6

I really don't know how the user managed to do this but for some reason .PNG images are no longer working in IE8.

When viewing a page that has .PNG images on it they are just displayed as a little red X. Navigating to the image directly also just shows a little red X.

I have tried:

  • Reinstalling IE8.
  • Resetting IE8 settings.
  • Logging in under a different user to see if .PNGs are displayed fine, which they are.
  • Running a virus scan.
  • Running Malwarebytes.
  • Running Spybot Search And Destroy.
  • Removing general crap using HijackThis.

I could just reformat the machine but I would much rather fix the issue than do that.

The OS is Windows XP SP3

2 Answers 2

4

Your MIME types may be set improperly (probably due to past spyware or failed addons).

Winhelponline has a helpful article including registry file you can download and merge to fix it. (the registry file assumes $WINDOWS is located on C:)

Windows XP Settings

Windows Registry Editor Version 5.00

;PNG file association fix for Windows XP
;Created on May 17, 2007 by Ramesh Srinivasan

[HKEY_CLASSES_ROOT\.PNG]
"PerceivedType"="image"
@="pngfile"
"Content Type"="image/png"

[HKEY_CLASSES_ROOT\.PNG\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\pngfile]
@="PNG Image"
"EditFlags"=dword:00010000
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
  00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
  32,00,5c,00,73,00,68,00,69,00,6d,00,67,00,76,00,77,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,33,00,30,00,35,00,00,00
"ImageOptionFlags"=dword:00000003

[HKEY_CLASSES_ROOT\pngfile\CLSID]
@="{25336920-03F9-11cf-8FD0-00AA00686F13}"

[HKEY_CLASSES_ROOT\pngfile\DefaultIcon]
@="shimgvw.dll,2"

[HKEY_CLASSES_ROOT\pngfile\shell]
@="open"

[HKEY_CLASSES_ROOT\pngfile\shell\open]
"MuiVerb"="@shimgvw.dll,-550"

[HKEY_CLASSES_ROOT\pngfile\shell\open\command]
@="rundll32.exe C:\\WINDOWS\\system32\\shimgvw.dll,ImageView_Fullscreen %1"

[HKEY_CLASSES_ROOT\pngfile\shell\open\DropTarget]
"Clsid"="{E84FDA7C-1D6A-45F6-B725-CB260C236066}"

[HKEY_CLASSES_ROOT\pngfile\shell\printto]

[HKEY_CLASSES_ROOT\pngfile\shell\printto\command]
@="rundll32.exe C:\\WINDOWS\\system32\\shimgvw.dll,ImageView_PrintTo /pt \"%1\" \"%2\" \"%3\" \"%4\""

[HKEY_CLASSES_ROOT\SystemFileAssociations\.PNG]
"ImageOptionFlags"=dword:00000003

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG]

[-HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/x-png]

[-HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/png]

[HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/x-png]
"Extension"=".png"
"Image Filter CLSID"="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/x-png\Bits]
"0"=hex:08,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,89,50,4e,47,0d,0a,1a,0a

[HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/png]
"Extension"=".png"
"Image Filter CLSID"="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_CLASSES_ROOT\Mime\Database\Content Type\image/png\Bits]
"0"=hex:08,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,89,50,4e,47,0d,0a,1a,0a

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}\InProcServer32]
@="C:\\WINDOWS\\system32\\pngfilt.dll"
"ThreadingModel"="Both"

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}\ProgID]
@="PNGFilter.CoPNGFilter.1"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter\CLSID]
@="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter.1]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter.1\CLSID]
@="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

VISTA Settings

Windows Registry Editor Version 5.00

;PNG file association fix for Windows Vista
;Created on May 17, 2007 by Ramesh Srinivasan

[HKEY_CLASSES_ROOT\.png]
@="pngfile"
"Content Type"="image/png"
"PerceivedType"="image"

[HKEY_CLASSES_ROOT\.png\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\pngfile]
@="PNG Image"
"EditFlags"=dword:00010000
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
  00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
  32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,33,00,30,00,35,00,39,00,38,00,00,00
"ImageOptionFlags"=dword:00000003

[HKEY_CLASSES_ROOT\pngfile\CLSID]
@="{25336920-03F9-11cf-8FD0-00AA00686F13}"

[HKEY_CLASSES_ROOT\pngfile\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6d,00,\
  61,00,67,00,65,00,72,00,65,00,73,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,38,\
  00,33,00,00,00

[HKEY_CLASSES_ROOT\pngfile\shell]

[HKEY_CLASSES_ROOT\pngfile\shell\open]
"MuiVerb"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\
  69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,47,00,61,00,6c,00,6c,00,65,00,\
  72,00,79,00,5c,00,70,00,68,00,6f,00,74,00,6f,00,76,00,69,00,65,00,77,00,65,\
  00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,34,00,33,00,00,00

[HKEY_CLASSES_ROOT\pngfile\shell\open\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\
  6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\
  00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\
  25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\
  00,74,00,6f,00,20,00,47,00,61,00,6c,00,6c,00,65,00,72,00,79,00,5c,00,50,00,\
  68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,\
  00,6c,00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,\
  77,00,5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,\
  00,25,00,31,00,00,00

[HKEY_CLASSES_ROOT\pngfile\shell\open\DropTarget]
"Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"

[HKEY_CLASSES_ROOT\pngfile\shell\printto]

[HKEY_CLASSES_ROOT\pngfile\shell\printto\command]
@=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,\
  75,00,6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,22,00,20,\
  00,22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,\
  25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,\
  00,69,00,6d,00,67,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,22,00,2c,00,49,00,\
  6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,5f,00,50,00,72,00,69,00,6e,\
  00,74,00,54,00,6f,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,\
  20,00,22,00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,\
  00,34,00,22,00,00,00

[HKEY_CLASSES_ROOT\pngfile\shellex]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-png]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-png]
"Extension"=".png"
"Image Filter CLSID"="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-png\Bits]
"0"=hex:08,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,89,50,4e,47,0d,0a,1a,0a

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/png]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/png]
"Extension"=".png"
"Image Filter CLSID"="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/png\Bits]
"0"=hex:08,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,89,50,4e,47,0d,0a,1a,0a

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}\InprocServer32]
@="C:\\Windows\\system32\\pngfilt.dll"
"ThreadingModel"="Both"

[HKEY_CLASSES_ROOT\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}\ProgID]
@="PNGFilter.CoPNGFilter.1"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter.1]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter.1\CLSID]
@="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter]
@="CoPNGFilter Class"

[HKEY_CLASSES_ROOT\PNGFilter.CoPNGFilter\CLSID]
@="{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}"
1

After some days working I found the problem here in the User-specific Registry:

[HKEY_CURRENT_USER\Software\Classes\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}]

[HKEY_CURRENT_USER\Software\Classes\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}\InProcServer32] @="C:\\DOKUME~1\\Viktor\\LOKALE~1\\Temp\\37.tmp" "ThreadingModel"="Both"

When I deleted this complete entry .png pictures were displayed regards in IE8 and also in other applications like Eudora or StarMoney

This entry was made by the virus TR/SPY.LURK.21

It is reported here

I found the problem, because I had another user on my system with correct display of .png. So I exported the registry of this user (very small) and the infected user. Before the following tests I wrote a restart point in the system, naturally (and I needed!). Then I deleted the registry of the infected user and imported the correct registry. As it worked, I deleted only parts and imported until I found the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .