|
JPEG Virus - Are you Vulnerable?
Use this program found here to see if you are vulnerable to the JPEG virus.
This will tell you which programs that you have installed are vulnerable to attack. Remember - lots of programs are affected by this bug. |
Re: JPEG Virus - Are you Vulnerable?
Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Version: 11.0.5207.5 C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll Version: 6.0.2900.2180 C:\Program Files\Macromedia\Dreamweaver MX 2004\gdiplus.dll Version: 5.1.3097.0 <-- Vulnerable version C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL Version: 6.0.3255.0 <-- Vulnerable version C:\WINDOWS\$NtServicePackUninstall$\sxs.dll Version: 5.1.2600.1515 C:\WINDOWS\$NtServicePackUninstall$\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes) C:\WINDOWS\ServicePackFiles\i386\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\ServicePackFiles\i386\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\system32\GdiPlus.dll Version: 5.1.3102.2180 C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll Version: 5.1.3102.2180 Scan Complete. I installed the GDI patch a week or two ago, how do I get round this? :( |
Re: JPEG Virus - Are you Vulnerable?
Quote:
And that's with a fully patched XP system :Yikes: |
Re: JPEG Virus - Are you Vulnerable?
Good job I'm staying with 98SE ! and Opera :D
Oh and I don't use any of the other MS stuff either .. good old 'Open Office' for me ! :p: |
Re: JPEG Virus - Are you Vulnerable?
The problem that this highlights is that it is NOT JUST XP that is affected - any program which handles JPEG's can be. The only way to make sur eyou are not vulnerable is to update EVERY program which has the possibility of being affected by the vulnerability.
Look on the bright side - at least you now know exactly what needs to be updated on your systems. |
Re: JPEG Virus - Are you Vulnerable?
Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.DLL Version: 6.0.2800.1411 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\gdiplus .dll Version: 5.1.3101.0 <-- Vulnerable version C:\WINNT\system32\dllcache\vgx.dll Version: 6.0.2800.1411 Scan Complete. Scanning Drive D:... D:\Creative Suite\Adobe Illustrator CS\Support Files\Contents\Windows\gdiplus.dll Version: 5.1.3097.0 <-- Vulnerable version D:\HandySnap\gdiplus.dll Version: 5.1.3097.0 <-- Vulnerable version Scan Complete. Not too bad... |
Re: JPEG Virus - Are you Vulnerable?
Scanning Drive C:...
C:\Program Files\porn\pornview.exe Version: 1.3 <-- Vulnerable version C:\Program Files\porn\pornpic.exe Version: 7.3 <-- Vulnerable version C:\Program Files\porn\dirtygit.exe Version: 7.3 <-- Vulnerable version Scan Complete. OH NO - Thats my porn watching buggered. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
WOW! 5.... got to be witty more often..lol
Thanks for that..lol I actually have about 5 entries that are identified. Quote:
Although I haven't a clue what to do about it. Maybe I'll put SP2 on next week, I can't use Win update at present till the IT dept get the poxy proxy sorted. |
Re: JPEG Virus - Are you Vulnerable?
We should all remember that whilst patching our computer software is an unending task, current antivirus software is also an essential part of our security.
If your A/V is current, and updated very regularly (at least once a day), you are going to be extremely unlikely to get an infection on your PC, even if it isnt quite fully patched. The A/V will scan any files as they are opened, detect something amis and prevent it's deployment. Bear in mind that windoze update and similar patching software often lags behind in real time to the detection of vulnerabilities, as things have to be properly tested. It's much easier to test and inocculate against a virus as it's small amount of code con be unpicked and behavior predicted. Thus A/V can be far more current than the patches available. Having said that the jpeg vulrnerability has been known of for a few weeks now, long enough for any good software manufacturer to have the patches available. |
Re: JPEG Virus - Are you Vulnerable?
Upgrades to get yourself patched...
