Entourage 'virus' has wiped an entire account

[AlBDamned]

Before you say it, I know there are no known viruses for OS X.

However, my mother has just called to ask me if I knew any way to recover an entourage account as she has just had a 'virus' email which has deleted her entire mailbox setup from her hard drive.

She recevied several emails from a phantom admin@hercompany.com address that included Zip files, none of which she has opened. The emails said: "Your account is due to be suspended due to a virus". She then forwarded these to her service provider who, although he said it was unusual, said she had a virus and there was no way of recovering them from her Mac.

Luckily, they are all stored on a remote server anyway, so it's just a case of downloading them again. She is also switching to Mail for her email and ditching the M$ B/S.

Now I know there are no viruses for OS X, you know there are no viruses for OS X, but what could have deleted her account if it wasn't a virus or malware of some sort?

The odd one out here is it's an Office program that lost its mojo but I still don't have a clue.

Also, where should she look for a backup, if there is one left, on her HD? Thre's nothing in Library>Mail as she wasn't using Mail, and there's nothing in the Microsoft User Data file.

It's all a bit bizarre/worrying/time consuming.

 

[yellow]

I'm thinking it didn't delete her account.

I'm thinking her ISP is wrong.

Probably what she got was some regular old self-propogating virus email. My users get them from time to time purporting to be from us (the support group), telling them their accounts have been suspended for one reason or another. They include a zip file, which clearly contains the virus. Even if your mom had opened it, it would have a contained a Windows executable or a Windows script, neither of which would have run on her Mac.

 

[mad jew]

I'm thinking it didn't delete her account.

You're probably right but then how come her emails have all disappeared?

 

[yellow]

"Mothers" are notoriously adept at misinterpreting what they see on a computer screen when speaking to their sons via the telephone.

 

[mad jew]

Very true.

 

[AlBDamned]

I'm thinking it didn't delete her account.

I'm thinking her ISP is wrong.

Probably what she got was some regular old self-propogating virus email. My users get them from time to time purporting to be from us (the support group), telling them their accounts have been suspended for one reason or another. They include a zip file, which clearly contains the virus. Even if your mom had opened it, it would have a contained a Windows executable or a Windows script, neither of which would have run on her Mac.

Well, she's not dim by any standards. This is her work email account on a G4 powerbook, the Entourage account on which was fine until this morning.

I am fully aware of the dodgy crap sent from supposed Admin addresses, but whatever happened the emails are not where they are supposed to be and it looks certain they have gone AWOL.

Saying she is adept is at misinterpretation sounds like typical IT Bod speak for "I'm stumped" to me .

Any constructive ideas as to what could have happened (other than her moving/deleting the emails which I'm reasonably sure she hasn't done.

 

[telecomm]

Well, if indeed the problem email is kept on the server side, redownloading all of her mail won't help anyway, since she'll just download the purported problem email again.

In order to avoid this, of course, your service provider would have deleted the problem email from her account, i.e., the service provider would have been messing with her email account on the server side, could that account for her problems?

On the other hand, maybe Entourage is messed up. Try rebuilding the Entourage database (instructions can be found in Entourage help).

Good luck.

Oh, and I guess I should note that Entourage databases do get messed up from time to time, hence the rebuilding option.

 

[yellow]

I'm DEFINITELY not saying your mother is stupid.

I'm also not stumped. It just so happens that users who are not computer professionals or bleeding edge tech junkies typically misinterpret what they see. They don't adequately describe the problem. It's a fact of life in support. Ask any support person (besides me).

I'm just telling you how it is. I'm fairly positive that email did NOT erase her account. It would be the first virus for Mac OS X caught in the wild. You'd (she'd) be famous.

If this is her work account, why isn't her work's IT support people taking care of it? Have you actually SEEN the "infected" computer? "Seen" the missing emails (or lack thereof)? Is all this being described over the phone?

Whatever happened, it's coincidental. Otherwise, I'll look forward to seeing your mom on the beeb.

