Need help! Virus/trojan

system · 2007-12-05T19:38:58.000Z

A Virus or trojan has recently done something to my system and now I can open or look at any of my JPEG images, they done even show an image as a thumbnail. tried running Avast anti virus, AVG free edition, spybot, rogue remover, Ad Adware. It appears to have cleaned them out but I still can,t open any of my JPEG files. Please please can someone give me some advice. have I lost these JPEG files? ???

DavidR · 2007-12-05T19:53:49.000Z

Firstly if you are talking about AVGanti-virus, having two resident scanners installed is not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.

So you should uninstall it and reboot, whilst that might not cure the problem (check) you may simply need to reassign the file association with whatever program normally opens jpg files.

Right click on a jpg file whilst holding down the shift key, and select Open with. When the window pops-up, select the program from the list (or if the program isn’t on the list, select Choose program) tick the ‘Always use the selected program to open this kind of file’ box.

Lisandro · 2007-12-05T20:57:43.000Z

Which application is associated with jpeg files? I mean, if you double-click one, which program is opening it or should opening it?

Can you post a screenshot of the it?
To know how to post a screenshot, see http://forum.avast.com/index.php?topic=8982.0
You can use Gadwin PrintScreen to get a screenshot (http://www.gadwin.com/printscreen/) or the free version of WinSnap 1.1.10 (http://www.filehippo.com/download_winsnap/?2173).

DavidR · 2007-12-05T22:34:43.000Z

That is his problem nothing happens as there has probably an intercept on the jpg files, so the file association needs to be re-established.

Lisandro · 2007-12-06T00:03:24.000Z

If it helps… http://xenomorph.net/?page_id=492
XdN File Association 0.0.0.7

system · 2007-12-06T09:13:27.000Z

I only have one anti-virus operating at a time but use AVG free edition & Avast free, I tried reasigning the JPEGS, the JPEGS are associated to windows picture & fax viewer. I’ve tried adding a screenshot hope it works. Thanks for all your help and advice.

system · 2007-12-06T10:11:53.000Z

I’ve just executed another virus scan using avast and it found an infection it was unable to clean, it was shown as follows:- F:\Documents and Settings\DKK\Desktop.…\CMDOW.EXE. don’t know if this helps?

system · 2007-12-06T10:52:43.000Z

[u]Tech
I’m not sure why you think XDN file association can help me? can you please explain why and how I would use it to help sort out my problem? Thanks!

system · 2007-12-06T10:57:26.000Z

DavidR

If there was an intercept on the jpg files as you suggest, how could I fix it?? I tried reassigning the file association following your instructions but it I still can’t open any jpg file?

Lisandro · 2007-12-06T12:07:06.000Z

dlish1 post:8:

[u]Tech
I’m not sure why you think XDN file association can help me? can you please explain why and how I would use it to help sort out my problem? Thanks!

You’re right. I’m wrong. Sorry.
I’ve overetimated the capacity of this tool. I’ll look for a better and suitable one.

DavidR · 2007-12-06T15:17:40.000Z

dlish1 post:6:

I only have one anti-virus operating at a time but use AVG free edition & Avast free, I tried reasigning the JPEGS, the JPEGS are associated to windows picture & fax viewer. I’ve tried adding a screenshot hope it works. Thanks for all your help and advice.

That isn’t good enough as both resident scanners will load virtual device drivers on boot, even if you only use one at a time, disabling isn’t enough.

dlish1 post:7:

I’ve just executed another virus scan using avast and it found an infection it was unable to clean, it was shown as follows:- F:\Documents and Settings\DKK\Desktop.…\CMDOW.EXE. don’t know if this helps?

See http://www.commandline.co.uk/cmdow/ If you installed this it is a tool which can be used for good or evil and avast doesn’t know the intention.

dlish1 post:9:

If there was an intercept on the jpg files as you suggest, how could I fix it?? I tried reassigning the file association following your instructions but it I still can’t open any jpg file?

An intercept works in a similar way to the file allocation when you click on a file windows needs to know what program to open it with, this is the file association and is stored in the registry, but you can use the the Interface that I gave to change it rather than have to manually edit the registry.

Since you still seem to have an association with windows picture & fax viewer, I wonder if there is a problem with that program, does it open and view other image file types, like .gif ?

You could try IrfanView http://www.irfanview.net/, which is a great little image viewer which can view many more image file formats that any other that I know. It also has basic image editing function.

Edit:
Try a visit to http://www.dougknox.com/index.html, look at the menu on the left, Win XP Fixes, then File Association Fixes in the right window and finally download the JPE/JPG/JPEG Association Fix a direct link to the zip download, http://www.dougknox.com/xp/fileassoc/xp_jpg_jpe_jpeg_file_assoc_fix.zip.