Microsoft Service Pack .NET Framework 1.1 Service Pack 1 http://www.microsoft.com/downloads/d...displaylang=en Microsoft .NET Framework SDK 1.0 SP2: Microsoft Service Pack .NET Framework 1.0 Service Pack 3 http://www.microsoft.com/downloads/d...displaylang=en Microsoft .NET Framework SDK 1.0 SP1: Microsoft Service Pack .NET Framework 1.0 Service Pack 3 http://www.microsoft.com/downloads/d...displaylang=en Microsoft .NET Framework SDK 1.0: Microsoft Service Pack .NET Framework 1.0 Service Pack 3 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Digital Image Pro 7.0: Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Digital Image Pro 9.0: Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Digital Image Suite 9.0: Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Greetings 2002 : Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Internet Explorer 6.0 SP1: Microsoft Patch Security Update for Internet Explorer 6 Service Pack 1: KB833989 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Office 2003 : Microsoft Upgrade Office 2003 Service Pack 1 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Upgrade Office 2003 Security Update: KB838905 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Office XP SP3: Microsoft Upgrade Office XP Security Update: KB832332 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Picture It! 7.0: Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Picture It! 9.0: Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Picture It! 2002 : Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Picture It! Library : Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Platform SDK Redistributable: GDI+ : Microsoft Patch Platform SDK Redistributable: GDI+ http://download.microsoft.com/downlo...iplus_dnld.exe Microsoft Producer for Microsoft Office PowerPoint : Microsoft Patch Producer for Microsoft Office PowerPoint 2003 http://www.microsoft.com/downloads/d...DisplayLang=en Microsoft Project 2002 SP1: Microsoft Upgrade Project 2002 Security Update: KB831931 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Project 2002 : Microsoft Project 2003 : Microsoft Upgrade Project 2003 Service Pack 1 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Upgrade Project 2003 Security Update: KB838344 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visio 2002 Professional SP2: Microsoft Upgrade Visio 2002 Security Update: KB831932 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visio 2002 Standard SP2: Microsoft Upgrade Visio 2002 Security Update: KB831932 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visio 2003 Professional : Microsoft Upgrade Visio 2003 Security Update: KB838345 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visio 2003 Standard : Microsoft Upgrade Visio 2003 Security Update: KB838345 http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visual Studio .NET 2002 : Microsoft Upgrade Visual Studio .NET 2002 GDIPLUS.DLL Security Update http://www.microsoft.com/downloads/d...displaylang=en Microsoft Visual Studio .NET 2003 : Microsoft Upgrade Visual Studio .NET 2003 GDIPLUS.DLL Security Update http://www.microsoft.com/downloads/d...displaylang=en Microsoft Windows Server 2003 Datacenter Edition : Microsoft Patch Security Update for Windows Server 2003 (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows Server 2003 Datacenter Edition 64-bit : Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987 http://download.microsoft.com/downlo...7-IA64-ENU.EXE Microsoft Windows Server 2003 Enterprise Edition : Microsoft Patch Security Update for Windows Server 2003 (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows Server 2003 Enterprise Edition 64-bit : Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987 http://download.microsoft.com/downlo...7-IA64-ENU.EXE Microsoft Windows Server 2003 Standard Edition : Microsoft Patch Security Update for Windows Server 2003 (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows Server 2003 Web Edition : Microsoft Patch Security Update for Windows Server 2003 (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows XP 64-bit Edition SP1: Microsoft Patch Security Update for Windows XP 64-bit Edition (KB833987) http://download.microsoft.com/downlo...7-ia64-ENU.EXE Microsoft Windows XP 64-bit Edition : Microsoft Patch Security Update for Windows XP 64-bit Edition (KB833987) http://download.microsoft.com/downlo...7-ia64-ENU.EXE Microsoft Windows XP 64-bit Edition Version 2003 : Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987 http://download.microsoft.com/downlo...7-IA64-ENU.EXE Microsoft Windows XP Home SP1: Microsoft Patch Security Update for Windows XP (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows XP Home : Microsoft Patch Security Update for Windows XP (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows XP Professional SP1: Microsoft Patch Security Update for Windows XP (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE Microsoft Windows XP Professional : Microsoft Patch Security Update for Windows XP (KB833987) http://download.microsoft.com/downlo...87-x86-ENU.EXE References Source: CERT TA04-260A Microsoft Windows JPEG component buffer overflow URL: http://online.securityfocus.com/advisories/7211 Source: Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow URL: msg://bugtraq/414770A2.9030603@verizon.net Source: Microsoft Security Bulletin MS04-028 URL: http://www.microsoft.com/technet/sec.../ms04-028.mspx Source: Netscape Communicator JPEG-Comment Heap Overwrite Vulnerability URL: http://www.securityfocus.com/bid/1503 Source: RE: old netscape vuln - affecting XP/explorer? URL: http://www.securityfocus.com/archive/82/290856 |
Re: JPEG Virus - Are you Vulnerable?
