Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Strange File In My Pictures Folder


  • Please log in to reply
11 replies to this topic

#1 Wendy K. Walker

Wendy K. Walker

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 20 August 2007 - 12:22 AM

Hi Everyone,

I'm not sure if this is the right forum to be posting this question in but here goes. Several weeks ago I had a devastating experience while using Microsoft Works Word Processor and lost a weeks worth of work. I posted this thread about it.
--> http://www.bleepingcomputer.com/forums/t/102537/trouble-with-microsoft-word-processor/ .

OK, today I was going through one of my pictures folders and just happened to stumble across a "file" stuck in with the pictures. The name of that file was similar to the one that I was talking about in that first thread but it has a ".1" file extension instead of a ".jpg" extension.

I tried to open it and got the Microsoft note saying that Windows couldn't open the file and asking if I wanted to search the INTERNET pro a program that could open it.

I figured it was a long shot but decided that I would give it a go anyway and clicked on search the INTERNET and got to this page --> http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=1 <-- That didn't give me much so I took another shot and clicked on the "Windows Live Search" button, got sent to this page --> http://search.live.com/results.aspx?&F...ile+extension+1 .

I clicked on this link --> http://www.liutilities.com/products/winbac...ibrary/files/1/ . OK so if you followed that link you wound up on this page --> http://www.liutilities.com/products/winbac...ibrary/files/1/ .

Now comes my question... At the top of the page is a little information bubble that says;

Description 1 is the file extension for the STEP Backup file associated with Iomega Backup.

Windows Cannot Open 1 Files? If Windows cannot open 1 you may not have the appropriate program installed or have a registry related error. We strongly recommend you run a free registry scan. <--- As I've never heard of this site before and don't have "Iomega Backup" I'm wondering how to tell if this is a legitimate site or not.

OK, I wrote all of that "Before" I went out Googling and educated myself a little. So now that I know there is such a thing as Iomega I need to change my question a little...as I have never used Iomega, and there is no such animal installed on my system how the heck did I end up with something called "A STEP Backup" copy of one of my files done by that program?

And more importantly "How can I access that backup file?" When I open it in Word Pad it has the resemblance of being an encrypted document.

Anyone have any experience using that program?

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

BC AdBot (Login to Remove)

 


m

#2 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,023 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:11:13 PM

Posted 20 August 2007 - 01:21 AM

If you download a utility like File Analyzer you can identify the format of a file, with what it was compiled, encrypted, packed, etc. Once you know what the format of the file is you will know what you need to open it with.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#3 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 20 August 2007 - 01:54 AM

Hi dc3, Thanks for the reply.

Well I managed to track its format down to something called a "STEP Backup" from something called Iomega, but I don't have that program on my PC.

So my original questions are still there. !.) How the heck did one of my .wps documents get saved as a .1? 2.) How the heck did it get from within a folder in my documents folder over to another folder in my pictures folder? and 3.) How the heck can I open it?

OK, I'm off now to check out that link...

Thanks,

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#4 rowal5555

rowal5555

    Just enough info to be armed & dangerous...


  • Members
  • 2,644 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:St Kilda, Dunedin. South Island. NZ
  • Local time:08:13 PM

Posted 20 August 2007 - 02:16 AM

FWIW. Just downloaded the FileAnalyser Zip file and Avast went crazy advising it contained a trojan.

rowal5555 (Rob )                                                             

Avid supporter of Bleeping Computer's
Team 38444

You can help find a cure


 


#5 Manshead

Manshead

  • Members
  • 96 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London England
  • Local time:07:13 AM

Posted 20 August 2007 - 02:33 AM

If you download a utility like File Analyzer you can identify the format of a file, with what it was compiled, encrypted, packed, etc. Once you know what the format of the file is you will know what you need to open it with.


I downloaded this link how do you use the program
Handle every situation like a real man.
If you cant eat it or drink it.
Walk Away, it Aint worth the hassle.

#6 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 20 August 2007 - 02:39 AM

Hi rowal5555, Thanks for the reply.

oh-oh! My Avast! must be broken then. I just downloaded the .zip packet, saved it to my HD, checked it with Avast, then extracted it into its own folder all without Avast! complaining at all.

