Computer infected?

Forum for all sorts of software discussions. Operating systems, applications, utilities and other software are all here.

Moderators: CPUagnostic, MTX, Celt, Hammer_Time, Sauron_Daz, Tacitus, Anna

Computer infected?

Postby Stupify » Wed Apr 17, 2013 5:41 pm

I was doing a diff between my computer's version against the NAS i had built and noticed there were many JPG files that were modified on 20130221 15:20 +/-3 minutes. Many different folders and just random files in them, not even all. I did a scan on my computer's version and no reports. I opened them up and did a visual compare against the NAS version and no difference there too. The size grew by 5-10% at max (600kb became 615kb and so).

What gives?
What goes around comes around with interest!
User avatar
Stupify
Moderator
 
Posts: 9187
Joined: Wed Dec 31, 1969 4:00 pm

Re: Computer infected?

Postby DIREWOLF75 » Wed Apr 17, 2013 6:58 pm

Different underlying file systems?

Ie the classical size of file vs size of file on disk. I bet the NAS doesn´t use the exact same.
This has been an objective and completely impartial message from the propaganda bureau of DIREWOLF75. Thank you for reading. Have a nice day.
Image
User avatar
DIREWOLF75
X-bit Goon
 
Posts: 15125
Joined: Wed Dec 31, 1969 4:00 pm
Location: Isthmus of Baldur (modernly known as Bollnäs), Sweden

Re: Computer infected?

Postby Stupify » Thu Apr 18, 2013 2:42 am

you misunderstand - only some of the JPG files on my computer were modified. I compared those against the version on the NAS and there was no change there. These are pictures that I have categorized by time and event. And the modified files were in random folders (categories) and random files (not all files in the same folders were modified, just few in each folder impacted). all around the same time. i am sure it wasn't a manual change as it would definitely take much longer to modified so many files in so many places. so how and why?
What goes around comes around with interest!
User avatar
Stupify
Moderator
 
Posts: 9187
Joined: Wed Dec 31, 1969 4:00 pm

Re: Computer infected?

Postby Stupify » Thu Apr 18, 2013 4:41 am

Damn I should have compared the actual content of the files before replacing them with the non-modified version to fully understand what's happened.

Anyhow I found few more JPG files that I had not got to fixing but the NAS contains the same version (modified). I then had the idea to compare the files against their peers (same folder files that were not modified). What i found is that there was some EXIF data added to the header, with a time-stamp in it. The time-stamp matches the file creations of the peers that do not have the EXIF data.

So very high chance of no virus but some software going in there and adding in the EXIF data. Although I could be wrong too and so I look to you guys if you have any idea.
What goes around comes around with interest!
User avatar
Stupify
Moderator
 
Posts: 9187
Joined: Wed Dec 31, 1969 4:00 pm

Re: Computer infected?

Postby DIREWOLF75 » Thu Apr 18, 2013 6:46 pm

Anyhow I found few more JPG files that I had not got to fixing but the NAS contains the same version (modified). I then had the idea to compare the files against their peers (same folder files that were not modified). What i found is that there was some EXIF data added to the header, with a time-stamp in it. The time-stamp matches the file creations of the peers that do not have the EXIF data.

So very high chance of no virus but some software going in there and adding in the EXIF data. Although I could be wrong too and so I look to you guys if you have any idea.

Well in that case, did you by any chance access those folders(or merely the parent folder even) at the time of changes?
If whatever you browsed with was set "correctly", it could have started adding in that data automatically. Anyway, some variation on that seems to have been the event.
This has been an objective and completely impartial message from the propaganda bureau of DIREWOLF75. Thank you for reading. Have a nice day.
Image
User avatar
DIREWOLF75
X-bit Goon
 
Posts: 15125
Joined: Wed Dec 31, 1969 4:00 pm
Location: Isthmus of Baldur (modernly known as Bollnäs), Sweden


Return to General Software Forum

Who is online

Users browsing this forum: No registered users and 1 guest