Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
3 days ago, the date on ALL files on my PC unexpectedly changed to 12/29/91. I assumed it was a virus but an (up-to-date) Norton Antivirus scan couldn't find anything. Then, the file, ddeml.dll (in the Windows system directory) complained in a popup that it had been replaced by an older version - so I copied across a replacement from the sysbackup folder. However, the popup returned (presumably because this backup file was, by now, also dated 12/29/91).
Not sure if I have a virus, whether it was the result of a power cut, whether this actually represents more than just one problem AND, most importantly, what I can do to restore everything. Any views?

Nice thought Dan; but no, on checking the BIOS displays today's date. Does this take you any further forward with the diagnosis?

I'm not a big favourite of Norton AV, (I've seen it miss a lot (and it's a system hog)) but that's besides the point. ;>) I suggest running an on-line virus scan at Trend Micro next. They're pretty thorough so it'll take a while, but it's worth the check.
http://housecall.trendmicro.com/housecall/start_corp.asp

Thanks for suggestion. Trend Micro just finished, and it confirmed there's no virus. Next logical step?

Hello Dan, Felixd,
Maybe, just maybe, someone has installed a prank s/w that tweaks like this?
Anything else unusual happening lately?
Good Luck and Happy Computing,
Kailas Shastry,
Sempron 2400 underclocked to 1GHz...just for the heck of it! MSI KT266VM
DDR 256MB

Hmmm. I have nothing else at the moment but it has me thinking. What could have the ability to timestamp ALL files on a system? The only thing I could think of initially was a bios function or a trojan/virus.
I do have a (computer) game I bought which on one day of the year (if you're playing it that day), plays a sound file of people at a birthday party singing Happy Birthday to one of the games creators. It's totally non-destructive but it has to do with the date. I'm wondering if maybe something like this may be at play.
I'll keep thinking and watching..........

"Formatting wont help unless you try to clean the bios and the RAM at the same time. When you defrag.. at the bottom of the display box/ activity view... is there a very large BLUE section that takes up allot of space? This is upper memory area.. where DOS programs are stored. Its a tell tale sign if this block islarge, especially if its like 20% of your hard drive."
Complete and utter nonsense
Drop the last year into the silent limbo of the past. Let it go, for it was imperfect, and thank God that it can go.

Thanks to everyone for your comments - you are all obviously as puzzled and intrigued as I am with this weird re-dating of ~60,000 files.
Kailas -> with Norton and Trend Micro now both giving a clean bill of health, I've started to suspect non-viral s/w myself. I recently found some ad software on the PC and scooped most of it out with Adaware and Spybot, but still not all of it. However, I've NEVER heard of adware trojans being capable of being able globally to change fundamental file attributes, so intuitively I initially discounted it as a possibility. And Kailas, perhaps you are right - that there MIGHT be something new out there that is about to affect others too, and not just me.
Yabut -> I checked out the URL you gave me. But I'm not about to do a full backup without knowing the full implications of what else I might lose in the process. In any case, one should never operate without determining the accurate diagnosis first. We are currently no where near that - so I'll keep your ideas on the backburner for now (if that's OK with you!).
Dan -> your thoughts continue to echo mine. There's something weird going on and I'm not wired enough to figure it out - and, whilst I normally like a puzzle, but not here, whilst the fate of my previously cohesive computer system could be on the line.
Jboy - apart from the fact that I doubt any of this is likely to be centred around an upper memory issue, I do tend to agree with your judgementalism, but I don't yet know enough to be certain either way!
In summary, I appreciate ALL your comments, and welcome more.