 

[rainman::|:|]

Agree with Yellow. If her emails are actually deleted (and not misplaced, moved, transferred, inaccessible, misconfigured or hidden) then it was something else. Those spams are very common, some spammer has started spoofing our Admin's email address as well, making tons of users (both PC and Mac) think they're infected, when they're not (well the PCs have a ton of spyware, but no one mentions that). Someone with a good tech background is just going to need to sit down and figure it out.

 

[AlBDamned]

I would agree, I don't think this is a 'virus' as she would indeed be famous. More likely it is an entourage mess-up and the BT guy she spoke to couldn't be stuffed to deal with it fully. The virus email looked like an easy option and he took it (they're are incredibly helpful, BT). Since the two things (virus email and losing account), did coincide, it's reasonable for her to reach the conclusion that the two are linked (even though I have repeatedly said to her there are no viruses for OS X.

The reason she cannot call her company's IT people is because she is her company and her IT support amounts to what people can tell her over IT support lines. She had no luck with BT as I've said, her mail servers said that she can re-download her emails but this is going to take a fair while and then she called me (the last resort ).

I will call her later for an in-depth discussion about it and try and make sure she doesn't misinterpret anything but I can't go see her as they live two hours away.

So, at the moment, her entourage account has gone walkabout and the only way I can maybe dissect the case is over the phone, plus whatever screen shots she can send me if needed.

I think there is a more reasonable explanation, and more than likely, a cr*p piece of Microsoft software bugged out on her. But it's worth asking if anyone else knows of this problem with Entourage.

A restore or rebuild may work.

 

[AlBDamned]

Agree with Yellow. If her emails are actually deleted (and not misplaced, moved, transferred, inaccessible, misconfigured or hidden) then it was something else.

Like what though?

 

[XNine]

Like what though?

Corrupted preference files, or a databse issue (which, as one poster noted, happens often with Entourage, hence the Rebuild option). She may have accidently erased the account, etc.

You'll have to troubleshoot the issue before you know the actual culprit in this. Try deleting the Entourage PLIST files in under her USER ACCOUNT>LIBRARY>PREFERENCES. Make sure Enourage is closed at this time, when done open Entourage. If this doesn't correct it, use the REBUILD option in Entourage itself. These are most likely to be the primary issues. The third is a permissions issue, and so on and so on.

 

[AlBDamned]

In order to avoid this, of course, your service provider would have deleted the problem email from her account, i.e., the service provider would have been messing with her email account on the server side, could that account for her problems?

The emails have been deleted from her hard drive, not her 'account' in that sense.


None of the three; preference lists deletion, rebuild database or a repair of permissions has helped in any way, unfortunately.

 

[sushi]

"Mothers" are notoriously adept at misinterpreting what they see on a computer screen when speaking to their sons via the telephone.

I would like to add: Fathers, Brothers, Sisters, Friends, Co-workers, etc.

These days, if helping someone, I very rarely like to do it on the phone. It is so much easier in person.

Sushi

 

[sushi]

Saying she is adept is at misinterpretation sounds like typical IT Bod speak for "I'm stumped" to me .

I don't believe that was the intent of the original reply.

Realistically, trying to support someone over the phone is a challenge to say the least. It is very easy to missunderstand each other and have a misscommunication. This has nothing to do with smarts, degrees, or expertise in computers. A phone is simply not the best tool to troubleshoot over.

The personal touch is always the best when you can do it.

Sushi

 

[yellow]

Sounds like she should be going to her most recent back up..

 

[AlBDamned]

Sounds like she should be going to her most recent back up..

Yeah. it's not that recent though unfortunately. For now, she has downloaded everything from the last month, the back-up is about three months previous (when the office moved it was all backed up), so there is about two months of stuff gone at the moment. I can't get down there to have a look for a week or so.

And I guess I said 'stumped' as no solid suggestion was posed but no worries. I agree - the phone is poor for troubleshooting.

BTW Yellow, we are probably moving to a new (newer than NT anyway) server soon, following a chat with our head IT guy. Will be when the next new Mac arrives.

