JPEG Virus

[Felipe Tonioli]

Hi,

How to get this sample ? better, where ?

tks


--
Felipe Tonioli

On Tue, 28 Sep 2004 12:39:53 -0500, Rick Cooper <rcooper at dwford.com> wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Spicer, Kevin
> > Sent: Tuesday, September 28, 2004 10:19 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: JPEG Virus
> >
> >
> >
> >
> > -----Original Message-----
> >  From: Leonardo Helman [mailto:mailscanner at LISTS.COM.AR]
> >
> > > ClamAV JPEG Exploit (MS04-028) Detection
> >  >    nervoso - 2004-09-28 06:30   -   Clam AntiVirus
> >  >ClamAV 0.80rc3 successfuly detects JPEG files with modified comment
> >  section that allows >attackers to remotely execute arbitrary code on
> >  unpatched Windows machines.
> >
> >
> > >I was running the stable version, 0.75-1, but it didn't catch this.
> >  >I didn't have trouble with the upgrade (from sources), the rpm isn't
> >  there yet.
> >
> > That's because this kind of detection is only supported with 0.80rc3
> >  (and maybe 0.80rc2?)
> >
>
> 0.80rc2 doesn't detect it, must use 0.80rc3
>
>
>
> Rick
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).