did not use any sort of USB drive or CD/DVD.
I suspect the 2 sites to be the vectors of the “virus”. Can a pdf carry a virus ?
I need this forum’s kind help in detecting the root cause of this anomalous behaviour.
Please help