What. The. HELL. ate all my MP3s??

Factual Questions
#1

Long story short: over 3,000 Mp3s I had been collecting/trading over the past two years are, like, gone.

First my computer starts acting up by being sluggish and freezing. Then it refused to open up some Mp3s I was downloading (although I was listening to a Winamp playlist at the time) – after that, it refused to let me open up the folder where I kept all my music files, saying folder was corrupted.

So I restarted my computer, because most glitches clear up when I restart and typically, you know, I go with what I know. But THEN the computer started doing something weird: I forget the exact message, but it said something about my files missing some sort of link and began doing something to the music files… … ‘Orphan truncated.’ I sort of freaked and restarted the computer twice more. Each time, the computer continued to insist there was something missing.

Against my better judgement I sat back and let the computer do its thing… part of the message said each cluster was being ‘…corrected.’ (HA!) When the dust settled and the computer turned all the way on, I was able to go straight to my music folder and all but 241 files were gone. Most of the ones that were left often only had a second of the opening strands of music. Disgusted, I dumped the rest of those partial fragments in the recycle bin. :smack:

I did some poking around and discovered that my computer generated a file of some 10,000 fragmented files, most of which were 16k fragments of my music. (I have since dumped that file in the recycle bin, too)

I still don’t understand what exactly happened. How did the folder get corrupted in the first place? Why wouldn’t my peer-sharing filter stop viruses from getting through? I want to know exactly what I should have done to avoid this. Anybody care to venture a guess what happened? (I have a Pentium 3 Gateway 2000 with a Windows 2000 Professional version O/S)

What’s the best way to safeguard my Mp3 files in the future so this doesn’t happen again?

– one last thinG: I am currently defragmenting my computer. I notice now that the icons on my desktop (My Computer, Recycle Bin, My Internet Explorer icon, and others) are moving around by themselves whenever my mouse arrow gets near them. Now what screwy thing is causing THAT?

#2

That sounds to me like a variant of the Magistr.B virus – both symptoms are pretty common, though so it might be anything.

You should always run an up-to-date virus checker, especially if you use P2P networks. Norton AV from Symantec is pretty good.

Bummer about your .mp3 losses. Even with virus protection, the best place for your data is archived and in your drawer. CD burners are cheap, and catastrophic hard-drive failures can happen to anyone.

The trial version of Nortan AV is avalable here.

#3

It could have been a simple hard drive crash caused by vibration, power surges, cosmic rays, or who knows what else. They’ve been known to happen, and if the right spot on the disk gets corrupted (e.g. part of your FAT), you could lose hundreds of files.

Also, if you keep your disk defragmented, you won’t have thousands of 16k files to chase down in the event that it happens again - losing your FAT means the operating system can’t track which fragments belong to which files.

There are programs (I think one is called Norton Image?) that will back up your FAT and other disk structures, to help in situations like yours where the structure is lost but the data is still there.

#4

Hamsters?

Sorry. Couldn’t help myself.

#5

Sounds like a virus to me as well, do you run virus protection software? Several virii attack .mp3s, .jpgs, etc.

If you want to keep things safe, burn them to a CD.

#6

Not to sound ominous, but you may want to read this thread.

I assume that it is a virus as well, but in the future, who knows?

#7

Larry Mudd: I kept holding out about getting an CD burner due to the fact that until now I never saw much need for going that extra mile. My computer survived three moves, 100 degree heat, two brownouts and a couple of lightning storms without data losses before. The only viruses I ever noticed where when people using my computer introduced them on floppy disks with viruses attached. I guess I’d been living on borrowed time.

Mr2001: Well, the data isn’t there any more. Once I realized all the files were broken up into nonsequential 16K bits AND the original file names had been erased AND the format had been changed, I decided it wasn’t worth it to piece them all together again, convert them and rename them, so I tossed them all in ‘Recycle.’ Luckily just last week I generated a fairly accurate HTML list of most of my files, so I can recreate the list – possibly as much as 90% of it – in just a few months. Some rarer, earlier files I might never get again, though.