Hi,
Had this happen several years ago when a flash BIOS only partially took.
Every single file on my computer had the time and date changed
Even the statistics dates in MS Word document properties were changed.
Had to do a full FDISK & format to get things back together.
Can't offer any real explantion or answers as to what might have caused your problems.
This program could however help
http://www.febooti.com/products/filetweak/screenshots/change-date-multiple-files-folders.html
As it will from the data on the home page allow you to change the dates on complete folders and such.
Back in the good old days I mean MSDOS this could be done very simply in Xtree, but that was before Windows 95 and everything since.Ztree is a program closely following the style of Xtree. Many of the commands are the same
http://www.ztree.com/html/ztreewin.htm
It took me back when I was using commands from memory that I hadn't used for many years.
There is a 30 trial version available.
Simply tag ( select ) the files and then change the appropriate feature such as a date.
hth
Ceri

Guys - whilst jboy and yabut kindly continue to make entertaining, protracted love to each other, I STILL have a fascinating problem to solve here, and such copious testosterone hurling perhaps won't help much. My respect to EVERYONE who adds their comments - remember a turtle only makes progress when he sticks his neck out.
Jboy - you asked me whether, aside from the popup and the timestamp mystery, all is running well?
I would (guardedly) say yes --> yes in the sense that I've noticed NO actual loss of program functionality since all my files recently acquired their new unified date (of 12/29/91).
Having said that, for completeness, I would cite 3 unexplained features, but probably irrelevant since they started much earlier :-
1. At startup, the screen goes inexplicably blank for 38 seconds just before Windows comes up and asks for the password. This blank screen time has been incrementally growing longer over the past 3 years or so.
2. Microsoft Word stopped running about 4 months ago - instead producing a message that were not enough system resources to run it. As far as I could see, there WAS enough memory, disk space, and cpu capacity. Powerpoint stopped working at the same time. I never tried to fix these problems because I rarely use Word or Powerpoint on this PC, but I have to put it down as an odd puzzle but, I sense, probably unrelated to the recent date change of files.
3. The PC often quickly hangs when I return to use it after maybe 12-24 hours, and I so have to reboot, even though it's ostensibly been inactive, only doing its basic housekeeping.
Having said all that - this PC has been incredibly reliable for years - far more reliable, in my experience, than Windows 2000 - that's why I've never 'upgraded' to a more recent Windows platform on this PC. Perhaps though, it's that I have simply been lucky with it, and now my luck's running out!
I recently toyed with the idea of upgrading this PC to Win 98 2nd edition in the hope, by doing so, I could upgrade from USB 1.1 to USB 2.0 to be able to run an external USB hard drive. Assuming we first manage to solve the current date issue - would this work?
Jboy and Yabut - love you both - talk to me, not to each other!!!!

Resources are separate from the other items you'd mentioned, and you can run out of them rather quickly if there are too many open program windows, or 'resource hog' type applications (such as Word or PowerPoint)
Have you tried scanning for altered files with SFC? As mentioned, not everything it discovers should be replaced
Anything 'unusual' show up in msconfig?
Drop the last year into the silent limbo of the past. Let it go, for it was imperfect, and thank God that it can go.

Hi,
For your MS Word problem
Find and delete all copies of a file called
normal.dot
This is the name of the file for the blank page that MS Word starts with.
The template file can become corrupted and give the error messages you detail.
For your other problems
Carry out virus scans with fully up to date signature files or on line
http://www.sarc.com
or
http://uk.trendmicro-europe.com/consumer/products/housecall_launch.php
Then download and install Spyware removal software.Ad-Aware, Spywareblaster, Spybot & CWshredder. All easily and readily found with google.
or at these sites.
http://www.lavasoftusa.com/software/adaware/
http://www.javacoolsoftware.com/spywareblaster.html
http://www.safer-networking.org/en/index.html
http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
Run each, update all of them and then run again, removing everything found.
hth
Ceri

Jboy -->
< Anything 'unusual' show up in msconfig? >
No, it looked fine.
< Have you tried scanning for altered files with SFC? As mentioned, not everything it discovers should be replaced >Happy to try but where do I find SFC, and what is it?
Ceri --> Yes, I remember xtree - found it immensely useful at the time.You can see from my earlier posts that the PC is "confirmed" free of viruses (according to up-to-date viral scans on both Symantec and Trend Micro) - i.e. we are presumably looking for ANOTHER answer, or maybe a VERY new virus.
Incidentally, at your suggestion - I removed Normal.dot, and Word STILL refuses to run. The precise message is "There is not enough memory or disk space to run Word". I would dispute this - there seems to be plenty of both!!!! Or maybe something sinister is hiding in there whilst hogging lots of resources - makes me wonder, are these SETI people still 'out there' using our PCs?

