Sign in to follow this  
Followers 0
pointertovoid

Office updates files just read?

10 posts in this topic

Hello dear friends!

I regularly notice that (with Office 2003 Pro) XLS files are modified on my Internet machine, despite their modification date has not changed according to Windows, and their size neither.

Before I imagine some worm...

Can it be that Office writes in the file each time I open an XLS to read it but don't save the changes if any? And that Office restores the old modification date despite having altered the file's contents?

Thank you!

0

Share this post


Link to post
Share on other sites

What, exactly, is being Modified? Can you detect that?

edit - possible - BUT can't tell for sure UNLESS a "clean" XLS is placed into the affect machine and you "edit" (open/close) it and compare "binary" the differences.

quick "google" says SOME kinds of trojans exist, but you need to dfo above first to tell WHAT "may" have changed, otherwise... :unsure:

Edited by submix8c
0

Share this post


Link to post
Share on other sites

I had noticed, in the past, that some files have one of the 3 dates "changed" when you open a file but don't modify it at all. No real examples... But maybe you (op) can explain exactly what you are seeing. :unsure:

0

Share this post


Link to post
Share on other sites

But from what I understand from the OP, the file dates were NOT changed, but the content WAS? Very mysterious.

Cheers and Regards

0

Share this post


Link to post
Share on other sites

What I've seen:

- I make backups of my files between two computers, including XLS files, hence detect changes when synchronizing

- The file properties displayed by Window's Explorer remain the same, including the date of modification and the size

- But the synchronizing software tells that the files have changed

- The user's contents is the same

- When comparing both files with a text editor, hence in a big and not intelligible form, I see one tiny difference, like 2-4 bytes at one single location.

So before considering some kind of malware, I'd like to check more banal explanations.

One possibility would be that Excel stores a "last read date" within the file contents (and not at the containing folder as Windows does), updates it accordingly each time I read the file, but after writing the file with updated "last read date", restores the previous "date of modification" in the folder - something Window allows.

One reason why NSA-like explanations are not my first ones is that I notice this with XLS files only.

Edited by pointertovoid
0

Share this post


Link to post
Share on other sites

I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

GL

0

Share this post


Link to post
Share on other sites

I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

Did you investigate it further? I mean... did you ascertain what those changes mean?

0

Share this post


Link to post
Share on other sites

I've noticed this as well, a long time ago. File and folder date isn't modified, few bytes inside the file are.

Excel 2003 does it, Excel 2010 doesn't.

Did you investigate it further? I mean... did you ascertain what those changes mean?

I assumed it's something like "last access timestamp" or probably the counterpart of Word's "store random number to improve merge accuracy" which:

1. I never quite understood how it works

2. I read somewhere is the exact opposite of what it says, as regards to privacy :ph34r:

GL

0

Share this post


Link to post
Share on other sites

- When comparing both files with a text editor, hence in a big and not intelligible form, I see one tiny difference, like 2-4 bytes at one single location.

Compare them in a HEX editor instead :whistle: and post the offset at which the change occurs (it is likely to be a "fixed" address, but verify by checking more that on e "couple" of files).

Even easier :yes: , use FC (with the /B option) and post results:

http://ss64.com/nt/fc.html

jaclaz

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.