The Gaspode: --------*----------

Telemark: Yes I do, but not much more frequently than every 30 days. Obviously, that will change.

adam yax: I don’t think it was deliberately deleted, but Yikes! that was an ominous thread.
Thanks to all who responded and letting me vent. In the meantime, two things…

  1. The icons on my desktop are STILL bouncing around-- and

  2. Should I take my computer to be serviced somewhere to remove viruses, or can I do it myself? I won’t be filesharing anymore until I feel its safe to do so.

#8

Try downloading and running the trial version of Norton AV – in all probability it’ll fix you right up, and it’s a very simple process. (It runs itself.)

I expect that after the trial version is installed, it’ll want to connect to the internet to download the latest virus definitions, then it’ll chug away for a good long time until your HD is virus-free.

As far as I know, the trial version is fully functional, with only a time limitation. If you want to do it up right you could just head down to your local software store and install the full version from the get-go - you’ll want it eventually, and it’s less of a hassle.

As for learning the value of back-ups – I learned the same way. Tons of multimedia down the tube, but worst of all, I lost months of my own work. Not a virus - general HD failure. :smack:

A CD-Burner is well worth it, especially since the price has come down so far.

Cheers.

#9

While a virus could be a cause, IMO this sounds like hard drive damage. The fragments of files is the kicker. If there is a virus, it went after your FAT table on the drive - possible but not as likely as simple HDD failure.

By all means, get a virus scanner. It’s good policy - keep it updated.

Also, though, before you do much else, run Scandisk with the “surface scan” and “thorough” options. If you have damage to your surface media, you’re wasting time laying down new files without marking any damaged blocks as bad.

$.02
-B

#10

No. There is a virus going around that specifically deletes MP3 files and a few others.

#11

Well, I did some homework. The Magistr virus has desk icon movement as a symptom. You can read about it here. It’s list of symptoms, however, does not include file deletion, mp3 or otherwise.

Shoerec also has desktop icons that run away and also deletes files.

You may have a variant.

As I was searching, I did notice one virus that was distributed via Gnutella clients and another that exploited a Windows Media Player bug that allowed a file with a MP3 extenstion to run as an ASF file. The ASF files can call other URLs or programs and therefore run code. This would allow the simple action of playing a music file to actually act as a trigger to run evil stuff on your computer.

You may have a renamed, infected ASF masquerading as an MP3.

Do the surface scan - it’s harmless. If you can, you might consider formatting and reinstalling. Put a virus scanner in before you start reinstalling and/or restoring from backups.

#12

It’s = Its

Whatever…

#13

Larry Mudd: I had to wait until my system completed defragmenting my C:/ and E:/ drives before I could uninstall my old Norton’s and execute the NAV2002 to check my systems for virii, which is why I’m just now getting back with an update.

You were right: my system was infected with
W32.Magistr.39921@mm – the ONLY virus it found – in 61 files, of which it was able to successfully repair 60. A big problem remains with the unrepaired file: PM6.Exe. NAV2002 wants to quarantine it, but I am very hesitant to delete or quarantine this particular file if it means I won’t be able to use it again.

PM6.Exe runs my Pagemaker program, a desktop publishing program I began using when I was a college newspaper editor and one I still rely on heavily as a schoolteacher when I type up school reports, handbooks, classroom newsletters and PTA notices. In fact, I was using it to finish up a handbook for my colleagues as I ran the defragmenting program! I still need to use it to complete some work I’m in the middle of and I cannot delete and re-install the file, because I no longer have access to the original software (it’s back at college.)

So: if I leave this infected file alone and continue to work on these publications what kind of damage to my system do I risk? Can I quarantine the Pm6.exe file and somehow still use it?

P.S. The desktop icons are still wriggling around. Driving me nurtz.

