Word/Excel files keep restoring to previous dates/lose data

By snowscreen
Dec 28, 2013
Post New Reply
  1. Hi all,
    Hoping you can help with this one.
    My partners Dad has an issue with his PC.
    Running Windows 7 Service Pack 1 x64 NTFS, HP TouchSmart 520

    He will do some work on an Excel or Word file, save it, but then when he goes back to the file another day it has sometimes lost not only the most recent data, but also previous months.
    It's almost as if they are restoring themselves to a previous date.

    The most recent example is an Excel file he saved 2 days ago, yet today it is showing as last being modified back in March.

    I temporarily resolved his loss of data the other week by right clicking the file, going into properties, previous versions, then restoring from the last save point so that all correct data is then displayed.
    Unfortunately the issue has came back on a file so something must be up somewhere.


    Any ideas or where to start?


    He has McAfee antivirus and Malwarebytes, will post a log from that in a second.
    Thanks
  2. snowscreen

    snowscreen Newcomer, in training Topic Starter Posts: 19

    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org
    Database version: v2013.12.14.04
    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.16476
    keith :: CRAZYMACHINE [administrator]
    28/12/2013 12:14:21
    MBAM-log-2013-12-28 (12-26-05).txt
    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 254028
    Time elapsed: 9 minute(s), 30 second(s)
    Memory Processes Detected: 1
    C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe (PUP.Optional.AmazonTB.A) -> 3232 -> No action taken.
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 52
    HKCR\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} (PUP.Optional.Delta) -> No action taken.
    HKCR\escort.escortIEPane.1 (PUP.Optional.Delta) -> No action taken.
    HKCR\escort.escortIEPane (PUP.Optional.Delta) -> No action taken.
    HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> No action taken.
    HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta) -> No action taken.
    HKCR\delta.deltaHlpr (PUP.Optional.Delta) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> No action taken.
    HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> No action taken.
    HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> No action taken.
    HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> No action taken.
    HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> No action taken.
    HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> No action taken.
    HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\delta.deltadskBnd.1 (PUP.Optional.Delta.A) -> No action taken.
    HKCR\delta.deltadskBnd (PUP.Optional.Delta.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\CLSID\{EA582743-9076-4178-9AA6-7393FDF4D5CE} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\TypeLib\{33D0AD98-3347-4A54-8929-5163EBEB9F72} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\AlxTB2.TBLayoutBHO.1 (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\AlxTB2.TBLayoutBHO (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\CLSID\{F443A627-5009-4323-9C1D-7FD598D0D712} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\AlxTB2.AlxHelper.1 (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\AlxTB2.AlxHelper (PUP.Optional.AmazonTB.A) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F443A627-5009-4323-9C1D-7FD598D0D712} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F443A627-5009-4323-9C1D-7FD598D0D712} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F443A627-5009-4323-9C1D-7FD598D0D712} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EA582743-9076-4178-9AA6-7393FDF4D5CE} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA582743-9076-4178-9AA6-7393FDF4D5CE} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\Interface\{8D03FA45-4B8C-4427-BE67-EE8885147151} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCR\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305} (PUP.Optional.AmazonTB.A) -> No action taken.
    HKLM\SYSTEM\CurrentControlSet\Services\Updater Service for AMZN (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> No action taken.
    HKCU\Software\Alexa Internet\Alexa9\Amazon (PUP.Optional.AmazonTB.A) -> No action taken.
    HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.
    HKCU\Software\Distromatic\Toolbars (PUP.Optional.AlexaTB.A) -> No action taken.
    HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> No action taken.
    HKCR\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\delta.deltaappCore.1 (PUP.Optional.Delta.A) -> No action taken.
    HKCR\delta.deltaappCore (PUP.Optional.Delta.A) -> No action taken.
    HKCR\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} (PUP.Optional.Delta.A) -> No action taken.
    HKCR\d (PUP.Optional.Delta.A) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\delta (PUP.Optional.Delta.A) -> No action taken.
    Registry Values Detected: 7
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: Delta Toolbar -> No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{EA582743-9076-4178-9AA6-7393FDF4D5CE} (PUP.Optional.AmazonTB.A) -> Data: -> No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EA582743-9076-4178-9AA6-7393FDF4D5CE} (PUP.Optional.AmazonTB.A) -> Data: -> No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: -> No action taken.
    HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Data: -> No action taken.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BackgroundContainer (PUP.Optional.Conduit) -> Data: "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\keith\AppData\Local\Conduit\BackgroundContainer\BackgroundContain er.dll",DllRun -> No action taken.
    HKCU\Software\Delta\delta|lastB (PUP.Optional.Delta.A) -> Data: http://www2.delta-search.com/?babsrc...66521&tsp=4992 -> No action taken.
    Registry Data Items Detected: 0
    (No malicious items detected)
    Folders Detected: 11
    C:\Users\keith\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\Content (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\Content\icons (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\updates (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Delta (PUP.Optional.Delta.A) -> No action taken.
    C:\Users\keith\AppData\Local\Amazon Browser Bar (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6 (PUP.Optional.Delta.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\bh (PUP.Optional.Delta.A) -> No action taken.
    Files Detected: 37
    C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (PUP.Optional.Delta) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe (PUP.Optional.Delta) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (PUP.Optional.Delta.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> No action taken.
    C:\Windows\Temp\TBU001\Update.exe (PUP.Optional.Searchprotect) -> No action taken.
    C:\Users\keith\AppData\Local\Conduit\CT3282137\FLV_Runner_BAutoUpdateHelper .exe (PUP.Optional.Conduit.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\FLStat.dat (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\MyList.dat (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\ocr_cache (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\ocr_data (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\Content\icons\BTMJWKZGYE_glossary_ic on.ico (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\Content\icons\BTMJWKZGYE_glossary_ic on2.ico (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\updates\convert.dat (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Babylon\updates\rates.dat (PUP.Optional.Babylon.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta.A) -> No action taken.
    C:\Users\keith\AppData\Local\Amazon Browser Bar\protect.xml (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.ini (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\AlxSSBPS.dll (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.Uninstall.exe (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBarSSB.3.0.dll (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\installer.xml (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\MainUninstall.exe (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\RemoveAmazonSearch.exe (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\search_protect.exe (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Program Files (x86)\Amazon Browser Bar\update.xml (PUP.Optional.AmazonTB.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\chu.js (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\SetupParams.ini (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Users\keith\AppData\Roaming\BabSolution\Shared\sqlite3.dll (PUP.Optional.BabSolution.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll (PUP.Optional.Delta.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll (PUP.Optional.Delta.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\GUninstaller.exe (PUP.Optional.Delta.A) -> No action taken.
    C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe (PUP.Optional.Delta.A) -> No action taken.
    (end)
  3. Cobalt006

    Cobalt006 TechSpot Maniac Posts: 1,750   +162

    Looks like you may need to hop over to the virus and malware sub forum here and let Broni take a look.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.