Empty Barca Folders! [Resolved: Virtumonde infection]

[jayno]

Help!

Booted up my PC this morning and opened Barca. The skin had changed, the email window headings (From, Subject, Date Received etc) had disappeared, and only my latest Inbox emails were shown.

All my folders - with thousands of important emails from the last 7 years - were empty!!

Can anyone tell me what has caused this? Has there been an event at the Poco Systems Server? Has an automatic update occured? Is this a recognised 'fault' that people have seen before?

I'm desparate to get all my emails back.

[Eric]

Help!

Booted up my PC this morning and opened Barca. The skin had changed, the email window headings (From, Subject, Date Received etc) had disappeared, and only my latest Inbox emails were shown.

All my folders - with thousands of important emails from the last 7 years - were empty!!

Sorry to hear about your strange problem.

Can anyone tell me what has caused this? Has there been an event at the Poco Systems Server? Has an automatic update occured? Is this a recognised 'fault' that people have seen before?

A bit difficult to know what's causing this, although it has nothing to do with PSI's server.
What automatic update are you talking about? Windows update, Barca's update?
I for sure haven't seen it happening here. I still got all my emails and settings.

I'm guessing something erased your emails and settings, so I'm leaning towards cleaning software as a possible culprit.
Another thing would be malware installed on your PC.
If you want to make sure, have a look at Cleaning an hijacked computer.

Also have a look in Explorer inside the Mail directory to see if there's anything left as well as all of Barca's settings.
Or your index files became corrupt, including your barca.ini file.
If you do find all *.IDB files inside that Mail directory, delete them and restart Barca so those will be rebuild.

I'm desparate to get all my emails back.

Don't you have a backup of all your messages, including Barca's settings
Always let Barca take a backup or use some 3rd party software.

Let me know what you find.

[jayno]

Thanks Eric

When I get home from work I'll see what I can find.

[Eric]

You're welcome Jayno.
Hope you'll find what's wrong.

[jayno]

Eric

I have rebooted the PC and this time when I opened Barca my emails are back in the folders (thank the Lord!), but I still get the changed skin and format. Very weird.

In the email pane all I can see are the list of emails according to what folder/s I have tabbed, e.g. 'In', 'Sent' etc.

What I have lost are the column headings!

Following the instructions in the Help menu, I went to Options, Index Columns, and Column Visibility - the Headings I should be seeing (Subject, From, Sent, To, Received) are all ticked but they are not appearing, even if I OK the window, untick and retick them and OK again.

Any idea what I should do now?

[Eric]

I have rebooted the PC and this time when I opened Barca my emails are back in the folders (thank the Lord!), but I still get the changed skin and format. Very weird.

Whew !!! That's really good news.
Don't wait to make a backup of it.

What I have lost are the column headings!

You mean you don't see those headings

Any idea what I should do now?

All I can think off is resetting your ini-file.

Here's how to do it:
1. Close Barca first.
2. Rename barca.ini to barca_old.ini
3. Restart Barca now
Prior to renaming that file, it would be best to take screenshots of your Options or noting them down.

I would also perform an online antivirusscan, as well as downloading SUPERAntispyware and MalwareBytes Anti-Malware.
Just to make sure there's no malware involved.

See what it gives and keep me informed.

[jayno]

Thanks again Eric

Since I wrote a little while ago I have managed to get my Headings back by going through Tools, Customise and resetting my index and pane layouts.

It's becoming more and more obvious that all my settings somehow reverted to either a default or some old set that I don't remember. For example, even in my top Toolbar icons, the Delete icon I normally display had gone, and the Today icon was there, when I never display that. Again, I have now re-arranged all these. Gradually I'll get the skin, colours, fonts etc back to where I want them.

I have very good security on this PC ( ESET smart security - which is a combined Firewall, AV and spyware package that auto-updates daily ), but I will run some other security programmes through it even so. I'll also do a new backup. This has given me quite a scare.

I appreciate your efforts to get me back to the right place. I'll let you know how I get on and if I find anything suspicious.

Stay good
Jayno

[Eric]

Thanks again Eric

My pleasure Jayno.

Since I wrote a little while ago I have managed to get my Headings back by going through Tools, Customise and resetting my index and pane layouts.

That's good to know you could do it this way.

It's becoming more and more obvious that all my settings somehow reverted to either a default or some old set that I don't remember.

Indeed, something must have reverted it or deleted or cleaned it up.

I have very good security on this PC ( ESET smart security - which is a combined Firewall, AV and spyware package that auto-updates daily ), but I will run some other security programmes through it even so. I'll also do a new backup. This has given me quite a scare.

