Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

Office updates files just read?

- - - - -

  • Please log in to reply
9 replies to this topic

#1
pointertovoid

pointertovoid

    Advanced Member

  • Member
  • PipPipPip
  • 466 posts
  • Joined 16-January 09
Hello dear friends!

I regularly notice that (with Office 2003 Pro) XLS files are modified on my Internet machine, despite their modification date has not changed according to Windows, and their size neither.

Before I imagine some worm...
Can it be that Office writes in the file each time I open an XLS to read it but don't save the changes if any? And that Office restores the old modification date despite having altered the file's contents?

Thank you!


How to remove advertisement from MSFN

#2
submix8c

submix8c

    Inconceivable!

  • Patrons
  • 4,331 posts
  • Joined 14-September 05
  • OS:none specified
  • Country: Country Flag
What, exactly, is being Modified? Can you detect that?

edit - possible - BUT can't tell for sure UNLESS a "clean" XLS is placed into the affect machine and you "edit" (open/close) it and compare "binary" the differences.

quick "google" says SOME kinds of trojans exist, but you need to dfo above first to tell WHAT "may" have changed, otherwise... :unsure:

Edited by submix8c, 24 June 2013 - 06:56 PM.

Someday the tyrants will be unthroned... Jason "Jay" Chasteen; RIP, bro!

Posted Image


#3
Kelsenellenelvian

Kelsenellenelvian

    WPI Guru

  • Developer
  • 8,823 posts
  • Joined 18-September 03
  • OS:Windows 7 x64
  • Country: Country Flag
Three letters...

NSA

#4
Tripredacus

Tripredacus

    K-Mart-ian Legend

  • Super Moderator
  • 9,913 posts
  • Joined 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Donator

I had noticed, in the past, that some files have one of the 3 dates "changed" when you open a file but don't modify it at all. No real examples... But maybe you (op) can explain exactly what you are seeing. :unsure:
MSFN RULES | GimageX HTA for PE 3-5 | lol probloms
msfn2_zpsc37c7153.jpg

#5
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,798 posts
  • Joined 12-May 07
  • OS:none specified
  • Country: Country Flag
But from what I understand from the OP, the file dates were NOT changed, but the content WAS? Very mysterious.

Cheers and Regards

Posted Image


#6
pointertovoid

pointertovoid

    Advanced Member

  • Member
  • PipPipPip
  • 466 posts
  • Joined 16-January 09
What I've seen:
- I make backups of my files between two computers, including XLS files, hence detect changes when synchronizing
- The file properties displayed by Window's Explorer remain the same, including the date of modification and the size
- But the synchronizing software tells that the files have changed
- The user's contents is the same
- When comparing both files with a text editor, hence in a big and not intelligible form, I see one tiny difference, like 2-4 bytes at one single location.

So before considering some kind of malware, I'd like to check more banal explanations.

One possibility would be that Excel stores a "last read date" within the file contents (and not at the containing folder as Windows does), updates it accordingly each time I read the file, but after writing the file with updated "last read date", restores the previous "date of modification" in the folder - something Window allows.

One reason why NSA-like explanations are not my first ones is that I notice this with XLS files only.

Edited by pointertovoid, 26 June 2013 - 02:06 AM.


#7
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,360 posts
  • Joined 21-April 05
  • OS:none specified
  • Country: Country Flag
I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

GL

#8
dencorso

dencorso

    Iuvat plus qui nihil obstat

  • Supervisor
  • 5,954 posts
  • Joined 07-April 07
  • OS:98SE
  • Country: Country Flag

Donator

I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

Did you investigate it further? I mean... did you ascertain what those changes mean?

#9
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,360 posts
  • Joined 21-April 05
  • OS:none specified
  • Country: Country Flag


I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

Did you investigate it further? I mean... did you ascertain what those changes mean?

I assumed it's something like "last access timestamp" or probably the counterpart of Word's "store random number to improve merge accuracy" which:

1. I never quite understood how it works
2. I read somewhere is the exact opposite of what it says, as regards to privacy :ph34r:

GL

#10
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,583 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

- When comparing both files with a text editor, hence in a big and not intelligible form, I see one tiny difference, like 2-4 bytes at one single location.

Compare them in a HEX editor instead :whistle: and post the offset at which the change occurs (it is likely to be a "fixed" address, but verify by checking more that on e "couple" of files).
Even easier :yes: , use FC (with the /B option) and post results:
http://ss64.com/nt/fc.html

jaclaz




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users