Jboy
< Have you tried scanning for altered files with SFC? As mentioned, not everything it discovers should be replaced >
OK, I've now worked out it's a start:run command. Flaky of me not to have known about it. The SFC results are as follows :-
Folders examined 211
Files examined 2110Files added to verification data file 365
Files removed from verification data file 66
Files updated in verification data file 1745Files restored 0
File changes ignored 0Does this help with your line of thought?

It's not so much my line of thought as what it finds - you use the Checker to see if System files have been altered, and, if advisable, replace them. Some files should never be replaced, and there's a bug in the Checker that causes it misidentify at least one common file. For example, if you've updated IE, that makes many legitimate changes, that's when you would use the 'update' feature.
Care must be taken or you may end up in a worse place than when you started.
It seems to me that this is not so much a problem as a mystery. While the timestamp has been altered, the files themselves seem to be ok.
The other issues you've mentioned are likely not related. Your 'Word' problem seems to render different error messages - initially you mentioned resources - not at all the same as memory or disk space. Possibly there is file corruption - SFC checks only system files (by definition)
Drop the last year into the silent limbo of the past. Let it go, for it was imperfect, and thank God that it can go.

It doesn't seem like some software fluke could cause that. It sounds more like a virus, especially since it happened at the end of the year. Maybe it was one of those time bomb viruses that lie dormant, pop up on a specific date to do their damage and then disappear.

Jboy,
< It's not so much my line of thought as what it finds - you use the Checker to see if System files have been altered, and, if advisable, replace them. Some files should never be replaced, and there's a bug in the Checker that causes it misidentify at least one common file. For example, if you've updated IE, that makes many legitimate changes, that's when you would use the 'update' feature.
Care must be taken or you may end up in a worse place than when you started.It seems to me that this is not so much a problem as a mystery. While the timestamp has been altered, the files themselves seem to be ok. >
Yes, file sizes appear absolutely normal, and I've yet to find any functionality problems, apart from constant reminders about ddeml.dll having been replaced by an older version.
I don't agree we are talking about a mystery rather than a problem, as I cannot imagine it won't have future repercussions on functionality. In fact, I am already finding it almost impossible to find files - I had no idea I searched on date so often to find recent files. And I'm sure there must be as-yet-unfound programs on my PC that will go into subscription-period apoplexy if they find key files they require are carrying the wrong dates.
< The other issues you've mentioned are likely not related. Your 'Word' problem seems to render different error messages - initially you mentioned resources - not at all the same as memory or disk space. >No, my mistake - the message doesn't mention 'resources' (that was my own mistaken synonym). It comes up with the consistent message about memory or disk space that I put into my earlier post. As with the date change issue, this Word problem is something that other users could potentially experience too, so we need to nail down what is going on.

Dave in Caps might be onto something there.
This may be a flow on effect of the Y2K issue. An impropper fix that adds 4 years might well cause this problem. I would suspect the bios is not recognising the file date to be valid and is resetting it.
A bios flash might be all that is required.

DAVEINCAPS,
< It doesn't seem like some software fluke could cause that. It sounds more like a virus, especially since it happened at the end of the year. Maybe it was one of those time bomb viruses that lie dormant, pop up on a specific date to do their damage and then disappear. >
I'd had a similar thought, but we need turn this 'maybe' into a definitive diagnosis. Are you suggesting I send a file to Symantec (my anti-viral provider), and if so, my problem is .... which one? Out of >60,000 files on my PC, they all seem to have retained their own individual sizes, yet are all now 'created' on the same date! I have NO candidate file to send. Anyway, wouldn't it have to be a spectacularly well-designed virus to change the date attribute on ALL file types, without exception, irrespective of whatever file extension they might have?

