Solved

Virus added .html to many .jpg files.

Posted on 2013-05-17
7
936 Views
Last Modified: 2013-05-17
I am working with a client who was hit with some sort of virus that messed with his .jpg files.  He has cleaned up the virus successfully, but now we are trying to correct the damage.

Many (all?) of his .jpg files now have .html added to the end.  If you double-click on them you are taken to a web site that wants money to clean up the problem.

I'm presuming that the direction to that site is enclosed in the corrupted files as other .html files are viewed properly.

I've tried renaming the files by deleting the .html extension, but they only generate errors in whatever I use to view them.

It appears to be the same symptom as described in: http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Q_28085247.html

I've attached three examples of this to illustrate the problem.  I'd recommend extreme caution when opening them as they will take you to the site that I mentioned and I can make no claims as to what that site may try to do to your computer.

How do I retrieve the proper .jpg files from these?
CorrupteddPics.zip
0
Comment
Question by:CompProbSolv
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 10

Expert Comment

by:cpmcomputers
ID: 39174007
Just a thought
Are the files actually the genuine ones

Is it possible the virus has created HTML links by using the filenames

If nay be that the originals have had their attributes changed to hide them away

Try running

Attrib *.jpg -r -a -s -h on a folder with known Jpg's

If the files appear it should just be necessary to delete the .html bogus files
0
 
LVL 21

Author Comment

by:CompProbSolv
ID: 39174016
I looked in the folder with Windows Explorer configured to show hidden and protected files and didn't see any additional files.

The sizes of the files and the content (when viewed with notepad, for example) implies to me that the actual pictures are imbedded in there.  Of course, that could just be wishful thinking!
0
 
LVL 10

Expert Comment

by:cpmcomputers
ID: 39174033
Seems there are a few variants of this
Some straight rename/hide
Some encrypting the files
Some zipping the originals

The filesize seems to be the clue
A work in progress for me at the moment
Will post back later
0
Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

 
LVL 10

Expert Comment

by:cpmcomputers
ID: 39174035
Am on iPhone will look a zip later
To see if it reveals anything
0
 
LVL 10

Expert Comment

by:cpmcomputers
ID: 39174056
Looks like original file is encrypted and HTML link added
Does not appear anyone has a decryption option for this as yet ?
0
 
LVL 20

Accepted Solution

by:
marsilies earned 500 total points
ID: 39175561
I found this post where someone was able to recover the original files by using Previous Versions:
http://www.podnutz.com/forums/viewtopic.php?f=26&t=9996

Windows 7 has Previous Versions on all editions, instructions on how to use it here:
http://www.howtogeek.com/howto/11130/restore-previous-versions-of-files-in-every-edition-of-windows-7/

Vista had the Previous Versions feature in Pro and higher editions, but users of the Home editions could use the third-party program Shadow Explorer to recover files:
http://www.howtogeek.com/howto/windows-vista/recover-files-with-shadow-copies-on-any-version-of-windows-vista/


FWIW, I tried extracting the JPEG from the file using BitmapRip, ExtractJPEG, and deJPEG, and none of them could find a JPEG. I'm guessing that means the file is encrypted, or at least compressed.
http://mark0.net/soft-bitmaprip-e.html
http://www.gunamoi.com.au/soft/extractjpeg/index.html
http://betanews.com/2013/05/16/extract-jpegs-from-almost-any-file-with-dejpeg/
0
 
LVL 21

Author Comment

by:CompProbSolv
ID: 39176397
Good news!

I connected to the client's computer (Vista Home Premium), downloaded Shadow Explorer and started recovering files.

It is running now but the first results are excellent.  I moved all of the folders in Pictures to a folder I created named Bad before starting the restoration.  It had only done a handful of folders when I left it, but they all checked out.

Many thanks for the input!

I am curious as to whether or not anyone has a way to undo the damage to the files directly, though this will likely not be necessary in this case.
0

Featured Post

MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The intent of this Article is to provide the basic First Aid steps for working through most malware infections. The target audience includes experienced IT professionals and the casual user who just wants to make the infection go away. **********…
Sub-Titled: “My Way” (with apologies to Francis Albert Sinatra) Let me start by stating emphatically that I am one of those Experts who prefer doing things “My Way”. It’s kind of a no-brainer. “The following procedure works for me, so here is …
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question