And an advisory from Symatec.com here which is also where i got the above.
Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability Risk High Date Discovered 09-14-2004 Description Microsoft (Graphics Device Interface) GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds value for a memory copy operation. A specially crafted JPEG image may trigger this vulnerability and result in the execution of arbitrary attacker-supplied code. Code execution would occur in the context of the user who is running the vulnerable software. **Update: This issue is similar in nature to BID 1503, discovered by Solar Designer. Symantec AntiVirus Products A heuristic detection has been released to detect possible exploits of this vulnerability. Symantec Antivirus products will detect files which contain code to exploit this vulnerability as Bloodhound.Exploit.13. Symantec ManHunt 3.0 As of September 25, 2004, users of Symantec Manhunt 3.0 can update to Security Update 28 to detect attempts to exploit this vulnerability. Click here for more information. Symantec Network Security 7100 As of September 25, 2004, users of Symantec Network Security 7100 can update to Security Update 2 to detect attempts to exploit this vulnerability. Click here for more information. This update is available via LiveUpdate. Platforms Affected Microsoft Excel 2002 SP3 Microsoft Excel 2003 Microsoft FrontPage 2002 SP3 Microsoft FrontPage 2003 Microsoft InfoPath 2003 Microsoft MSN Messenger Service 9.0 Microsoft OneNote 2003 Microsoft Outlook 2002 SP3 Microsoft Outlook 2003 Microsoft PowerPoint 2002 SP3 Microsoft PowerPoint 2003 Microsoft Publisher 2002 SP3 Microsoft Publisher 2003 Microsoft Visual Basic .NET Standard 2002 Microsoft Visual Basic .NET Standard 2003 Microsoft Visual C# .NET Standard 2002 Microsoft Visual C# .NET Standard 2003 Microsoft Visual C++ .NET Standard 2002 Microsoft Visual C++ .NET Standard 2003 Microsoft Visual J# .NET Standard 2003 Microsoft Word 2002 SP3 Microsoft Word 2003 Components Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Modular Messaging Avaya S8100 Media Servers Microsoft .NET Framework 1.0 SP2 Microsoft .NET Framework 1.1 Microsoft .NET Framework SDK 1.0 SP2 Microsoft .NET Framework SDK 1.0 SP1 Microsoft .NET Framework SDK 1.0 Microsoft Digital Image Pro 7.0 Microsoft Digital Image Pro 9.0 Microsoft Digital Image Suite 9.0 Microsoft Greetings 2002 Microsoft Internet Explorer 6.0 SP1 Microsoft Office 2003 Microsoft Office XP SP3 Microsoft Picture It! 7.0 Microsoft Picture It! 9.0 Microsoft Picture It! 2002 Microsoft Picture It! Library Microsoft Platform SDK Redistributable: GDI+ Microsoft Producer for Microsoft Office PowerPoint Microsoft Project 2002 SP1 Microsoft Project 2002 Microsoft Project 2003 Microsoft Visio 2002 Professional SP2 Microsoft Visio 2002 Standard SP2 Microsoft Visio 2003 Professional Microsoft Visio 2003 Standard Microsoft Visual Studio .NET 2002 Microsoft Visual Studio .NET 2003 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Datacenter Edition 64-bit Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Enterprise Edition 64-bit Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Recommendations Do not accept or execute files from untrusted or unknown sources. A remote attacker will need to present a JPEG file to a victim user in order to exploit this vulnerability. Avoid accepting or opening files that originate from a user of questionable integrity. Do not follow links provided by unknown or untrusted sources. A remote attacker may exploit this vulnerability through a remote Web site. Avoid following links that originate from a user of questionable integrity. Run all software as a non-privileged user with minimal access rights. Run all applications with the minimum amount of privileges required to function adequately. This action can limit the impact of a successful attack. Do not open email messages from unknown or untrusted individuals. A remote attacker may exploit this vulnerability through email. Avoid accepting or opening unsolicited emails that originate from a user of questionable integrity. Microsoft has released a security bulletin MS04-028 and fixes to address this issue in affected products. Additionally, the vendor reports that this issue is addressed in Microsoft Office 2003 Service Pack 1 for Office 2003, Microsoft Visio 2003 Service Pack 1 for Visio 2003 and Microsoft Project 2003 Service Pack 1 for Project 2003. The vendor also reports that customers that have installed MSN 9, and have chosen to install Picture It! Express version 9 and Picture It! Library, should install the Picture It! version 9 update. Customers are advised to access the referenced advisory for further information pertaining to obtaining and applying appropriate updates. It should be noted that not all of the fixes to address this vulnerability are available at the time of writing. These fixes will be added later once they are available. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
It does say - Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
