Re: "virus" within JPEG

From: Robert Moir (bofh_at_mvps.org)
Date: 11/10/03

  • Next message: David Okemos: "MS says turn off virus protection, if 0x800CCC0F error" 
    Date: Mon, 10 Nov 2003 09:27:39 -0000

    David Schoon wrote:
    > We operate an on-line photofinishing business. Customers
    > send us hundreds of JPEG (and other format) files each
    > day. We have recently been getting some JPEGS which, when
    > converted to thumnbnails and sent back to the customer
    > embedded in a web page, cause IE6.0 to freeze (globe
    > rotates forever). Worse yet, IE will no longer view any
    > images on subsequently viewed pages. IE must be closed
    > and re-opened to view any web page with images. The
    > offending JPEGS contain verbiage which is retained in the
    > thumbnails. It starts out as follows:
    >
    > <?xml version="1.0" encoding="UTF-8"?>
    > <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST
    > 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    > <plist version="1.0">
    > <dict>
    > <key>com.apple.print.PageFormat.PMHorizontalRes</ke
    > y>
    > <dict>
    > <key>com.apple.print.ticket.creator</key>
    > <string>com.apple.printingmanager</string>
    > <key>com.apple.print.ticket.itemArray</key>
    > <array>
    > ... and on and on, for 22,106 bytes.
    >
    > Pages with this text view fine on Mozilla, but not on IE.
    > We've installed filters to take this code out, but I'm
    > just curious as to what it does. It also seems that
    > perhaps IE could benefit by a filter to not seize up when
    > it sees this code. Anyone have any idea what's going on
    > here?

    its a XML document Data Type definition. I don't believe it should be
    actually inside JPEG files but I'm not an expert on XML so don't take that
    as gospel.

    I can say it isn't a virus however. 

    -- 
-- 
Rob Moir
Microsoft MVP for servers & security
http://www.robertmoir.co.uk
"802.11bofh - the *other* power over ethernet standard"
  • Next message: David Okemos: "MS says turn off virus protection, if 0x800CCC0F error"