HELP!!!!! I foolishly opened an email attachment that had a .jpg.pif attachment

Forums › Microsoft Windows › HELP!!!!! I foolishly opened an email attachment that had a .jpg.pif attachment

Johnboy1234

44 posts

Geek

#150252 16-Jul-2014 14:31

This morning I was half asleep and received a email with a zip extention. IMG_009840.zip I scanned it first with the windows 7 security software and it said it was safe. Then when unzipped it it had a file called IMG_009840.jpg.pif Ididnt notice the .pif part and double clicked on it, then a dos box came up breifly and disappeared, and no image showed up, which made me suspicious, so I googled the file and found out it is most likely a virus, but cannot find a way to get rid of it off google..........anyone know what I can do to fix this problem please!

Sky is too expensive for what you get.

1 | 2

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1090025 16-Jul-2014 15:06

Download and run HouseCall and see if it finds anything.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Stress

48 posts

Geek
+1 received by user: 27

#1090026 16-Jul-2014 15:07

Have you virus scanned your PC? Snap! was going to say house call too.

I know a song that gets on everyone's nerves!

Johnboy1234

44 posts

Geek

#1090029 16-Jul-2014 15:11

Yea I did scan and nothing showed up, I will download housecall now and let you know

Sky is too expensive for what you get.

nakedmolerat

4631 posts

Uber Geek
+1 received by user: 874

Trusted

Lifetime subscriber

#1090030 16-Jul-2014 15:15

Upload the concerned file to www.virustotal.com

Johnboy1234

44 posts

Geek

#1090033 16-Jul-2014 15:20

still scanning with House call

Got virus total and got this result

SHA256:

9f99f45c4af4340753b392de625557d2e6b2ef2251444ab52eeb3825e4d747a4

File name:

IMG_004543.zip

Detection ratio:

11 / 54

Analysis date:

2014-07-15 22:59:00 UTC ( 4 hours, 19 minutes ago )

Sky is too expensive for what you get.

Johnboy1234

44 posts

Geek

#1090034 16-Jul-2014 15:22

Nothing found with HOUSECALL, am I screwed.

Sky is too expensive for what you get.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

Batman

Mad Scientist
30014 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#1090035 16-Jul-2014 15:24

people should install avast - deselect all the bloat, just the one important bit (last line of defense), and it would have picked it up.

Batman

Mad Scientist
30014 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#1090037 16-Jul-2014 15:25

install avast - just the file shield bit, nothing else if you don't want to be bogged down, and then do a boot scan.

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1090047 16-Jul-2014 15:29

You would have gotten a variant of the Zeus trojan which can be hard to detect and remove. I would recommend to Download / Run a Malwarebytes scan - https://www.malwarebytes.org/

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Batman

Mad Scientist
30014 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#1090051 16-Jul-2014 15:37

let me know if avast finds it :D

Johnboy1234

44 posts

Geek

#1090052 16-Jul-2014 15:38

Thanks.. doing a Malwarebytes scan now and it already has picked up 2 threats in the registry, awaiting final results and post them.

Sky is too expensive for what you get.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

Johnboy1234

44 posts

Geek

#1090056 16-Jul-2014 15:43

Heres the results

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 16/07/2014
Scan Time: 3:34:10 p.m.
Logfile:
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.16.01
Rootkit Database: v2014.07.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 307970
Time Elapsed: 8 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 14
PUP.Optional.Babylon.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, , [171a40602f4ce155432d93c0ea184bb5],
Trojan.Vundo, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{56256A51-B582-467e-B8D4-7786EDA79AE0}, , [022fc1dfaccf70c60e1cfc8a05fd34cc],
PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64, , [cf62237d1a61cd69162f4ad09a6ab24e],
PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\S-5944234096, , [949d17893d3e89adfabfe1de30d256aa],
PUP.Optional.GreenerWeb.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Greener Web, , [44ed5f41a9d21c1a86a69332da288977],
PUP.Optional.FreeHDSportTV.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FreeHD-Sport TV V9.0, , [181997095526bd7922b9d10d03ff728e],
PUP.Optional.TornTV.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Torntv V9.0, , [d25f7c246c0fcf67e6f11ac457ab42be],
PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\1ClickDownload, , [131ea9f7651685b137715c9f46bd50b0],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, , [b27fb8e8e8930d2987298d81877ddb25],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [43eef2ae8cef132305488d57d42e09f7],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [b180920ef9825cda5df5ce2cfe0509f7],
PUP.Optional.SuperFish.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, , [68c9a5fb601bc27493dbfcc41ae844bc],
PUP.Optional.WebSearchInfo, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [e24fa4fc93e8ca6cf1a158b0d232e818],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [49e898088bf09f976de8a72cc73b916f],

