-1

One of my friends windows laptops (which I don't have access to right now) has in the recent past had a virus (where .doc files were converted to .exe files) which we dealt with.

Now when she right-clicks a folder to "send to compressed file" instead of creating a .zip file it creates an image file (jpg/png variety - will find out which). Is this known behaviour of a virus? I can't find anything anywhere about this kind of behaviour. Avast is not picking it up as a virus, but I can't imagine it being anything but a virus.

Where do I start to fix this?

Matt Parkins
  • 101
  • 6
  • 1
    image file in sense iso/nrg or jpeg/jpg? – BlueBerry - Vignesh4303 Mar 13 '13 at 12:15
  • 4
    See http://xkcd.com/1180/ – AviD Mar 13 '13 at 12:43
  • 1
    I would assume, since you say that you dealt with the previous virus, that you ["nuked it from orbit"](http://security.stackexchange.com/q/24195/33). Is this assumption correct, or is your friend's laptop still presumed infected? It is definitely one of the two. – AviD Mar 13 '13 at 12:45
  • I didn't nuke it from space, no! Just used avast to remove the virus, but yes that might be a solution! – Matt Parkins Mar 13 '13 at 15:09
  • Image as in jpg/png - will find out which! – Matt Parkins Mar 13 '13 at 15:11
  • @AviD Ok, any ideas what it could be? I can't think why any legit program would do that. – Matt Parkins Mar 13 '13 at 15:12
  • No, I don't know what would have caused it (nothing *should* have) and I don't know if it IS a virus nor if it IS NOT. My point is it's throwing good hours down a sewage pipe, until you start with a known clean (or at least, not a known-unclean) system. It might just be a simple registry key import, it might not, but I wouldnt bother with it. – AviD Mar 13 '13 at 15:56
  • It's like if you take your jalopy to be serviced, you tell him "I just blew a gasket out on the highway, and I know my engine block is cracked. Can you please check the oil?" – AviD Mar 13 '13 at 15:57
  • Not really, it's like saying "the car doesn't work anymore" but I can't tell if it is malicious or something I've done to it. So I think the question seems legitimate. Nuking from space should not be a first resort. – Matt Parkins Mar 13 '13 at 16:15
  • 1
    No, the issue is that you *know* there was a severe problem (the virus infestation). You did not deal with it properly, and are trying to ignore it. Again, I don't know that it is caused by the virus, but I find it pointless to deal with the little things (like checking oil) before dealing with the big, critical things (like the cracked engine). Here's the thing: If it is a virus / malware issue, in some way, the advice you will get here is as I've said: Nuke It. If it is *not* virus/malware, the question would be off topic here... – AviD Mar 13 '13 at 19:49
  • No. We very probably did deal with it properly. We simply don't know if it is a virus, hence me asking here if it is a known behaviour of a virus. Why take the car in for a new engine if it is just the oil? I would also have thought here was a great place to ask if that behaviour is known virus behaviour. I think we're done here. – Matt Parkins Mar 14 '13 at 09:32

1 Answers1

3

type this command in run window

windows xp

rundll32 zipfldr.dll,RegisterSendto

windows 7

regsvr32 %windir%/system32/zipfldr.dll

and click ok....

user827918
  • 246
  • 1
  • 5