Windows can destroy your learning material

Warning! Data loss possible!

Please make regular backups of your collections! We have documented a case where Microsoft Defender deleted the entire text registry (which is equivalent to permanently destroying a collection). The reason for this action was a string that resembled a virus. The "offending" text simply discussed virus fighting techniques and was unlucky to be marked for destruction by the Defender!!!

Problem

Microsoft Windows Defender uses dumb string-matching based malware recognition. This may result in targeting your learning material if it happens to contain unlucky texts. We have documented at least once case in which the defender wiped out the entire collection!

Solutions

Back up your learning material often! You never know when the next hardware or software disaster hits! You can lose months of work!

• make sure Defender does not target files with the extension *.RTX (SuperMemo text registry). The true danger comes with infected HTML files. However, if Defender attacks those, you are likely to lose just the formatting of a single text, rather than all your texts in the collection.
• exclude the folder with your collections from the Defender runtime protection (you can scan this folder on demand, e.g. each time after you back up your learning material)

When SuperMemo displays a Fatal Error, choose Abort!!! Not Continue!. Continuing may result in SuperMemo writing over the damaged files. This will reduce chances of restoring the damaged files! Once you stop SuperMemo, go to Windows Defender and look for history of recent "fixes" to attempt a Restore on the quarantined item. In case you manage to recover texts.rtx file, but not the entire collection, see: How to transfer work from a damaged collection to a backup collection.

Documented Case

In the documented case, a collection became a target only because it included a technical article devoted to defending computers from malware. The article included a piece of exemplary PHP code used by a popular virus. That code was recognized by the Defender as malware even though it was part of plain text that in no way was part of executable HTML file. The Defender reported "detecting malware", locked the registry file, blocked SuperMemo and collection abort was necessary. The text registry files have been reset to empty zero-size, and Restore in the defender resulted in a registry filled with garbage texts.

The error displayed by SuperMemo:

Fatal error!

Cannot open registry files
Registry=C:\SuperMemo\MyKnowledge\registry\Text
I/O error 225

Choose Abort to halt SuperMemo

IMPORTANT! To prevent data loss do the following:
1. Back up your collection (e.g. with Ctrl+Shift+C)
2. Run File : Repair collection (Ctrl+F12)!!!

In similar cases, you are given a choice: Abort or Continue. Always choose Abort to prevent further damage.

Technical

It is possible that the Defender intercepts "suspicious" strings while they are being processed during reading extracts or other operations. It then interferes with writing to the registry files resulting in a total wipeout of the registry, which is equivalent to entirely destroying the collection. Restore on quarantined items in the Defender may not work (due to the lost of the integrity of text registry records).

More information will be posted when available.

See also: Some applications lock SuperMemo files and cause errors