I know ESS, I've used it quite some time before. Even the beta's.
I'm more into layered defense, so not only relying on my security suite.

It only has to happen once before you realize you didn't do the right thing. Taking a backup(s) is necessary.
Same here, although next to backups, I'm also making images on weekly bases.

I appreciate your efforts to get me back to the right place. I'll let you know how I get on and if I find anything suspicious.

No probs, I'm glad you recovered most of it.
Curious to know what the culprit is or was.

Till soon.

[jayno]

Hi Eric

My PC seems to be OK (fingers crossed) and Barca is functioning normally now I have re-set all the settings.

Having had this calm for a couple of days I updated Spybot Search & Destroy this evening and ran a scan. Apart from finding the usual list of tracking cookies (associated with browsers), the one significant infection it turned up was:

Virtumonde: [SBI $0FB400C8] Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21- etc etc

Can't be certain, but given this thing gets into the Settings section of the Registry, it may be the culprit? Anyway, after Spybot fixed it I downloaded VundoFix from atribune and ran that too to check everything is clear. Seemingly it is, but I'll stay alert as I read that Virtumonde comes in different versions and sometimes can be very difficult to find, even with VundoFix.

I trust this is of interest.
Wish me luck.
Jayno

[Eric]

Hi again Jayno,

My PC seems to be OK (fingers crossed) and Barca is functioning normally now I have re-set all the settings.

Good to hear, so I hope it stays this way.

Having had this calm for a couple of days I updated Spybot Search & Destroy this evening and ran a scan. Apart from finding the usual list of tracking cookies (associated with browsers), the one significant infection it turned up was:

Virtumonde: [SBI $0FB400C8] Settings (Registry key, fixed)

That's a nasty infection which does have several variants, some hiding it with rootkits.
I can only suggest to read this: How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo. The best would be to post an hijackthis log at one of the dedicated forums, so they can help you step by step to remove all infections/remnants left.

I trust this is of interest.
Wish me luck.

Indeed, quite interesting. Seems like that could be certainly the one that causes all this trouble for you. Good luck cleaning up your computer.

[jayno]

Hi again Eric

Having assumed I had got everything cleaned up and back to normal with Barca, I realised yesterday that my Contacts Folder is empty! It has the sub-folder 'Address Book' but there's nothing in it.

If I start a 'New' email and type a letter into the 'To:' line, it produces the resident email address for whoever I'm wanting to write to, so the email addresses are being held somewhere ..

Is there a file somewhere with all these addresses in? If so, how do I re-activate/import it into the Contacts folder? [Note: I've checked my backup copy of Barca and the Contacts Folder is empty there too].

Conversely, if the addresses are lost (or perhaps stolen by the recent trojan infection?) and I want to rebuild my address book one by one, how do I do that? I can't see a tab or menu item anywhere that allows me to "Add email address of sender to Contacts" by clicking it!

Jayno

[Eric]

Hi jayno,

Having assumed I had got everything cleaned up and back to normal with Barca, I realised yesterday that my Contacts Folder is empty! It has the sub-folder 'Address Book' but there's nothing in it.

Pretty annoying, I suppose that trojan erased your ini-files, including your address book.
Else it's an agressive registry cleaner or an option you didn't set.

If I start a 'New' email and type a letter into the 'To:' line, it produces the resident email address for whoever I'm wanting to write to, so the email addresses are being held somewhere ..

That's not the same. It's the auto-complete, so it has nothing to do with your address book.

Is there a file somewhere with all these addresses in? If so, how do I re-activate/import it into the Contacts folder? [Note: I've checked my backup copy of Barca and the Contacts Folder is empty there too].

As mentionned above you'll need your address.ini to put into that Address book folder. If you do have a backup, you can place only that file back.
Else you're out of luck.

Conversely, if the addresses are lost (or perhaps stolen by the recent trojan infection?) and I want to rebuild my address book one by one, how do I do that? I can't see a tab or menu item anywhere that allows me to "Add email address of sender to Contacts" by clicking it!

I don't think they were stolen, only just erased whether by that trojan or another program.
Do you use the preview pane?
If you do, you can right-click on the e-mail address to add it to your address book. Or click on the people's icon to add it to the address book of your choice.
There's even a script 'add_senders_to_address_book.poc" in Extras which will add it to your address book, if not present.

Hope that helps building your address book up from scratch.

Have a fine weekend.

[jayno]

Thanks Eric

I have used the preview pane to rebuild my contacts/address book, then done a new backup.

