Jump to content
malibu91

Extension Mismatch .jpg? Is this a Trojan?

Recommended Posts

Hi,

I have been having issues wherby I have lost a lot of image files (corrupted file headers apparently).

In any regard I have lost a ton of family photos which is not good.

I have run MB, and have come up with the following log for one of my stored images.

"38_1_b11.JPG (Extension.Mismatch) -> Quarantined and deleted successfully."

I have attached a .zip of the image file and would appreciate any advice as to whether this progranm is possibly responsible for the loss of other images, or whether it is just a False Positive?

Cheers

Jules

38_1_b11.rar

Share this post


Link to post
Share on other sites

This is not a jpeg, it is a damaged executable files given a .JPG extension.

Are you sure this was a picture at one point? The file header currently is without question executable and not an image file.

Extension.Mismatch <- that is what this actually means, an executable file obscured to look like something else.'

If possible Id like to see the full scan log.

Share this post


Link to post
Share on other sites

This is not a jpeg, it is a damaged executable files given a .JPG extension.

Are you sure this was a picture at one point? The file header currently is without question executable and not an image file.

Extension.Mismatch <- that is what this actually means, an executable file obscured to look like something else.'

If possible Id like to see the full scan log.

No worries. I have attached the log file as well as a copy of the "real" .jpg file from a good backup.

Jules

mbam-log-2011-07-17 (11-42-58).txt

post-88041-0-07240200-1310902595.jpg

Share this post


Link to post
Share on other sites

This is not a corrupted jpeg, it has been replaced by executable code and this is almost certainly the result of the following:

d:\program files\mediamonkey\keygen.exe (Trojan.Dropper.PGen) -> No action taken.

Keygens are often malicious and using them is a huge risk.

I am asking support to take a look at this, it is likely that your pictures are still there but hidden.

Share this post


Link to post
Share on other sites

malibu91

Please post your MBAM scan results.

  • Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.
  • After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification, so that you're alerted when someone has replied to your post.
  • One of the expert helpers there will give you one-on-one assistance when one becomes available.
  • Please refrain from making any further changes to your computer such as (Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.

NOTE: Please DO NOT post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies. If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

Share this post


Link to post
Share on other sites
it is likely that your pictures are still there but hidden.

Hi, Can you explain a bit more about this? It would be very good news indeed.

Cheers

Jules

PS: logs posted in a new post.

Share this post


Link to post
Share on other sites

I replied to your topic in the Hijackthis Removal Forum and waiting for your reply.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.