Download: June 2007

Community Comments

Fighting Trojan Zlobs and PUPs; The Mystery of “Jpeg” Files

By Cheryl Leff  

Q: I left my computer on overnight, with Internet Explorer open. When I came back in the morning, there were 45 IE windows open, with lots of popup ads, and several windows warning that malware had been detected. The top couple of windows had a blue shield logo, kind of like a blue version of Microsoft’s Update shield, and were directing me to buy some piece of software called “MalwareWipe.” Fortunately, I have SpySweeper, and that was indicating that malware was detected, so I closed all the windows and ran a scan. It found something called “trojan-downloader-zlob.” I quarantined and deleted that.

What I want to know is: How dangerous is this trojan downloader and how did I get it in the first place? Am I correct in thinking that MalwareWipe is something I don't want? And am I OK now, or is there likely to be something still left hiding that can come back to bite me later?

A: You’ll be glad to know you did exactly the right thing! This demonstrates, once again, why you need to be sure to run recognized, reliable anti-virus and anti-spyware software at all times, with updated malware definitions.

The trojan, Zlob (a variant of something McAfee calls Puper – I kid you not!), is a downloader – which means that it downloads other malware, which may include keyloggers (which log every keystroke you make and send it back to the malware maker); BHOs, or Browser Helper Objects (talk about misnamed!), which are pieces of code that attach to your browser and serve you popup ads or re-direct your browser to their website. In your case, it opened up all those windows and served up several bogus alerts, warning you that malware had been detected and advising you to “click here” to purchase MalwareWipe to remove it.

Fortunately, you were smart enough to avoid the trap. MalwareWipe is a useless piece of software (what McAfee calls a “PUP”: potentially undesirable program) that does nothing to remove spyware, and may actually deliver it. It can also be difficult to remove once installed. Any of the major anti-spyware (such as SpySweeper or Spybot S&D) and anti-virus programs (like McAfee, Norton or AVG) should be able to detect, prevent and remove these items, provided you have up-to-date virus/spyware definitions.

As to how your computer became infected, Zlob was probably delivered as a “drive-by download” from some Web site you visited, quite possibly without the knowledge or permission of the site owner.

Q: I’m currently having problems opening jpeg pictures. When opening pictures saved in a folder, I get an error message “Cannot find the file or one of its components — make sure path and filename are correct and that all required libraries are available.” I won't get this message if I happen to have Internet Explorer already open; however, it does take exactly 30 seconds to open the picture every time. When I open a jpg picture from an email attachment it takes 30 seconds to open. I never had this problem before. It used to open immediately when I clicked on it (regardless if Internet Explorer was open or not). I recently switched from a phone line to cable. I don’t know if this is just a coincidence or not.

A: The problem most likely resides in your File Type association settings. Switching from phone to cable shouldn’t have anything to do with it, unless the new ISP installed software that altered the File Type settings.
I also notice that you mention having problems opening “jpeg” files, but can open “jpg” files in email. This may be a significant difference. Even though they refer to the same file format, if you have a file type set up for “jpg” but not for “jpeg,” jpegs may fail to open. There are two ways to resolve this problem: (1) change the file type association or add one for JPEG, or (2) change the “jpeg” file extension to “jpg.” I’ve had success with the second approach, although Windows will warn you that changing the file extension may cause files to not open. Ignore that. The down side is that you have to change the file extension for all jpeg files.

To change the file type associations:

1. Click Start, then Control Panel.

2. In Control Panel, click Folder Options. Click the File Types tab.

3. You will see a list of file types in the window, showing the file extension and the icon and program associated with each. Scroll down to JPG and see what (if any) program is associated with it. If there is none, or there is some program you don’t want, click the Change button.

4. A window will open, showing a list of available programs. With Windows XP and later, the Windows Fax and Picture viewer is a good choice. If you have a graphics program in which you like to edit images, such as PhotoShop, select that; then click OK.

5. If JPEG, doesn’t show up on the list, click the New button and add it; then select a program to open it, as above.

If you don’t have a viewer that works, you can download Irfan View for free from http://www.irfanview.com/. 

• Share
  • Digg This
  • del.icio.us
  • Newsvine
  • Facebook
  • Reddit
  • Furl It
  • !Y My Web
  • Google
• Email
• Print

Recommend This

Community Comments