Rimfire,
< Dave in Caps might be onto something there.
This may be a flow on effect of the Y2K issue. An impropper fix that adds 4 years might well cause this problem.But wouldn't such a virus already be well known? I mean - if it's sitting around on PCs all these years - wouldn't Symantec or Trend Micro have picked it up by now?
I tried to look up their viral information files to see if any viruses are known to incur date changes but (during my limited search) couldn't find anything that did anything remotely close).
< I would suspect the bios is not recognising the file date to be valid and is resetting it. A bios flash might be all that is required. >Please tell me exactly how would I do that?
And, what would be the downsides, if any?If there were no potential downsides I could try it anyway - even before a definitive, logical, differential diagnosis have been reached. And, if you are right, I guess it could even be the clincher for the diagnosis.

I didn't say anything about a virus. I thought you had done enough to eliminate that possibility. I was refering to the date one which the problems started.
You need to go to the Dell website and check if they have any updated bioses for your computer and see what they fixed. If this is a Y2k+4 problem, then there almost certainly be one there to fix it (even with Dell).
If there is one, you will need to download it and load it on a floppy disk. I'll leave further instructions as they can be found with the updates and hell I'm only grabbing at straws, I could be completely wrong!

Not so sure it will help much but just for info if you type sfclog.txt in the Run box it will tell you exactly what files were changed and when (see last run). It will also indicate if their version numbers changed.
Derek.W

You've done a virus check and it hasn't come up with anything so either it isn't there or it's something new. I thought I'd heard some of those time bomb viruses self destruct after doing their damage, in which case it wouldn't be there to find. But I don't know enough about them to say for sure.
I did a brief google search but couldn't find any references to a virus that changes all the file dates.
I too thought of a Y2K problem or bad battery but they would only alter the computer time and date and not the existing file dates.

http://www.troubleshooters.com/tfresh95/prepare.htm
"WARNING: The BACKUP.exe included in Windows 95 backs up beautifully, and restores your files accurately, but it sometimes sets your file dates to the restore date, rather than the date of the backed up files. I consider the backup program that comes with Windows 95 to be UNACCEPTABLE for that reason."YABUT(all verisions of windows load win95 hidden because it is the only MS o/s that can be networked OFF of)
http://www.eweek.com/article2/0%2C4149%2C1383111%2C00.asp
Bugs, Old File Dates in New Microsoft Patches
"The various versions of the patch, for different products and versions of Windows that contain the FrontPage Server Extensions, all contain multiple files with various dates, but in all cases the only recent files are related to the patching installation code and not the patch itself.
We contacted Microsoft for comment on these reports, but the company has not yet responded.November 14, 2003"http://www.annoyances.org/exec/forum/win2000/t1050958838
blank property boxes
YABUT(check your DLLs for NO install date)http://www.kbalertz.com/Feedback_231691.aspx
This behavior can occur if you are running Norton Disk Doctor 4.0 and the computer's CMOS contains an incorrect date (which can occur if the computer's system battery is weak or expired).
Yabut.. it says a fix and a complete reinstall is necessary but, I'll bet you a bottle of Crown Royal that even if you do this the problem will repeat itself.
A computer is a perfectionist's nightmare.

A similar thing happened to me today. I have a six-year-old computer with win 98 SE and 384M RAM. I use Firefox 1.0 and occasionally IE 6.0 and have checked for viruses (Norton), spyware (AdAware), and have not loaded any software recently. I check for updates frequently. A couple days ago the internet service slowed to be slower than a dead snail. I use a dialup connection that has given me no trouble for quite a while.
I just did a defrag and noticed that all my files dates have been set to 1/4/80. They weren’t before the defrag. After the defrag I restarted and got a dialog box saying I needed to set the date and it was shown as 1/4/80. The computer took the new date and files newly created have correct dates and times, but I am suspicious of multiple problems occurring simultaneously.
I checked for altered files with SFC and looked for odd items using msconfig but found nothing.

"..all verisions of windows load win95 hidden because it is the only MS o/s that can be networked OFF of)"
Can you expand on/clarify/*~justify~* this comment?
I look forward to your answer.

