Looking at the file in my text/hex editor (editpad), it looks an awful lot like a renamed executable. It didn't work in my VM when I renamed the file to EXE though.
So I ran it through File Analyzer; it gives this:
Processing file : GDB.DOC
Large file name : GDB.doc
DOS File size : 24,064/00005E00
Created : 04:43:02 Jul, 02 of 2010
Processed with(1): CPShrink Archive
Extension ( 1): Microsoft Word Document File
CPSHrink is extremely old... it's pretty much what the closest match was.
For a Office 97-2003 document, the program is able to determine that it is indeed a word document. I also tested it with word 2007; the program correctly determines that the docx is really a zip file (which is is) and lists the contents.
Clearly, the attached file is not a word document; at least, not the whole thing.
Looking closer, I suspected some sort of EXE because it quite clearly says ".text", ".rdata" ".rsrc" which indicate code sections. However, it lacks any sort of MZ header (I tried running it as a COM as well but since it's >64k I doubted that would work... and it didn't, just gave a NTVDM Fault.
Curiously, there are specific entries related to registry keys:
"SOFTWARE\Microsoft\Windows\CurrentVersion" specifically.
It isn't until about halfway down the page that things look word-like (paragraph, font, etc structures)
my thoughts? Since you (the Original Poster) have mentioned that these files used to open properly, the best we can surmise is that they were changed. It looks almost as if a PDF, executable, and the original word document have somehow been mixed together. Now- I can think of two possibilities- first, and rather unlikely, is that the disk is rather unreliable and you somehow manage to keep having cross-linked files. the second, and more probable (given the information) is that you may actually be infected, or a computer that handles the document file is infected with a virus, and that virus blatantly attaches itself inside files. I'm not well versed on the Binary Doc format or it's header but it doesn't look like there is a magic number anywhere in the file at all, indicating that this may be a rather simple virus that overwrites a section of the file.
On the other hand, it could easily be some sort of accidental file corruption or something. it's hard to say.
I think that the fact that your Word and excel documents are the only Office documents that are "corrupted" is a clue as well; many less skilled virus authors merely "infect" files with certain extensions; they may have chosen to have the virus infect DOC and XLS files but never actually tested it, so the virus merely infects doc files the same way it would exe files, which would be to inject executable code (there is, without a doubt, parts of an EXE file in there); additionally, a simple virus of this sort would not be able to look inside and modify the contents of ZIP files (zipped folders) which means, as was stated, they would not be corrupted.
On the other hand, I could be completely wrong. But that's my take on it. I'd do a complete AV and Anti-malware scan of all machines that handle this file. The fact that it corrupts "over time" indicates that the files may not be processed/stored on the computer for a while. Also, do a disk check- the cross-linked theory could well be the case.
