What just happened to my PC?

Question

I was trying to open a .png picture today and clicked edit instead of open, which in my opinion wouldn't affect anything. However, most likely coincidentally, as soon as I clicked edit, a large number of cmd prompts opened and closed quickly.

I noticed that the file location was on the headers of the cmd prompts. This is what it said, from what I gathered before it stopped: C:\<user>\AppData\Google.

Does anyone have any idea what happened and what can I do to fix it or keep it from happening again?

Answer 1

It might be that some virus/application modified the registry key that executes which command when clicked on edit. Check yourself first in the registry.

Browsing the file extension key in HKEY_CLASSES_ROOT will say the key for the shell menus. Now find that shell key in the registry editor.

If there is another app that modified, like I have 'Edit with GIMP' here, new shell item appears. If there is something there, just check the command.

It might be that the program that is opening that file from the context menu might be faulty and it generates the errors. If that program is having errors, just delete that entire key, and the edit should ask you to select the program to launch.

Answer 2

It might be as stated by @SriHarsha, but there are also the following cases

Virus in PNG

Unlikely but even worse case:

the PNG file itself is prepared in a special way and contains a virus that opens a command prompt in order to perform a special operation (whatever the virus wants it to be).

Depending on the program which is used to open the PNG file, the virus may become active or not. E.g. it may not become active in Windows Image Viewer, because that program uses a newer graphics library which checks for buffer overflows.

But since you accidentally clicked "edit", it was opened in MS Paint, which might use a different library that does not perform buffer overflow checks, therefore crashes and the crash causes the virus to become active. The virus manages to run a command via the command line.

In such a case, the application is likely to crash or be unusable.

Fix: no fix. Run an antivirus program. If the virus is very new, it may not be detected. Don't use the PNG, but maybe keep it if you want to contact an anti-virus vendor.

Debugger

It is possible to set up a debugger to launch automatically when a program is started. This is done via the Registry Key ImageFileExecutionOptions. Depending on what type of debugger it is, it may open a console window. When the debugger decides to detach, the console window may close.

In that case, the application is likely to run normally.

Fix: remove the Registry Key for the affected program.

Answer 3

It could be a virus masked/binded to a PNG/JPG file. With your accidental 'edit' of the image file, it may have caused the virus binded/masked to it to run.

Some viruses can be set to mask or bind into images. That way when you open the image file, it opens up the virus too. The way most of these things work is, the virus is stored into a .rar file and then placed inside the actual image. But most other binders work too.

You should run an anti-virus scan your entire system and the image file, as soon as possible. And delete the image file so you won't accidently edit it/run it again.