**Urban Ranger and Belrix: ** I think you may have nailed it. The problems began shortly after I began listening to four MP3s I’d just downloaded, and one of them, I remember, from a Gnutella client. When the computer started acting screwy and I restarted it, the first thing it did upon start up was to begin listing the music files by URL in that one folder and began “fixing” them. Like an idiot I sat back and let it. Grrrrrr. :smack:

Well, I’ve dumped all the Mp3s already and the Norton’s didn’t find anything it didn’t repair other than Pm6.exe, so I guess that’s that. I’ll have to remember to add .asf to my filters when I start downloading files again.

– Thanks again for your help, guys.

#14

If the icons are still wriggling, you’re still infected. You need to get it all out of there. Can you send to someone at college and have them forward your media to you. If you leave your system infected, it’ll just spread within your system and to others via your e-mail (Magistr travels via e-mail, too.).

The ASF files are good to filter against but the article describes ASF format files that have an MP3 extension. Your filter wouldn’t catch that. I just happens that Windows Media Player will recognize the internal structure of the fake MP3 as an ASF and will run it as such despite the extension.

Good Luck!

#15

Belrix: I’ve already decided to bear the infection for a little while longer – just so I can complete my current publication projects. Now that I’m keenly aware of the infection, I’ll do my best to minimize/contain it: I’ll leave my computer on so that it won’t spread at each start-up, I’ll shut off my Outlook Express for a few days and I’ll run a full NAV systems check every day. (I notice it hasn’t spread anywhere today.) I know – I KNOW – I should purge the infected file, but I don’t see any way around this. I have no clean PM6.exe to re-install… and I have to finish my work. School starts in two weeks.

I suppose it won’t hurt to call up my former newspaper advisor tomorrow and ask her to send the original media or clean copies by mail, although I deeply, deeply suspect the answer will be “no.” See, I wasn’t supposed to have the software on my home computer in the first place…! :smiley:

Thanx loads, tho.

#16

Duh, isn’t it obvious? The RIAA hacked your computer and deleted them all, you thieving scum.

;D

#17

Call me paranoid, but I did think that Askia was the guinea pig for RIAA’s MP3 killer software. (Hey, gotta have something to roll out if they ever get their laws passed, right?)

#18

Here’s an update:

  1. After letting Norton’s do its thing the last few days, I am happy to report that the Magistr B virus is gone from my system, except the aformentioned PM6.exe, which appears to be contained in one folder. I have run Norton’s at least four times in the last 2 days and each time it has only found that one file. Even more happily, the Magistr B symptomatic movement of the desktop icons quit doing the creepy crawl the last 24 hours and thanks to my defragmenting my C:/ and E:/ drives, my system is running noticeably smoother.

  2. Seriously doubt my computer was the guinea pig for an RIAA hack, if only for three reasons: one, thanks to Belrix’s research, I’m pretty sure all this was the direct result of at least one screwy .mp3 or .wav file I downloaded, renamed, then transferred into that folder myself (I suspect it was “Truth Hurts - Jimmy”, btw) and secondly – if the point were to wipe out my Mp3 files and discourage my filesharing – why stop at just ruining my Mp3s? Why not my .avi DVDs? Why not my music videos? Why leave my connections to KaZaA and Morpheus intact? Neither of these program’s .exe files were damaged. Also, some Mp3s I had – like some 30s jazz and blues riffs, a few speeches and couple of interviews – were in the public domain or given to me, so I shouldn’t be persecuted for those.

Thirdly, why pick on me? I only had a measly 3,218 files. I know plenty people with waaa-aaaay more.

  1. ElwoodCuse: Dammit, I am NOT thieving scum. If anything, I’m an unctous flotsam, possibly a disingenuous jetsam, conceivably a lichevious loam, some sort of sentient slimeball or just plain carbon-based gunk. Damn your eyes and the vitreous humor that moistens them. ;D

  2. KKBattousai: Okay. You’re paranoid.

Thanx for playing.