Question/thoughts on suspicious image file behavior

[Z0mBieP00Nani]

The other day I was doing reverse image searches and found one version of the image I had been looking for in the webp image format (I HATE that format by the way, what a useless format for something that could just as well be in JPEG or PNG in my opinion, but I digress) later I found an even bigger version of the image I had been looking for and decided to delete the previous image, well this is wher things get kind of interesting. First I noticed that I could not delete image, or move it from my desktop to another file folder, or resave it in MS Paint, which was odd because  I never got any error messages saying that the image was being used by another program or anything like that, I also noticed that the image had an unusually long and nonsensical name, almost like a programming code or something, I thought that maybe it had been a glitch so I shut down then turned on my computer, but I still could not move or delete the image. After some research I ended up rebooting in safe mode, opening the image file in Notepad++ and deleting all of the script I saw then resaving it (not sure if that did anything other than make the picture go away, I STILL could not delete or move it anywhere  else), then I rebooted the computer aging, downloaded a program called  "FileASSASSIN" and was able to delete the image that way.

 

So what I want to know is what was that, and should I be worried?

[Tron91]

41 minutes ago, Z0mBieP00Nani said:

The other day I was doing reverse image searches and found one version of the image I had been looking for in the webp image format (I HATE that format by the way, what a useless format for something that could just as well be in JPEG or PNG in my opinion, but I digress) later I found an even bigger version of the image I had been looking for and decided to delete the previous image, well this is wher things get kind of interesting. First I noticed that I could not delete image, or move it from my desktop to another file folder, or resave it in MS Paint, which was odd because  I never got any error messages saying that the image was being used by another program or anything like that, I also noticed that the image had an unusually long and nonsensical name, almost like a programming code or something, I thought that maybe it had been a glitch so I shut down then turned on my computer, but I still could not move or delete the image. After some research I ended up rebooting in safe mode, opening the image file in Notepad++ and deleting all of the script I saw then resaving it (not sure if that did anything other than make the picture go away, I STILL could not delete or move it anywhere  else), then I rebooted the computer aging, downloaded a program called  "FileASSASSIN" and was able to delete the image that way.

 

So what I want to know is what was that, and should I be worried?

 

Do a proper scan of your PC. Also do you have a copy of the script embedded in the image. That could point out what harm it might have done to your PC.

[Z0mBieP00Nani]

58 minutes ago, Tron91 said:

 

Do a proper scan of your PC. Also do you have a copy of the script embedded in the image. That could point out what harm it might have done to your PC.

No, I was too paranoid and got rid of the whole thing. It seemed like it could be radioactive, if that makes sense?

 

What's also odd is that when I scanned the image itself it came up clean, which didn't seem right given the circumstances.

 

I'm starting to wonder if the image file was intended to be a back door into my system or a marker of sme kind. I have yet to run a full scan of my system, not that I'm convinced anything will be found, even if there is anything to find, given what happened when I scanned the file its self. I did briefly look to see if power shell was open, but didn't see anything like that.

[ChloeKitten]

Hmm... >.>
Sounds kinda scary, but it might just have been some regular program using the file. Maybe if it happens again I could recommend lockhunter as an alternative to FileASSASSIN. Lockhunter will tell you what is locking the file, might be helpful in finding if it's dangerous or not

Side note:

On 9/13/2022 at 4:40 PM, Z0mBieP00Nani said:

(I HATE that format by the way, what a useless format for something that could just as well be in JPEG or PNG in my opinion, but I digress)

Yeaah, i mean is sucks that not many programs support webp, but the format itself is actually pretty good im told. It can do the work of both jpeg and png all while taking up less space.

[Z0mBieP00Nani]

3 hours ago, ChloeKitten said:

Hmm... >.>
Sounds kinda scary, but it might just have been some regular program using the file. Maybe if it happens again I could recommend lockhunter as an alternative to FileASSASSIN. Lockhunter will tell you what is locking the file, might be helpful in finding if it's dangerous or not

Side note:

Yeaah, i mean is sucks that not many programs support webp, but the format itself is actually pretty good im told. It can do the work of both jpeg and png all while taking up less space.

Thanks for the tip, I had never heard of lockhunter before now.

[Captain Cobra]

Windows doesn't like files with super long file names, have had a similar problem with an image I downloaded that had a fuck ton of *booru style tags in it's filename.

The "script" you deleted was just the image data.

[DrunkenCow]

On 9/16/2022 at 12:21 AM, Captain Cobra said:

The "script" you deleted was just the image data.

 

Probably, but

cat porn.jpg rat-installer.exe >> totallynotarat.jpg

 is still a thing that will install the RAT if you double click to view it.  

[myuhinny]

.WEBP  image format is better than .PNG and .JPG as it's basically the same thing without the huge ass file sizes that come with it. To be able to view .WEBP files on a computer you might have to download a .WEBP codec. Some sites are starting to use it and many adult game DEV's that use RPGM and renpy are starting to switch from .PNG to .WEBP for images to keep their file size down as they can quickly become huge and if your download of stuff is metered then it can eat up your limit in a hurry. Many are also switching to .WEBM file format for videos. 

 

How to Open WebP Images on Windows 11 and Windows 10 PCs (techdows.com) Link is also in my sig.

 

I have had trouble deleting files before but usually I could inside the folder and delete everything out of it and then later delete empty when I can.