Its a very simple and clear statement.
Research it if you like. I originally found the refs on line researching this exact problem.Thy get better at hiding it, but looking thru a win98 hard drive, its easily seen. Especially in your update folder.
Lotsa stuff is hidden, for instance.. and I find this just stumping...
While working on brand new store bought computer before being connected to the net or loading any other programs.. I saw in the BOOTLIST.. both old versions of IE and netscape. Ya couldnt find it on the hard drive, but you could in the registry. Now why... would win98 ( MS) load a version of netscape? Or where does it come from. Which came first? The bios or the windoze>? One of em loads this, and why ?"File1=1,,browsers\nc40\Netscape.ex_,Netscape.exe,$(AppPath)\Netscape\Program,,,04/13/98
9:47:00,10000,,"","Netscape
Communicator",""Its interesting. Is it loaded or does is set things WHEN netscape gets loaded>? If so.. why is it there from MS>? Or is it from the bios?
A computer is a perfectionist's nightmare.

This certainly wouldn't be in the bios.
I believe what you (think you) are seeing is there for backwards compatability only, going back to windows 3.1. As in your above excerpt, *IF* Netscape happened to be loaded on a machine, the "handlers" for it are there.

Thanks Dan,
I kinda leaned that way too. Im just so surprised that Microsoft would load anything at all to do with Netscape.A computer is a perfectionist's nightmare.

There are wadges of references to various products in the registry even on a virgin installation. This, I would think, is to allow for the major ones as far as is reasonable.
Similarly there are a whole stack of driver files on the machine for hardware devices that you have not got fitted.
Bloated maybe but I don't believe there is some wicked attempt to hide things (although that makes a much better story). Paranoia can be fun but it is often far from the truth.
Derek.W

"although that makes a much better story"
;>)
"Paranoia can be fun but it is often far from the truth."
Now THAT's the truth.

My computer is doing the same thing. It has suddenly changed all the files to 2/12/2000 the only files that kept their dates were the operating files for windows. All my documents and other files had the dates changed. I have checked for virus with several of the online checkers and haven't found any virus by them. Did you ever find out what was causing the problem and how to fix it?
Peggy

Different posters above related different activities leading up to the file date changes on their computers. Do any of their experiences match yours?

My computer crashed the day or so before and I had also installed AVG 7 virus at about the same time. I used scanreg /restore in getting it started again. I am on a Compaq 7470 533/97 MHz 64MB computer running win98 second edition. I had also run a complete scan and defrag at about the same time period. I was doing some internet research on virus yesterday and the nearest virus that I found that came near to causing this kind of problem was W32/mypics.worm The computer seems to work ok on most of the programs that I use (ie for the internet and
Ezphoto & I-View 32 for my images) I'm just worried about future consequences with the files. I have uninstalled the virus software thinking that it might be the culprit but see that since the file dates are already changed it made no difference. I tried going back on the scanreg restore and it didn't take me back far enough to see if that made a difference. I hesitate to do anything drastic as it seems to work fine at the moment. I am not all that computer savy--know just enough to get in trouble :) Here is what the sfclog exam revealed:209 folders examined.
2213 files examined.
756 files added to verification data file.
68 files removed from verification data file.
401 files updated in verification data file.
0 files restored.
0 file changes ignored.I sure would like to know how to go back in time. I used to have First Aid installed on the computer and it allowed you to backtrack and restore registry. The only trouble with comparing the file dates on the sfclog is that my personal data files are not included and I can't find where their create dates would be. If they were known I would just use software program like AttributeMagic Free to change them back. My problem pretty much mirros Felixd except for the date. Sure hope you can help us and if anyone does know the cause Please write and let us know even if this thread dies before it is solved.
Peggy

There are utilites to change the file date but, since it's unlikely that whatever changed them in the first place kept a log, there's no way to know what the original dates were. The file dates aren't stored in the registry so restoring an older registry won't help.
Normally a file date would change if a file was modified, or just opened with editing software and then re-saved even if it wasn't changed. But that sets the file date to the current date. So maybe there's two mysteries--why the date changes and why it doesn't change to the current date.
It's an intriguing problem and I'd like to know its cause but right now I can't do anything but speculate.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |