|
 | Document ID:1999060711015209
Last Modified:03/29/2001 |
Error: "Cannot open file... if part of a ZIP format backup set..." and the size of many files is zero
Situation:
After running the file ZIPPED_FILES.EXE, you see the message: "Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."
You also notice that you have the file EXPLORE.EXE in your Windows\System folder, or the file _SETUP.EXE on your system partition, and that each time you boot up, your email program opens and runs. Some of your files are now empty, having a zero byte size.
Solution:
If your system displays all the above symptoms, the system probably has the worm called Worm.ExploreZip. Worms are similar to computer viruses. For more about this virus and how to get rid of it, see How to Remove Worm.ExploreZip.
Caution:
If you already have this worm and you do not have an antivirus program, do not install an antivirus program at this time. Instead, see the above link for how to get rid of the worm without an antivirus program. Installing an antivirus program, or saving any files to the hard disk, can overwrite files the worm has deleted, making those files unrecoverable.
Follow these steps to recover your deleted files:
If you already had Norton Utilities installed on the system prior to the worm, you may be able to recover the files from the Norton Protected Recycle Bin, using UnErase Wizard:
- Make sure the worm is fully removed from your computer. If the computer is on a network, either disconnect it from the network, or make sure the worm is fully removed from any computers that are attached to the network.
- Double-click the Norton Protected Recycle Bin icon on your desktop to open UnErase Wizard.
- Follow the on-screen prompts to look for the deleted files. The deleted files are any file with the extension .h, .c, .cpp, .asm, .doc, .ppt, or .xls. If you cannot find the files here, proceed to "Chances for a successful file recovery." In most cases, the files will be listed here.
- For each file you want back, select the file and click the Recover button. The file will be returned to the directory from which it was deleted.
- If Norton Utilities reports that it cannot recover the file because recovering it would overwrite an existing file:
- Find the existing file on your hard disk.
- Verify that the size of the existing file is zero bytes.
- Delete the existing file.
- Repeat steps 2 through 4 to recover the file from the Recycle Bin.
Chances for a successful file recovery
If you cannot recover the deleted files from the Norton Protected Recycle Bin, the likelihood of recovering the deleted files depends on many factors, such as how long the virus was on your system, the size of your swap file, the size of the deleted files, how recently you optimized (defragmented) the drive, and whether you have an Image file from Norton Utilities.
- Novell file servers
Files deleted from a Novell File Server may be recovered using Salvage, provided that Salvage was enabled and running prior to the deletions. If Salvage is unable to recover the files, your best alternative is a recent backup of the files.
- NTFS partitions
Unless the files can be recovered with UnErase Wizard from the Norton Protected Recycle Bin, Norton Utilities does not have utilities for recovering files from NTFS partitions. Your best alternative is a recent backup of the files.
- Fragmented FAT32 partitions without a recent Image file
Recovery of files from FAT32 partitions that have no recent Image file and have never been defragmented is extremely unlikely. Your best alternative is a recent backup of the files.
- FAT16 and FAT32 partitions without a recent Image file
If you do not have a Norton Utilities' Image file, complete file recovery is highly unlikely. Your best alternative is a recent backup of the files.
If you have a recent Image file on a FAT16 or FAT32 partition, complete file recovery is still unlikely, but is improved if you have recently defragmented the drive. Use the instructions below for running the UnFormat utility from Norton Utilities.
Using the UnFormat utility
Use this procedure only if you had Norton Utilities on the system prior to the file deletions, and you have a recent Image file (IMAGE.DAT and IMAGE.IDX). This procedure cannot be reversed, and is unlikely to get back all your data. You are more likely to get back useful data if you ran a disk defragmentation utility shortly before the files were deleted. Norton Utilities' UnFormat program restores a backup of the FAT from the Image files made by Norton Utilities. If no Image file was made, this procedure is highly unlikely to recover your files.
Backup your data:
Since any Windows program, including backup programs, can cause the swap file to grow and overwrite deleted files, do not make backups while booted into Windows. Instead, boot the system to a DOS prompt and backup your files from there, either by copying the files, or by using a DOS backup program.
If you are unable to backup your files from DOS, then whether to backup your remaining data files from within Windows before running UnFormat depends on whether you have a recent set of backups, how recent the Image file is, and how important your remaining data is in comparison to the data that the worm deleted. The UnFormat process reverts your system to the File Allocation Table (FAT) configuration it had at the time the Image file was created. So if the Image file is old, or if many of your files were updated since creating the Image file, the updated files may no longer work after running UnFormat. Generally, if you have recent backups and a recent Image file, do not make backups from within Windows before running UnFormat. This maximizes your chances of file recovery of the deleted files. If your Image file is old, or you have no backups, and the remaining data is just as important as the lost data, you may want to risk making backups before running UnFormat.
To recover the files, run UnFormat and then Norton Disk Doctor, as follows:
- Insert Emergency Disk 1 into the boot drive.
- Turn on your computer and wait for the Norton Utilities screen to appear.
- Use the Arrow keys to select UnFormat.
- At the prompt, and after UnFormat, type the drive letter of the drive and press Enter.
For example, UNFORMAT D: means that UnFormat will try to unformat the D drive.
- Follow the on-screen instructions.
- Leave Emergency Disk 1 in the boot drive and restart the computer.
- Wait for the Norton Utilities screen to appear.
- Use the Arrow keys to select Norton Disk Doctor (NDD).
- At the prompt, and after NDD, type the drive letter of the drive and press Enter.
For example, NDD D: means that Norton Disk Doctor will diagnose your D drive.
- Follow the on-screen instructions. When Norton Disk Doctor reports lost clusters, it allows you to either delete the clusters, or make them into files. Do not delete the clusters. Make them into files instead.
- Remove Emergency Disk 1 from the boot drive and restart the computer.
- You will find files with names in the format *._DD. If there was an Image file on the drive, there should be one or more *._DD files for each deleted file.
- Open each *._DD file in any text editor to determine whether it has the missing data.
- If the deleted file was in a non-text format, such as Excel, rename each *._DD file to that format, such *.XLS for Excel files, then open the file in that program, such as Excel.
Data recovery services
All data recovery services charge for their services. None can guarantee that they will successfully recover your data. However, some companies may be willing to provide you with an estimate of the chances for recovery. A successful recovery depends on many factors.
- Data Recovery Companies may accept NTFS drives. These companies are likely to recover data from physically damaged hard drives as well. Look for data recovery companies in your local phone book, national computer magazines, or on the Internet. You may want to check with these companies about the possibility of recovering files from an NTFS partition. Symantec does not endorse particular data recovery companies.
|