I tried to figure out how to make it work but it didn't have an installer or an .exe for me top click on so I deleted both the file and the .zip folder too.

Did Avast! name the Trojan?


Thanks for the warning.

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#7 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 20 August 2007 - 02:43 AM

Hi Manshead, Thanks for the reply.

DON'T TRY TO USE IT JUST YET !! Read rowal5555's comment first and then go from there OK?


Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#8 jhsmurray

jhsmurray

  • Members
  • 383 posts
  • OFFLINE
  •  
  • Location:6,378 km above the Earth's core
  • Local time:03:13 AM

Posted 20 August 2007 - 03:10 AM

One thing you might try is to upload the file for scanning. This list (under Free Online Virus/Trojan/Spyware Scanners) has a few options:
http://www.bleepingcomputer.com/forums/topic3616.html

Also, it's remotely possible that a different program is using the Iomega format. Have a look here:
http://filext.com/file-extension/1
At the bottom of the page, are any of these programs installed?

Acer Aspire 5732z
OS: Windows 7 Ultimate
Processor: Intel Pentium III Xeon, 2200 MHz
RAM: 3 GB
Display: Mobile Intel GMA 4500M

#9 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 20 August 2007 - 03:48 AM

Hi jhsmurray, Thanks for the reply.

I took a look at that second link that you gave me ans I don't have any of those things installed on my PC. I'm checking out the first link as we speak.

As stated in my original post I think that I know what the file is but I just don't understand how it got from where it was in my documents folder where it was a .wps document file and into a folder in my pictures folder and with a .1 extension.

I was able to open it in wordpad but I couldn't read it because it looks as though it has been encrypted.

I Shall continue with this tomorrow as I have got to get to bed.

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.

#10 rowal5555

rowal5555

    Just enough info to be armed & dangerous...


  • Members
  • 2,644 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:St Kilda, Dunedin. South Island. NZ
  • Local time:08:13 PM

Posted 20 August 2007 - 04:11 AM

Weird. Avast complained loudly twice on the Zip file before I even had a chance to scan it. It did name the alleged Trojan but I didn't take any notice as Eraser was thru it in 2 seconds. LOL
Good luck.

rowal5555 (Rob )                                                             

Avid supporter of Bleeping Computer's
Team 38444

You can help find a cure


 


#11 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,023 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:11:13 PM

Posted 20 August 2007 - 10:20 AM

Well that was less than useful, I downloaded it twice only to have an empty file. I apologize for the wild goose chase, softpedia usually has safe and reliable downloads.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#12 Wendy K. Walker

Wendy K. Walker
  • Topic Starter

  • Members
  • 633 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:In The Treeline 300 Yards Behind You, Tracking Your Every Move Through A Sniper Scope
  • Local time:07:13 AM

Posted 21 August 2007 - 06:52 PM

Hi dc3, Thanks for the reply.

Well, I still don't know about it. I've been talking to OldTimer about it and he said that he just downloaded it and told me what to look for to be able to use it.

I had gotten it downloaded and unzipped once but it wouldn't work so I had deleted it. Then when I tried to download it again I got a "0" byte folder a couple of times too.

I think some of my problem was coming from my Unzipping utility, which was CAM UnZip, because once I had gotten it to download again and I tried to unzip it I was getting some weird notice saying "this is disk one of a backup set, please insert disk one" or something like that.

Anyway, I got rid of CAM UnZip and got FreeZip. Then downloaded File Analyzer again. It has 375 kb in its zipped state, and unzips to 1.06 MB. There is supposed to be a file fa.exe in there somewhere but so far I haven't found it yet, so I have to get back to OldTimer and find out exactly where to look for that file.

I'll let you know what happens.

Wendy
TRUST NO ONE...! EXCEPT For The Beloved Computer Geek Helping You In The MALWARE FORUMS.

Do Unto Others Before They Have A Chance To Do Unto You.

HP Pavilion 512n [Rescued from a pile of trash on the side of the road] 128 MB SDRAM, 60 GB Hard Drive, Windows XP, Home Edition, SP3, COMODO Anti Vitus and Firewall.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users