JPEG Virus - Are you Vulnerable?

[TheBlueRaja]

Originally Posted by Aragorn

OK, two things of note -

1. MS say that MS Works is not vulnerable! GDIScan disagrees
I suggest you copy C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll over the top of the Works file.

2. I've done some more research on the C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDI PLUS.DLL file. This is in a copy of the original XP disk stored on your drive (the make installing extra features easier). Again, it is safe to just copy the patched version you've just used for Works.

HTH.

This is all due to one of the security features in Windows XP. Basically, important system files are backed up and if one is replaced incorrectly or becomes corrupted then it will automatically be overwritten with the backup IIRC.

[highlandlassie]

thanks for the reply have sent you a PM as this is way over my head

[highlandlassie]

its saying make sure file path is correct - not working

C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll

[highlandlassie]

it worked - but did it a different way - so looks like I am ok now. I downloaded a new dgiplus.dll followed the instructions that were posted and am a happy camper - thanks to everyone for their help


Scanning Drive C:...

C:\Documents and Settings\Mary\Desktop\gdiplus.dll

Version: 5.1.3102.1360

C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL

Version: 10.0.4219.0 <-- Possibly vulnerable (Under OfficeXP only)

C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll

Version: 6.0.2900.2180

C:\Program Files\Microsoft Works\gdiplus.dll

Version: 5.1.3102.1360

C:\WINDOWS\$NtServicePackUninstall$\sxs.dll

Version: 5.1.2600.1515

C:\WINDOWS\$NtServicePackUninstall$\vgx.dll

Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)

C:\WINDOWS\$NtUninstallKB839645$\sxs.dll

Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes)

C:\WINDOWS\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\gdi plus.dll

Version: 5.1.3102.1360

C:\WINDOWS\ServicePackFiles\i386\sxs.dll

Version: 5.1.2600.2180

C:\WINDOWS\ServicePackFiles\i386\vgx.dll

Version: 6.0.2900.2180

C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\asms\10\msft\windows\gdipl us\gdiplus.dll

Version: 5.1.3102.2180

C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\sxs.dll

Version: 5.1.2600.2180

C:\WINDOWS\SoftwareDistribution\Download\9ded4ee34 a35fced0033d3e152a36e0e\vgx.dll

Version: 6.0.2900.2180

C:\WINDOWS\system32\sxs.dll

Version: 5.1.2600.2180

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll

Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll

Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll

Version: 5.1.3102.2180

Scan Complete.

[basa]

I haven't got a copy of the test result, but on my W98SE box the only apps the test considered vulnerable were Symantic products !!

[TheBlueRaja]

Apologies for bumping this again, but i have found a new version of GDIPLUS.DLL from microsoft that is not vulnerable and you can use it to overwrite any version of GDIPLUS.DLL you may have that is vulnerable.

You can grab it here - http://www.microsoft.com/downloads/d...displaylang=en

This is a self extracting exe, just unzip it to C:\Temp or whatever then copy over any vulnerable versions with that one.

[Aragorn]

FYI, MS have just updated the sec bulletin for MS04-028 :

* MS04-028

- http://go.microsoft.com/?linkid=1190073
- Reason for re-release: Bulletin updated to advise on the
availability of revised security updates for Office XP,
Visio 2002, and Project 2002 customers that are using Windows XP
Service Pack 2. Microsoft Knowledge Based Article 833987
documents the currently known issues that customers may
experience when installing these security updates. The article
also documents recommended solutions for these issues. Microsoft
has also released the MS04-028 Enterprise Update Scanning Tool
to help customers detect and deploy the required updates. For
more information about the MS04-028 Enterprise Update Scanning
Tool, see Microsoft Knowledge Base Article 886988. Microsoft has
also released an update for Windows 2000 based systems that have
installed the Windows Journal Viewer. The bulletin has also been
updated with a new FAQ that addresses questions regarding the
Visio 2002 Viewer, Visio 2003 Viewer, and PowerPoint 2003
Viewer programs.

[AndrewJ]

Scanning Drive C:...
C:\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLUS.DLL
Version: 5.1.3097.0 <-- Vulnerable version
C:\WINDOWS\system32\dllcache\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\system32\dllcache\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
Scan Complete.


Mind you I aint installed SP2 or most updates....but psp9 i just paid out for that

Ran the scan, and got this:

Scanning Drive C:...

C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.DLL

Version: 6.0.2800.1411

C:\WINNT\system32\dllcache\vgx.dll

Version: 6.0.2800.1411

Scan Complete.

Running Windows 2000