Destrojed JPG picture (not from Affinity)

[Petar Petrenko]

Hi,

here is a screenshot of a JPG picture from my wife's computer. There are 1000's of JPG photos destroyed by something. Does somebody know the reason why this happened? At the moment of opening the picture it is OK, but after a 1/10th of a second it is ruined. The pattern is not repetitive.

P.S.

She uses "Microsoft Photo Viewer" or maybe "Photos" (also from Microsoft) to watch the pictures. She doesn't know to use and doesn't have any bitmap editor. BTW, all other files are OK.

[v_kyr]

Did those showed up and worked correctly before? - Reminds me to some wrong image transfer from a card reader I've once saw, that card reader had difficulties working correctly on a specific USB port and always mismatched the image transfer from certain CF cards.

[Petar Petrenko]

She has the pictures for years and she noticed it a few days ago.

[walt.farrell]

Are they ok if you open them on your computer, or corrupted there, too?

[Petar Petrenko]

I'm affraid to copy any of them to my computer. If they contain virus...

https://www.geek.com/news/updated2-new-virus-embeds-itself-in-jpg-images-549279/

[casterle]

14 minutes ago, Petar Petrenko said:

I'm affraid to copy any of them to my computer. If they contain virus...

https://www.geek.com/news/updated2-new-virus-embeds-itself-in-jpg-images-549279/

Note that the article is from 2002. Google for jpeg viruses and see if that reassures you. I don't see how the contents of a jpeg could hurt your computer as long as you only open it in a trusted application like AP (but computer security is far from my area of expertise).  

I assume you've checked her system for malware. You might try installing a trusted image viewer like IrfanView  (www.irfanview.com) and see if they display properly.

[Petar Petrenko]

It is protected only by Wondows Defender.

For malware I only use SuperAntiSpyware.

[casterle]

6 minutes ago, Petar Petrenko said:

It is protected only by Wondows Defender.

For malware I only use SuperAntiSpyware.

Windows Defender is good. I don't know about SuperAntiSpyware; I use MalwareBytes and it hasn't let me down.

Have you tried installing IrfanView and viewing the images with it?

[Petar Petrenko]

Yes, I tried. The same results, unfortunatelly.

SuperAntiSpyware is great program. It saved me when no other could.

[casterle]

24 minutes ago, Petar Petrenko said:

Yes, I tried. The same results, unfortunatelly.

SuperAntiSpyware is great program. It saved me when no other could.

I assume you've also tried updating drivers. Do you have somewhere you could upload one of the images so I could take a look?

[Petar Petrenko]

Here it is.

[casterle]

2 minutes ago, Petar Petrenko said:

Here it is.

This was sent directly from your wife's computer, right?

[Petar Petrenko]

No, I copied to mine first via Viber.

[casterle]

1 minute ago, Petar Petrenko said:

No, I copied to mine first via Viber.

I didn't realize you'd decided that was safe. Do the file dates indicate that they have been changed about the time you noticed the issue?

[Petar Petrenko]

Well, I took a risk.

The Created and Modified dates are january 25, 2015 and the accessed date is march 22, 2017 for this picture.

[casterle]

6 hours ago, Petar Petrenko said:

Well, I took a risk.

The Created and Modified dates are january 25, 2015 and the accessed date is march 22, 2017 for this picture.

Could it possibly have been corrupt that long? Can you establish the last time that the file was known to be good?

Of course it's easy for a program to change a timestamp, or modify a file and not change the timestamp, but it's not something that an application would typically do.

Other than this image file issue, has her computer been behaving properly?

[v_kyr]

You can give some JPG repair tools a try ...

• The best programs to recover damaged jpg files

... and see if those might help to identify the problems.

[Petar Petrenko]

3 hours ago, casterle said:

1. Could it possibly have been corrupt that long?

2. Can you establish the last time that the file was known to be good?

Of course it's easy for a program to change a timestamp, or modify a file and not change the timestamp, but it's not something that an application would typically do.

3. Other than this image file issue, has her computer been behaving properly?

1. I don't know how long they have been corrupted because I don't use her computer.
2. I don't understand your question. How to do that and what is it good for?
3. Yes, everything else works fine.

 

[Petar Petrenko]

3 hours ago, v_kyr said:

You can give some JPG repair tools a try ...

• The best programs to recover damaged jpg files

... and see if those might help to identify the problems.

Thanks @v_kyr. I'll give them a try.

[casterle]

9 hours ago, Petar Petrenko said:

I don't understand your question. How to do that and what is it good for?

It's not something you would do, I was just noting that while it's easily possible to modify the contents of a file without changing a timestamp programmatically, that's not something an application would generally do. In other words, only a program designed for nefarious purposes would do that, to disguise that or when the file was changed and thus make it harder to find the culprit. 

Since you apparently don't have viruses (and I've never heard of one designed to mess with your photos and nothing else) or malware, and we know the files were once in good condition on that computer, the corruption must have occurred on that computer. But how?

MalwareBytes has a free version. You might give that a try and see if it finds anything. Beyond that I'm at a loss.

[Petar Petrenko]

Thanks guys for helping me with the problem.

@casterle I'll give a chance to MalwareBytes to see if it could help me.

[casterle]

47 minutes ago, Petar Petrenko said:

Thanks guys for helping me with the problem.

@casterle I'll give a chance to MalwareBytes to see if it could help me.

Two other thoughts come to mind. Windows provides a couple of utilities you should try. One will scan your system and check the OS files for completeness and corruption, and the other checks your hard disk for corruption.

You must run the first program, fsc, from the command prompt as administrator. Open the command prompt by right clicking on the icon in your taskbar, then 'Run as administrator'. On Win 10 that option is hidden; you have to right-click twice - once on the icon to open the context menu:

Then again on 'Command Prompt' within the context menu:

And finally on 'Run as administrator'.

At the command prompt type:

  sfc /scannow

The scan takes about 20 minutes on my system. It will tell you if it finds a problem with your system files.

Once this scan has completed, type:

   chkdsk

and wait for the scan to complete. Depending on disk size and speed this scan can take an hour or more.

If either of these programs finds problems, post the results here and we can proceed.

[Petar Petrenko]

I started with SFC /SCANNOW but no window is opened to monitor the progress. It is the same case with CHKDSK. Is it OK or something is wrong?

[casterle]

4 hours ago, Petar Petrenko said:

I started with SFC /SCANNOW but no window is opened to monitor the progress. It is the same case with CHKDSK. Is it OK or something is wrong?

Yes, that's how command line utilities generally work. They take their input via command line parameters (the '/scannow' part of the sfc command). Output is printed in the 'DOS box' where the command prompt lives, below the line to typed to start the utility.

If either of these programs indicates that it found a problem, it will tell you in the text it displays. If you think the output indicates an issue, can you grab a screenshot (focus on DOS box, Alt-PrtScrn). That puts the image in the clipboard. You can literally paste (Ctrl-V) that image into the editor when you reply to this message rather than saving it to a file first.

If there is more output than will fit on a screen let me know and I'll tell you how to proceed. 

[Petar Petrenko]

Yesterday, when I tried, a DOS text box appeared for a fraction of a second and dissapeared. It happened with both commands (AFC and CHKDSK). No report, no prompt that it was working or stopped working. Just nothing. I can try something else when she comes back home about 6 PM and it is 8:30 AM now.

I tried, also, MalwareBytes. It found some malware and removed them, but the photos are still the same.

I installed "Stellar Repair for Photo", too, but it didn't help. I was watching, in a separate window, the folder with the pictures while it was running and nothing happened when it said that a picture was repaired.