 

[kalisphoenix]

I would like to add: Fathers, Brothers, Sisters, Friends, Co-workers, etc.

These days, if helping someone, I very rarely like to do it on the phone. It is so much easier in person.

Sushi

How true. I accquired an iceBook for my mom recently, and yesterday she called me from where she works, panicking. Her exact words were "I hit a key and the screen went blank." What she should have said, what actually happened, was that she was typing in TextEdit and all of her work in that window disappeared. It cost about fifteen minutes of me saying wtf and wondering if we got a lemon laptop when the simple truth is that my mother is @#$%ing retarded and incapable of explaining a situation properly. Mind you, she's used computers since 1993 and it took her over an hour of use to realize that the big square button on her iBook is a mouse button.

Me: *tries to explain how to move documents to and from a USB pendrive* "No, no, click *that* button. The big square one in front of the trackpad."
Mom: "Wait! So... this button is like 'enter'?"
Me: ".... no, that's a mouse button. You remember mice, don't you ma?"
Mom: "And this thing..."
Me: "That's a trackpad. It's like a mouse. Don't act stupid, ma, you were just using it like a pro three minutes ago."
Mom: "So this is the mouse button?"
Me: "Yes. Macs only have one mouse button."
Mom: "As opposed to what?"
Me: "The PC you used for six years had two buttons and a scroll wheel on its mouse, ma, and our first computer that we had for five or six years before that had two mouse buttons."
Mom: "Wow."
Me: "How about you let me have this laptop, and I'll get you a Palm?"
Mom: "No @#$%ing way."

 

[AlBDamned]

Boing......

Problem solved (not by me)....

A G5 iMac my mum bought last year for her office came with a year's free IT support and servicing. The guys came up yesterday for it's final tune up and I pointed out to her that these people would quite likely be able to help her with this Entourage problem.

So, they troubleshooted and found the entire database had been moved and was in the wrong folder deep, deep down somewhere. It's permission had been screwed when moved (god knows how that happened but I've been assured it wasn't a conscious action), and it cocked the whole thing up. So, the database file is now back in the right place, a permissions check was run and all now running smoothly. I don't know what the file would have been called though and mum can't remember so that's a little annoying. Searching under 'entourage', 'mail', '@' and other things did not throw it up before so it must have been something completely different.


Now, where was the name and number of that dumbass BT engineer who told her it was an OS X virus....

 

[yellow]

[incoming] I told you so [/incoming]

 

[AlBDamned]

[incoming] I told you so [/incoming]

LOL, you did, you did.

**dives head first into mild sheepishness**

Glad she got it sorted though. Having never used Entourage I would not have had a clue on finding that mis-placed file myself. Wish I had been there to watch the pro's fix it properly.

 

[yellow]

Also definitely glad it got sorted. And that it was a (relatively) easy fix. It sure beats having to start over from scratch. Now would be a good time to remind your Mom that a good backup practice would have saved her from this fiasco.

 

[AlBDamned]

Now would be a good time to remind your Mom that a good backup practice would have saved her from this fiasco.

With a bit of luck, that message has now got through but we will see....

 

[plinden]

I don't know a lot about Entourage, but since it's the Mac version of Outlook, I have a question. Did she have a large amount of email, say > 2 GB worth?

I ask this because Outlook stores mail in a custom .pst file, which is limited (in Outlook 2000) to 2 GB. Many Outlook users I know have lost all their email because they went over the 2GB limit.

This may be the issue here, but like I said, I don't really know.

Edit: sorry, should have read the whole thread, but still I'd like to know, is this ever a problem on Entourage?

 

[iMeowbot]

I don't know what the file would have been called though and mum can't remember so that's a little annoying. Searching under 'entourage', 'mail', '@' and other things did not throw it up before so it must have been something completely different.

In case you need to go though this again:

~/Documents/Microsoft User Data/Office 2004 Identities/Main Identity/Database

Yes, they stuck it right in the user documents folder where it's easy to accidentally move, and the name is a wee bit generic.