Author Topic: MS04-028 JPEG Exploit on Windows Vista (32 bit)  (Read 3472 times)

0 Members and 1 Guest are viewing this topic.

Offline GuitarGuy

  • Newbie
  • *
  • Posts: 4
MS04-028 JPEG Exploit on Windows Vista (32 bit)
« on: October 22, 2007, 08:23:02 AM »
Hello,

I have Windows Vista Business edition installed on my laptop. Yesterday, I transferred few pictures from my cell phone to my laptop using bluetooth.

When I open the pictures using 'Windows photo gallery', flip the picture and try to save it, avast reports a warning -

"C:\Users\User\AppData\Local\Temp\~PI12A7.tmp" contains a virus.
Malware Name: MS04-028 JPEG Exploit
VPS version: 000783-0, 21-10-2007

I'm unable to repair the virus or delete the ~PI12A7.tmp file manually. I can only use 'Move to chest' option. I wonder why AVAST is unable to fix this problem?

Can anyone suggest solutions?


Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4143
  • Some days..... MOS...this bug's for you
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #1 on: October 22, 2007, 08:49:32 AM »
You could upload the file to www.virustotal.com and see if any other scanner detects any thing. You will have to move it from the chest to a temporary location to submit it.


Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #2 on: October 22, 2007, 10:26:49 AM »
guitarguy: simply because the file is used by another process when scanning (with 99% of probability)..

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11590
    • AVAST Software
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #3 on: October 22, 2007, 10:58:31 AM »
Well, I'd rather vote for the remaining 1% ;D

avast! can't repair it because the file is not repairable.
Anyway, can you send us the file (you can do it directly from the Chest)?
Or, even the original picture might be useful, if you describe exactly the operations you've done with it.

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #4 on: October 22, 2007, 11:12:04 AM »
when the file can't be removed manually and can't be removed by avast, then it really is locked by another process imho.. anyway, it would be good to have the file :)

Offline GuitarGuy

  • Newbie
  • *
  • Posts: 4
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #5 on: October 22, 2007, 08:45:16 PM »
Neither MAPI nor the SMTP is allowing me to send the virus :( , is there any other way to do so? I've all the infected files in virus chest.

Shall I send the infected files manually using my mail client? ( and is that possible? )


Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67282
Re: MS04-028 JPEG Exploit on Windows Vista (32 bit)
« Reply #6 on: October 22, 2007, 08:51:17 PM »
is there any other way to do so? I've all the infected files in virus chest.
Maybe extracting them carefully (without double-clicking the extracted files or opening\executing them). Zipping them with a password (like 'virus') and sending to virus (at) avast.com.
The best things in life are free.