You have to be rather unlucky to be one of the first to get sent that brand new virus before the good a/v vendors get to know about it, decode it, and release an update. The point is you get waht you pay for. The big a/v players do frequent updates and have enough staff to put out regular frequent updates. Freebie programs surely cannot be as safe, even if they are reputable. The updates arent as frequent for one and after all they are reallly hoping you will pay to upgrade to their paid version which probably does have better updates - there has to be a benefit to the upgrade. Of course being sensible about what you open is a big step in protection. Just 'cos you were sent an email, doesn't mean you should open the attachments. Do you know the sender and were you expecting them to send it to you. If the answer to at least one of those questions is no, proceed with extreme caution. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
I think you are largely OK. As I read the output, the active versions of the DLL's are patched - the vuln. versions are in 'uninstall' locations. Bifta, looks like you need the patch for your Office version (from http://www.microsoft.com/technet/sec.../MS04-028.mspx) and a patch for Dreamweaver, but otherwise your system looks OK. :) Zombini, I don't think you need to do anything.. except relax and :beer: HTH |
Re: JPEG Virus - Are you Vulnerable?
Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\$NtServicePackUninstall$\sxs.dll Version: 5.1.2600.1106 <-- Vulnerable version C:\WINDOWS\$NtServicePackUninstall$\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes) C:\WINDOWS\ServicePackFiles\i386\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\ServicePackFiles\i386\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\asms\10\msft\windows\gdipl us\gdiplus.dll Version: 5.1.3102.2180 C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll Version: 5.1.3102.2180 Scan Complete. Did a trouble free SP2 update two weeks ago. Most of mine seem to be in uninstall folders. Which if any of the patches listed do I need for the two "apparent" GDI vulnerabilties? My AV deffiles auto updated at least five times on Tuesday alone this week, and three times since. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
If you've got Office XP you'll need the patch for that, but more worrying is the bit about ...\GDIPLUS\GDIPLUS.DLL It looks like Windows, or you, have downloaded the patch for GDIPLUS (Software Distribution version), but hasn't moved it into place. No errors from the patch install? I would try the patch again (manual download) and if still no luck manually copy the new DLL in place of the old one (make a Windows Restore point, just in case!). HTH |
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Wayne,
All the patches for the GDI problem can be reached here - http://www.microsoft.com/technet/sec.../MS04-028.mspx Note - If you have your Office CD handy you only need the 'client' version of the patch, otherwise download the 'fullfile' version. My other point was that you have two files - C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDI PLUS.DLL Version: 5.1.3097.0 <-- Vulnerable version ... C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll Version: 5.1.3102.2180 One is the original file (5.1.3097.0), the other is the patched version of the same file (5.1.3102.2180). Normally the patch should have copied the patch over the original, but it hasn't. I would suggest downloading the WinXP patch from the location above and manually installing. Then run the GDISCAN again. HTH and is clearer! |
Re: JPEG Virus - Are you Vulnerable?
Can someone please read my scan for me please
Scanning Drive C:... C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL Version: 10.0.4219.0 <-- Possibly vulnerable (Under OfficeXP only) C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll Version: 6.0.2900.2180 C:\Program Files\Microsoft Works\gdiplus.dll Version: 5.1.3079.3 <-- Vulnerable version C:\WINDOWS\$NtServicePackUninstall$\sxs.dll Version: 5.1.2600.1515 C:\WINDOWS\$NtServicePackUninstall$\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes) C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDI PLUS.DLL Version: 5.1.3097.0 <-- Vulnerable version C:\WINDOWS\ServicePackFiles\i386\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\ServicePackFiles\i386\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll Version: 5.1.3102.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll Version: 5.1.3102.2180 Scan Complete. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
Quote:
1. MS say that MS Works is not vulnerable! GDIScan disagrees :Yikes: I suggest you copy C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll over the top of the Works file. 2. I've done some more research on the C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDI PLUS.DLL file. This is in a copy of the original XP disk stored on your drive (the make installing extra features easier). Again, it is safe to just copy the patched version you've just used for Works. HTH. |
Re: JPEG Virus - Are you Vulnerable?