Registry Values: 2
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0E2Z1U1R1I1R2W0Q, , [b180920ef9825cda5df5ce2cfe0509f7]
PUP.Optional.WebSearchInfo, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [cb66bde3ea91a29481129f69ce36669a]

Registry Data: 2
PUP.Optional.WebSearchInfo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://websearch.eazytosearch.info/?pid=724&r=2014/05/21&hid=18319359888219393996&lg=EN&cc=NZ, Good: (www.google.com), Bad: (http://websearch.eazytosearch.info/?pid=724&r=2014/05/21&hid=18319359888219393996&lg=EN&cc=NZ),,[51e0aef26912999d2da40593e61e4db3]
PUP.Optional.WebSearchInfo, HKU\S-1-5-21-4147700844-2117321934-3503256247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://websearch.eazytosearch.info/?pid=724&r=2014/05/21&hid=18319359888219393996&lg=EN&cc=NZ, Good: (www.google.com), Bad: (http://websearch.eazytosearch.info/?pid=724&r=2014/05/21&hid=18319359888219393996&lg=EN&cc=NZ),,[9e93a3fdcead092d16baedab0400c739]

Folders: 4
PUP.Optional.Multiplug, C:\Program Files (x86)\YoutubeAdblocker, , [260bccd4d0abd85e3006e2c0a65ca15f],
PUP.Optional.YoutubeAdblocker.A, C:\ProgramData\YoutubeAdblocker, , [949d326ee19af640fb39f7ad71918d73],
PUP.Optional.MultiPlug.A, C:\ProgramData\SaeVe net, , [74bd811f225976c032037d35af5310f0],
PUP.Optional.SNBooster.A, C:\ProgramData\Excellent4App\SW-Booster, , [c76af1afbbc058de59823185e220be42],

Files: 2
PUP.Optional.Amonetize, C:\Users\Owner\Downloads\FDM__3472_i957861132_il63.exe, , [9f923a666615cc6a0f01d86c6d936898],
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64.sys, , [cf62237d1a61cd69162f4ad09a6ab24e],

Physical Sectors: 0
(No malicious items detected)

(end)

Sky is too expensive for what you get.

Johnboy1234

44 posts

Geek

#1090057 16-Jul-2014 15:44

should I apply actions??

Sky is too expensive for what you get.

l43a2

1784 posts

Uber Geek
+1 received by user: 591

ID Verified

Trusted

#1090063 16-Jul-2014 15:46

yes

Johnboy1234

44 posts

Geek

#1090067 16-Jul-2014 16:00

Well I rebooted the computer OK after quarantineing everything, so I guess that worked, or did it?

Sky is too expensive for what you get.

1 | 2

News and reviews »

New ECOVACS DEEBOT T80S OMNI Available Now
Posted 9-Apr-2026 11:11

Ring Brings 4K Video to Battery-Powered Doorbells
Posted 9-Apr-2026 11:01

Synology Announces a New Privacy-First Home Monitoring Experience for BeeStation Plus
Posted 9-Apr-2026 10:02

GIGABYTE X870E AERO X3D DARK WOOD Redefines the Motherboard
Posted 7-Apr-2026 14:06

Datacom Acquires Auckland Data Centre from T4
Posted 2-Apr-2026 09:43

Spark Launches Satellite Service with SMS and data options
Posted 2-Apr-2026 09:16

Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Updates »

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Support Geekzone »

You can support Geekzone with a one-off or recurring donation via PressPatron.