Vista photo gallery infects files, Trend Micro says

Not as bad as the subject makes it sound, but:

Noticed when I was trying to fix some photos I took with the wrong white
balance setting in the camera.


Vista Business (all updates, but not SP1 yet)
Trend Micro OfficeScan v8.0 (current with updates)

Symptom: TM won't allow Vista Photo Gallery to save changed JPEG images.

* open a JPG in windows photo gallery and click "Fix", or right-click the
file and choose "Edit"
* then change anything (just clicking "Auto adjust" is enough)
* exit photo gallery to save the changed image

OfficeScan immediately kicks in and deletes the result, saying it is
infected with EXPL_MS04-028.A (which seems to be the infamous GDI+ buffer
overrun vulnerability, as fixed by MS in September - December 2004.)

The same thing happens when I just try to copy a changed image to the
clipboard from within photo gallery.

But when I add a subject and comment to the file (through windows explorer)
before trying to edit it, the problem disappears.


To me, just trying to make an educated guess, this looks like Photo Gallery
saves the file with empty comment and/or subject fields instead of omitting
the fields, and OfficeScan thinks a zero data length must automatically
lead to a buffer overflow.
Or something equally stupid.


Just thought I'd report it, in case someone else hasn't already done so
long ago.

Update: it doesn't seem to do it with all pictures, but it does it with all
pictures taken with the only camera I have at hand right now (a 3.2
megapixel, used at maximum resolution).

Maybe because the sample pictures that are installed with windows have an
author name etc. filled in in advance, while all optional fields in my
phone's images, except for "camera maker" and "camera model", are empty by
default?



On Tue, 25 Mar 2008 14:46:00 +0100, Lucvdv <> wrote:

> Not as bad as the subject makes it sound, but:
>
> Noticed when I was trying to fix some photos I took with the wrong white
> balance setting in the camera.
>
>
> Vista Business (all updates, but not SP1 yet)
> Trend Micro OfficeScan v8.0 (current with updates)
>
> Symptom: TM won't allow Vista Photo Gallery to save changed JPEG images.
>
> * open a JPG in windows photo gallery and click "Fix", or right-click the
> file and choose "Edit"
> * then change anything (just clicking "Auto adjust" is enough)
> * exit photo gallery to save the changed image
>
> OfficeScan immediately kicks in and deletes the result, saying it is
> infected with EXPL_MS04-028.A (which seems to be the infamous GDI+ buffer
> overrun vulnerability, as fixed by MS in September - December 2004.)
>
> The same thing happens when I just try to copy a changed image to the
> clipboard from within photo gallery.
>
> But when I add a subject and comment to the file (through windows explorer)
> before trying to edit it, the problem disappears.
>
>
> To me, just trying to make an educated guess, this looks like Photo Gallery
> saves the file with empty comment and/or subject fields instead of omitting
> the fields, and OfficeScan thinks a zero data length must automatically
> lead to a buffer overflow.
> Or something equally stupid.
>
>
> Just thought I'd report it, in case someone else hasn't already done so
> long ago.