Exploit.Win32.MS04-028.gen
Some pictures on my friends computer has this virus in them !
Its very strange because he has taken the pictures with his own digitalcamera..so its nothing he downloaded from the net.
My theori is that he is infected by another virus that spread itself to jpg files.
But we cant finde the source
we have scanned the whole system with kaspersky.

What do you guys think aboute this?

update your KAV because it should find it if you are infected

from some other

File: BSI-JPG-TEST.jpg
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
Packers detected:
None

AntiVir No viruses found (1.47 seconds taken)
Avast No viruses found (4.82 seconds taken)
BitDefender No viruses found (2.72 seconds taken)
ClamAV No viruses found (7.48 seconds taken)
Dr.Web Exploit.MS04-028 (4.83 seconds taken)
F-Prot Antivirus No viruses found (0.43 seconds taken)
F-Secure Anti-Virus Exploit.Win32.MS04-028.gen (5.25 seconds taken)
Kaspersky Anti-Virus Exploit.Win32.MS04-028.gen (4.20 seconds taken)
mks_vir No viruses found (1.97 seconds taken)
NOD32 No viruses found (2.17 seconds taken)
Norman Virus Control No viruses found (0.82 seconds taken)

I bet the AV guys hueristics are keying on \xFF \xE1\xE2\xED\xFE\x00 \x00\x01. recent snort sigs that we deployed are giving us False Positives for images generated by Kodak Cameras or Adobe products. Probably a whole slew more as well. So much for your AV protection, huh?

Its a fine line to tread between banning too many files and giving people a backdoor around there protection. Before anyone starts saying typical and the like just think about that for a second.

Heres a challenge, how would YOU stop it ?

-Download the critical update for Windows XP (September 2004) - Buffer Overrun in JPEG
ddl file


-Update ur AV dat file

Appearantly, someone has not be reading the forums lol.

Just to know if something happen
Download the tools to view the process and there exe path,
this tools have a lot of features ..
get the startup list ( start => execute => msconfig ) or try regcleaner (freeware) to have an "advanced startup list" and clean your register (optional)
check your service list y por fin, yu should archive and delete ^^ the *#!@¿ô exe if yu found one.
And reboot, voilà
HERE For the Tools
PM me the list if yu want ...
sorry for my bad english