[samiurrahman]

All the image files(.jpg or .png) saved on my computer or dropbox or google drive are getting edited by themselves. By getting edited, i mean at the left bottom corner of each photos a text saying "I am sorry!!!" is appearing. It started few months ago on my old laptop. It only happened with the pictures saved on my dropbox. I thought it might be some kind of virus and i looked for a solution but didn't find any. I stopped using dropbox after that. Then when i bought my new laptop, i thought the problem would go away. But it started happening the same with the google drive photos. The same text "I am sorry!!!" started appearing on the photos. I also noticed that, it doesn't just happen once to a single photo. It gets edited multiple times and the text just stacks on top of the old one. Anyone have any idea what this is? I ran antimalware software and anti virus software, but nothing works. Couple of examples are attached. I would really appreciate any help on this.

Attached Thumbnails

• 
• 

[Advertisements]

ESET calls it:

Win32/Delf.NRJ worm

Their online scan can remove it:

Use IE and go to https://www.eset.com...online-scanner/

  and click on SCAN NOW under ESET online Scanner.  Accept the terms then press Start (If you get a warning from your browser tell it you want to run it).   Click on Advanced Settings.

Make sure you check Clean Threats Automatically then hit SCAN.  Will probably take several hours.

IF you don't use IE it will still work but you must download a program and run it.
 

Once ESET finishes, download a clean jpg.  Reboot and see if the I am Sorry shows up on your new jpg.

 

IF it comes back then we need a FRST log:

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[RKinner]

ESET calls it:

Win32/Delf.NRJ worm

Their online scan can remove it:

Use IE and go to https://www.eset.com...online-scanner/

  and click on SCAN NOW under ESET online Scanner.  Accept the terms then press Start (If you get a warning from your browser tell it you want to run it).   Click on Advanced Settings.

Make sure you check Clean Threats Automatically then hit SCAN.  Will probably take several hours.

IF you don't use IE it will still work but you must download a program and run it.
 

Once ESET finishes, download a clean jpg.  Reboot and see if the I am Sorry shows up on your new jpg.

 

IF it comes back then we need a FRST log:

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[samiurrahman]

Thank you for your reply. So as you suggested, i ran the eset online scanner and also ran 360 security antivirus. They found some files they claim that they are infected. But my question is, the files they supposedly think are infected, are mostly .exe files. To be precise, most of them are itunes.exe, kmplayer.exe, ccleaner.exe, a few files from microsoft shared folder, CPUID.exe, java.exe from my java installation folder and so on. My point is, all these exe files are known to us. I mean i use these softwares all the time. Are the antivirus software giving me a false positive? or these exe files can actually get infected with a virus and cause the problem i am having. I am a bit confused. I wouldn't mind to reinstall my whole computer but it's a whole new laptop and i haven't installed any fishy software after i bought it. just the ones that i as well as many other people use. Also, i visit very limited number of websites. So where exactly is this virus coming from and the antivirus just wants to quarantine the files, which means i can't use these programs. So what should i do in this situation?

Thanks 

[RKinner]

The virus likes to replace exe files with its own file.  They are then usually all the same size.  If in doubt submit the file to virustotal.com and see what they say.

 

As for how you got the virus did you reuse any files from your earlier computer?

[samiurrahman]

Ok. I'll submit the files to virustotal.com . And I didn't use any files from my old computer. All these software are downloaded and installed fresh and from the official website.