It appears to be a “.gif” that is wrapped or renamed. It caused the website to not save content when it was being added or updated.
I found the file in the root of the Joomla install and also in the /images folder. It looked like this.
Solution: AVG quarantined the tojan and I upgraded the Joomla install to version 3.
I found more info on the virus here.