Quote:
|
Re: JPEG Virus - Are you Vulnerable?
thanks for the reply have sent you a PM as this is way over my head:dunce:
|
Re: JPEG Virus - Are you Vulnerable?
its saying make sure file path is correct - not working
C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll |
Re: JPEG Virus - Are you Vulnerable?
it worked - but did it a different way - so looks like I am ok now. I downloaded a new dgiplus.dll followed the instructions that were posted and am a happy camper - thanks to everyone for their help :kiss:
Scanning Drive C:... C:\Documents and Settings\Mary\Desktop\gdiplus.dll Version: 5.1.3102.1360 C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL Version: 10.0.4219.0 <-- Possibly vulnerable (Under OfficeXP only) C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll Version: 6.0.2900.2180 C:\Program Files\Microsoft Works\gdiplus.dll Version: 5.1.3102.1360 C:\WINDOWS\$NtServicePackUninstall$\sxs.dll Version: 5.1.2600.1515 C:\WINDOWS\$NtServicePackUninstall$\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes) C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\gdi plus.dll Version: 5.1.3102.1360 C:\WINDOWS\ServicePackFiles\i386\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\ServicePackFiles\i386\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll Version: 5.1.3102.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\vgx.dll Version: 6.0.2900.2180 C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.2180 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll Version: 5.1.3102.2180 Scan Complete. |
Re: JPEG Virus - Are you Vulnerable?
I haven't got a copy of the test result, but on my W98SE box the only apps the test considered vulnerable were Symantic products !! :rolleyes:
|
Re: JPEG Virus - Are you Vulnerable?
Apologies for bumping this again, but i have found a new version of GDIPLUS.DLL from microsoft that is not vulnerable and you can use it to overwrite any version of GDIPLUS.DLL you may have that is vulnerable.
You can grab it here - http://www.microsoft.com/downloads/d...displaylang=en This is a self extracting exe, just unzip it to C:\Temp or whatever then copy over any vulnerable versions with that one. |
Re: JPEG Virus - Are you Vulnerable?
FYI, MS have just updated the sec bulletin for MS04-028 :
* MS04-028 - http://go.microsoft.com/?linkid=1190073 - Reason for re-release: Bulletin updated to advise on the availability of revised security updates for Office XP, Visio 2002, and Project 2002 customers that are using Windows XP Service Pack 2. Microsoft Knowledge Based Article 833987 documents the currently known issues that customers may experience when installing these security updates. The article also documents recommended solutions for these issues. Microsoft has also released the MS04-028 Enterprise Update Scanning Tool to help customers detect and deploy the required updates. For more information about the MS04-028 Enterprise Update Scanning Tool, see Microsoft Knowledge Base Article 886988. Microsoft has also released an update for Windows 2000 based systems that have installed the Windows Journal Viewer. The bulletin has also been updated with a new FAQ that addresses questions regarding the Visio 2002 Viewer, Visio 2003 Viewer, and PowerPoint 2003 Viewer programs. |
Re: JPEG Virus - Are you Vulnerable?
Scanning Drive C:...
C:\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLUS.DLL Version: 5.1.3097.0 <-- Vulnerable version C:\WINDOWS\system32\dllcache\sxs.dll Version: 5.1.2600.1106 <-- Vulnerable version C:\WINDOWS\system32\dllcache\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.1106 <-- Vulnerable version C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL) C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\gdiplus.dll Version: 5.1.3097.0 <-- Vulnerable version Scan Complete. Mind you I aint installed SP2 or most updates....but psp9 :dozey: i just paid out for that :rolleyes: :angel: :dozey: |
Re: JPEG Virus - Are you Vulnerable?
Ran the scan, and got this:
Scanning Drive C:... C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.DLL Version: 6.0.2800.1411 C:\WINNT\system32\dllcache\vgx.dll Version: 6.0.2800.1411 Scan Complete. Running Windows 2000 :erm: |
| All times are GMT. The time now is 12:55. |
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
All Posts and Content are © Cable Forum