• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 984
  • Last Modified:

Virus added .html to many .jpg files.

I am working with a client who was hit with some sort of virus that messed with his .jpg files.  He has cleaned up the virus successfully, but now we are trying to correct the damage.

Many (all?) of his .jpg files now have .html added to the end.  If you double-click on them you are taken to a web site that wants money to clean up the problem.

I'm presuming that the direction to that site is enclosed in the corrupted files as other .html files are viewed properly.

I've tried renaming the files by deleting the .html extension, but they only generate errors in whatever I use to view them.

It appears to be the same symptom as described in: http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Q_28085247.html

I've attached three examples of this to illustrate the problem.  I'd recommend extreme caution when opening them as they will take you to the site that I mentioned and I can make no claims as to what that site may try to do to your computer.

How do I retrieve the proper .jpg files from these?
CorrupteddPics.zip
0
CompProbSolv
Asked:
CompProbSolv
  • 4
  • 2
1 Solution
 
cpmcomputersCommented:
Just a thought
Are the files actually the genuine ones

Is it possible the virus has created HTML links by using the filenames

If nay be that the originals have had their attributes changed to hide them away

Try running

Attrib *.jpg -r -a -s -h on a folder with known Jpg's

If the files appear it should just be necessary to delete the .html bogus files
0
 
CompProbSolvAuthor Commented:
I looked in the folder with Windows Explorer configured to show hidden and protected files and didn't see any additional files.

The sizes of the files and the content (when viewed with notepad, for example) implies to me that the actual pictures are imbedded in there.  Of course, that could just be wishful thinking!
0
 
cpmcomputersCommented:
Seems there are a few variants of this
Some straight rename/hide
Some encrypting the files
Some zipping the originals

The filesize seems to be the clue
A work in progress for me at the moment
Will post back later
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 
cpmcomputersCommented:
Am on iPhone will look a zip later
To see if it reveals anything
0
 
cpmcomputersCommented:
Looks like original file is encrypted and HTML link added
Does not appear anyone has a decryption option for this as yet ?
0
 
marsiliesCommented:
I found this post where someone was able to recover the original files by using Previous Versions:
http://www.podnutz.com/forums/viewtopic.php?f=26&t=9996

Windows 7 has Previous Versions on all editions, instructions on how to use it here:
http://www.howtogeek.com/howto/11130/restore-previous-versions-of-files-in-every-edition-of-windows-7/

Vista had the Previous Versions feature in Pro and higher editions, but users of the Home editions could use the third-party program Shadow Explorer to recover files:
http://www.howtogeek.com/howto/windows-vista/recover-files-with-shadow-copies-on-any-version-of-windows-vista/


FWIW, I tried extracting the JPEG from the file using BitmapRip, ExtractJPEG, and deJPEG, and none of them could find a JPEG. I'm guessing that means the file is encrypted, or at least compressed.
http://mark0.net/soft-bitmaprip-e.html
http://www.gunamoi.com.au/soft/extractjpeg/index.html
http://betanews.com/2013/05/16/extract-jpegs-from-almost-any-file-with-dejpeg/
0
 
CompProbSolvAuthor Commented:
Good news!

I connected to the client's computer (Vista Home Premium), downloaded Shadow Explorer and started recovering files.

It is running now but the first results are excellent.  I moved all of the folders in Pictures to a folder I created named Bad before starting the restoration.  It had only done a handful of folders when I left it, but they all checked out.

Many thanks for the input!

I am curious as to whether or not anyone has a way to undo the damage to the files directly, though this will likely not be necessary in this case.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now