Lisandro · 2007-12-06T19:45:56.000Z

Shareware, but you can try: http://www.download.com/File-Association-Manager/3000-2094_4-10309235.html

Seems freeware: File Type Manager 2.0.1 (http://frank.neatstep.com/node/1)

Are you using XP?
This registry key could solve, if imported (take care on working with registry):

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.jpe]
"PerceivedType"="image"
@="jpegfile"
"Content Type"="image/jpeg"

[HKEY_CLASSES_ROOT\.jpe\OpenWithProgids]
"jpegfile"=hex(0):

[HKEY_CLASSES_ROOT\.jpe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\.jpeg]
"PerceivedType"="image"
@="jpegfile"
"Content Type"="image/jpeg"

[HKEY_CLASSES_ROOT\.jpeg\jpegfile]

[HKEY_CLASSES_ROOT\.jpeg\jpegfile\ShellNew]

[HKEY_CLASSES_ROOT\.jpeg\OpenWithProgids]
"jpegfile"=hex(0):

[HKEY_CLASSES_ROOT\.jpeg\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\.jpg]
"PerceivedType"="image"
@="jpegfile"
"Content Type"="image/jpeg"

[HKEY_CLASSES_ROOT\.jpg\jpegfile]

[HKEY_CLASSES_ROOT\.jpg\jpegfile\ShellNew]

[HKEY_CLASSES_ROOT\.jpg\OpenWithProgids]
"jpegfile"=hex(0):

[HKEY_CLASSES_ROOT\.jpg\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\jpegfile]
@="JPEG Image"
"EditFlags"=dword:00010000
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
  00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
  32,00,5c,00,73,00,68,00,69,00,6d,00,67,00,76,00,77,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,33,00,30,00,33,00,00,00
"ImageOptionFlags"=dword:00000003

[HKEY_CLASSES_ROOT\jpegfile\CLSID]
@="{11943940-36DE-11CF-953E-00C0A84029E9}"

[HKEY_CLASSES_ROOT\jpegfile\DefaultIcon]
@="C:\\WINDOWS\\Installer\\{90280409-6000-11D3-8CFE-0050048383C9}\\PEicons.exe,5"

[HKEY_CLASSES_ROOT\jpegfile\shell]

[HKEY_CLASSES_ROOT\jpegfile\shell\Open]
@="&Open"

[HKEY_CLASSES_ROOT\jpegfile\shell\Open\command]
@="\"C:\\Program Files\\Common Files\\Microsoft Shared\\PhotoEd\\PHOTOED.EXE\" \"%1\""
"command"=hex(7):43,00,38,00,34,00,44,00,56,00,6e,00,2d,00,7d,00,66,00,28,00,\
  59,00,52,00,5d,00,65,00,41,00,52,00,36,00,2e,00,6a,00,69,00,50,00,68,00,6f,\
  00,74,00,6f,00,45,00,64,00,69,00,74,00,6f,00,72,00,46,00,69,00,6c,00,65,00,\
  73,00,3e,00,44,00,6f,00,54,00,5d,00,6a,00,49,00,7b,00,6a,00,66,00,28,00,3d,\
  00,31,00,26,00,4c,00,5b,00,2d,00,38,00,31,00,2d,00,5d,00,20,00,22,00,25,00,\
  31,00,22,00,00,00,00,00

[HKEY_CLASSES_ROOT\jpegfile\shell\Print]
@="&Print"

[HKEY_CLASSES_ROOT\jpegfile\shell\Print\command]
@="\"C:\\Program Files\\Common Files\\Microsoft Shared\\PhotoEd\\PHOTOED.EXE\" /p \"%1\""
"command"=hex(7):43,00,38,00,34,00,44,00,56,00,6e,00,2d,00,7d,00,66,00,28,00,\
  59,00,52,00,5d,00,65,00,41,00,52,00,36,00,2e,00,6a,00,69,00,50,00,68,00,6f,\
  00,74,00,6f,00,45,00,64,00,69,00,74,00,6f,00,72,00,46,00,69,00,6c,00,65,00,\
  73,00,3e,00,44,00,6f,00,54,00,5d,00,6a,00,49,00,7b,00,6a,00,66,00,28,00,3d,\
  00,31,00,26,00,4c,00,5b,00,2d,00,38,00,31,00,2d,00,5d,00,20,00,2f,00,70,00,\
  20,00,22,00,25,00,31,00,22,00,00,00,00,00

[HKEY_CLASSES_ROOT\jpegfile\shell\Printto]

[HKEY_CLASSES_ROOT\jpegfile\shell\Printto\command]
@="\"C:\\Program Files\\Common Files\\Microsoft Shared\\PhotoEd\\PHOTOED.EXE\" /pt \"%1\" \"%2\" \"%3\" \"%4\""
"command"=hex(7):43,00,38,00,34,00,44,00,56,00,6e,00,2d,00,7d,00,66,00,28,00,\
  59,00,52,00,5d,00,65,00,41,00,52,00,36,00,2e,00,6a,00,69,00,50,00,68,00,6f,\
  00,74,00,6f,00,45,00,64,00,69,00,74,00,6f,00,72,00,46,00,69,00,6c,00,65,00,\
  73,00,3e,00,44,00,6f,00,54,00,5d,00,6a,00,49,00,7b,00,6a,00,66,00,28,00,3d,\
  00,31,00,26,00,4c,00,5b,00,2d,00,38,00,31,00,2d,00,5d,00,20,00,2f,00,70,00,\
  74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,00,25,00,32,00,22,00,20,00,22,\
  00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,22,00,00,00,00,00

system · 2007-12-11T15:14:42.000Z

Hi,

Just a tiny question… just imagine that:
You put one jpg file on an USB drive, then you try to open it on another computer.

What’s happening ?

(just to see if files are corrupted… or not).

Announcements