Actually, it's probably a good time for me to get Barca sorted, if you can help me do it without me making a mistake:

I am actually running Barca 2.5 (created Nov 2007), but there is no address.ini file (even now) in my C Drive, only in my F Drive where I have just done the new backup.

The odd thing is that I still have Barca 2 on my C Drive and there is an address.ini file in that folder, but it dates back to Oct 2007.

I did download the Barca 2.8 setup file at the end of April 2009, but when I tried to instal it I got some odd error/warning messages (can't remember now what they were - but I think they were about the risks of losing files, file conflicts, or not having certain files). I seem to remember that when I opened the new version it hadn't imported my existing email records properly, but luckily I was still able to use my 2.5 version, so I deleted the 2.8 version. Maybe I should have deleted Barca 2 and 2.5 before I did the 2.8 install, but I don't remember the 2.8 instruction telling me I should do. Of course, I'm very nervous of losing my email records, which are very extensive and important; and now I'm fearful of losing my Contacts too, given there is no uptodate address.ini on the C drive.

I'm obviously confused and unsure what to do. Can you advise?

Sorry to be such a nuisance.

[Eric]

Thanks Eric

You're welcome jayno.

I have used the preview pane to rebuild my contacts/address book, then done a new backup.

That's good to hear.

I am actually running Barca 2.5 (created Nov 2007), but there is no address.ini file (even now) in my C Drive, only in my F Drive where I have just done the new backup.

Keep your backup safe, because you'll need it.

The odd thing is that I still have Barca 2 on my C Drive and there is an address.ini file in that folder, but it dates back to Oct 2007.

What you could do, is copy that address.ini file to your current installation, but at the same renaming it to import.ini for example. This way your current address.ini won't be overwritten.
Next you'll be able to move addresses from that import.ini to your current address.ini. Afterwards you can simply delete that import.ini.

If after you restart Barca you don't see Import, just go to Tools > Options > Contacts and add it by navigating to your address book folder and selecting it.

I did download the Barca 2.8 setup file at the end of April 2009, but when I tried to instal it I got some odd error/warning messages (can't remember now what they were - but I think they were about the risks of losing files, file conflicts, or not having certain files).

Try to do a clean install and don't import anything yet.
Just make sure to install it into another directory.

When all works as it should you can perform Import > data from previous install to be found under File.
As always make a backup of your version 2.5, just to be on the safe side.

I seem to remember that when I opened the new version it hadn't imported my existing email records properly, but luckily I was still able to use my 2.5 version, so I deleted the 2.8 version. Maybe I should have deleted Barca 2 and 2.5 before I did the 2.8 install, but I don't remember the 2.8 instruction telling me I should do. Of course, I'm very nervous of losing my email records, which are very extensive and important; and now I'm fearful of losing my Contacts too, given there is no uptodate address.ini on the C drive.

No need to delete anything.
If you do take your precautions, then there's nothing to fear.
I've done it several times and not once did I lose my mail.

Take your time and don't rush it.
If your mail doesn't display properly, go to your mail directory after closing Barca and delete all *.idb files. On restart those index files will be rebuild.

When all goes well, you then can delete previous installations.

Sorry to be such a nuisance.

No nuisance at all. It's better to ask then be sorry afterwards.

Keep me informed how it goes and if you do need more info, just give a shout.

[jayno]

Eric, thanks again. I follow your instructions but I'm a bit unsure about this. Before I attempt to do anything can you first have a look at what is inside the two Barca folders on my C Drive:-

Inside C Drive / Programs / BARCA 2.5 :

This one is odd because first inside is a folder called BARCA2, and when I open this I get 2 sub-folders and 8 files, but no sign of an address.ini anywhere:

FOLDERS

Emoticons
Help

FILES

Barca
BarcaSystem
POImport
POImport.dll
Spell.cfg
unins000
unins000
user.adu

Inside C Drive / Programs / BARCA 2 :

This is a stand-alone BARCA2, which has 15 sub-folders (one of which has the old Address.ini file in it), and 30 files:

FOLDERS

Address [ 2 files in this folder = Address and Address.~ini from Nov 2006]
Attach
Cache
Calendar
Diary
Emoticons
Help
Icons
Mail
Notes
Scripts
Signatures
Skins
Templates
Users

FILES
accounts
Address.mbx
American.adm
Attach.mbx
barca
barca
Cache.mbx
Calendar.mbx
Copy of Barca
Diary.mbx
Emoticons.mbx
events
filters
history
Icons.mbx
Mail.mbx
Notes.mbx
POImport
POImport.dll
position
Scripts.mbx
Signatures.mbx
Skins.mbx
spell
Templates.mbx
unins000
unins000
user.adu
user_sp.adl
Users.mbx