6

I was trying to open a .png picture today and clicked edit instead of open, which in my opinion wouldn't affect anything. However, most likely coincidentally, as soon as I clicked edit, a large number of cmd prompts opened and closed quickly.

I noticed that the file location was on the headers of the cmd prompts. This is what it said, from what I gathered before it stopped: C:\<user>\AppData\Google.

Does anyone have any idea what happened and what can I do to fix it or keep it from happening again?

migrated from security.stackexchange.com Dec 17 '15 at 18:12

This question came from our site for information security professionals.

  • This probably should go to superuser, but ....Where did the picture come from? Did you run a Virus/Malware scan? Does it do that with all pictures? – N. Greene Dec 17 '15 at 15:05
  • I saved a picture from online (wiki commons or wikimedia) and wanted to look at it with Microsoft Paint. I hit edit and all that happened. – A Child of God Dec 17 '15 at 15:08
  • 7
    What is the default app to edit png files on your PC? I'd be more inclined to investigate an issue with that software as opposed to a png file (not that png files can be harmless). That is if there even is an 'issue' - it could just be an update/initialization process of whatever it is you're running. – JᴀʏMᴇᴇ Dec 17 '15 at 15:21
  • 1
    Well ... many of them. Also, I seen legitimate app doing this when installing. – Vilican Dec 17 '15 at 15:28
  • 1
    @Vilican, actually Panda Free Antivirus made 2015's "Editor's Choice" for PC Magazine (pcmag.com/article2/0,2817,2388652,00.asp). They were near the top of various antivirus benchmarks and testing that I looked at a year or so ago when my Kaspersky subscription expired and I was looking into new antivirus. Although, I did end up choosing something else at the time. – Ben Dec 17 '15 at 15:35
15

It might be that some virus/application modified the registry key that executes which command when clicked on edit. Check yourself first in the registry.

Reg-Edit

Browsing the file extension key in HKEY_CLASSES_ROOT will say the key for the shell menus. Now find that shell key in the registry editor.

Reg-Edit

If there is another app that modified, like I have 'Edit with GIMP' here, new shell item appears. If there is something there, just check the command.

Reg-Edit

It might be that the program that is opening that file from the context menu might be faulty and it generates the errors. If that program is having errors, just delete that entire key, and the edit should ask you to select the program to launch.

1

It might be as stated by @SriHarsha, but there are also the following cases

Virus in PNG

Unlikely but even worse case:

the PNG file itself is prepared in a special way and contains a virus that opens a command prompt in order to perform a special operation (whatever the virus wants it to be).

Depending on the program which is used to open the PNG file, the virus may become active or not. E.g. it may not become active in Windows Image Viewer, because that program uses a newer graphics library which checks for buffer overflows.

But since you accidentally clicked "edit", it was opened in MS Paint, which might use a different library that does not perform buffer overflow checks, therefore crashes and the crash causes the virus to become active. The virus manages to run a command via the command line.

In such a case, the application is likely to crash or be unusable.

Fix: no fix. Run an antivirus program. If the virus is very new, it may not be detected. Don't use the PNG, but maybe keep it if you want to contact an anti-virus vendor.

Debugger

It is possible to set up a debugger to launch automatically when a program is started. This is done via the Registry Key ImageFileExecutionOptions. Depending on what type of debugger it is, it may open a console window. When the debugger decides to detach, the console window may close.

In that case, the application is likely to run normally.

Fix: remove the Registry Key for the affected program.

  • 1
    I would think that if someone went to the trouble of embedding an exploit in an image they would also make sure it was invisible to the user. – JAB Dec 17 '15 at 17:41
  • I clicked on edit more purposely than accidentally. – A Child of God Dec 17 '15 at 18:16
  • 1
    my antivirus detected no threat/virus in the png pic. – A Child of God Dec 17 '15 at 18:19
1

It could be a virus masked/binded to a PNG/JPG file. With your accidental 'edit' of the image file, it may have caused the virus binded/masked to it to run.

Some viruses can be set to mask or bind into images. That way when you open the image file, it opens up the virus too. The way most of these things work is, the virus is stored into a .rar file and then placed inside the actual image. But most other binders work too.

You should run an anti-virus scan your entire system and the image file, as soon as possible. And delete the image file so you won't accidently edit it/run it again.

  • As I have said previously, I did not click edit accidental. – A Child of God Dec 22 '15 at 16:10

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.