Can Exploit-ANIfile.c infect JPG files?

Can Exploit-ANIfile.c infect JPG files?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Can Exploit-ANIfile.c infect JPG files? Russell L. Smith 04-19-2007
Posted by Russell L. Smith on April 19, 2007, 2:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
A recent VirusScan log showed that VirusScan found a JPG file on my web site
infected with Exploit-ANIfile.c (Trojan). I read the Microsoft security
bulletin, the info on the McAfee site, and searched the net - I can find no
mention of this virus infecting JPG files. Can anybody point me to
documentation that mentions this virus infecting JPG files? Thanks for your
assistance.



Posted by jen on April 19, 2007, 6:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
"Russell L. Smith" <r dot l dot smith at caci dot com> wrote in message
>A recent VirusScan log showed that VirusScan found a JPG file on my web
>site infected with Exploit-ANIfile.c (Trojan). I read the Microsoft
>security bulletin, the info on the McAfee site, and searched the net -
>I can find no mention of this virus infecting JPG files. Can anybody
>point me to documentation that mentions this virus infecting JPG files?
>Thanks for your assistance.

"This is a very serious vulnerability that is almost certain to be
exploited on a wide-scale basis," ZERT member Randy Abrams said in an
emailed statement. "If the vulnerability were limited to animated
cursors alone it would not be as serious, but there are reports of .jpg
files, which are very commonly used in Web pages, being exploited as
well.":
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1249803,00.html

HTH,
-jen



Posted by David H. Lipman on April 19, 2007, 7:43 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
From: "Russell L. Smith" <r dot l dot smith at caci dot com>

| A recent VirusScan log showed that VirusScan found a JPG file on my web site
| infected with Exploit-ANIfile.c (Trojan). I read the Microsoft security
| bulletin, the info on the McAfee site, and searched the net - I can find no
| mention of this virus infecting JPG files. Can anybody point me to
| documentation that mentions this virus infecting JPG files? Thanks for your
| assistance.


It isn't a JPG file. Exploits don't "infect". I don't need to point to you to
ANY
documentation. I have seen many web sites alreadt using files named *.JPG that
are
ANI-Exploit files. I bet the JPG file is less then 2KB and most likely between
.5KB and
1KB in size.

If a JPG was was found on YOUR web site that had the "Exploit-ANIfile.c" then
most likely
your web site has been hacked, the JPG was placed there and there is a HTML file
with a
Javascipt or someother script being using to infect computers that access your
web site.

You web server needs to be removed from the internet, the system thoroughly
scanned and
all vulnerabilities that led to teh systenm being hacked mitigated ASAP !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Russell L. Smith on April 20, 2007, 12:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> From: "Russell L. Smith" <r dot l dot smith at caci dot com>
>
> | A recent VirusScan log showed that VirusScan found a JPG file on my web
> site
> | infected with Exploit-ANIfile.c (Trojan). I read the Microsoft security
> | bulletin, the info on the McAfee site, and searched the net - I can find
> no
> | mention of this virus infecting JPG files. Can anybody point me to
> | documentation that mentions this virus infecting JPG files? Thanks for
> your
> | assistance.
>
>
> It isn't a JPG file. Exploits don't "infect". I don't need to point to
> you to ANY
> documentation. I have seen many web sites alreadt using files named *.JPG
> that are
> ANI-Exploit files. I bet the JPG file is less then 2KB and most likely
> between .5KB and
> 1KB in size.
>
> If a JPG was was found on YOUR web site that had the "Exploit-ANIfile.c"
> then most likely
> your web site has been hacked, the JPG was placed there and there is a
> HTML file with a
> Javascipt or someother script being using to infect computers that access
> your web site.
>
> You web server needs to be removed from the internet, the system
> thoroughly scanned and
> all vulnerabilities that led to teh systenm being hacked mitigated ASAP !

Thanks for the response. I think you are saying some vulnerability with the
server allowed the JPG to replaced with a malicious ANI masquerading as a
JPG. I am trying to figure out the sequence of events. The server was
started after a scheduled building power outage. A developer coincidentally
noticed less than 24 hours later that the VirusScan on-access scanner was
disabled. I have noticed this very occasionally happens on restart with
some of my internal development servers. The server was immediately pulled
off line and fully scanned (VirusScan plus tools used our security group to
check ports, vulnerabilities, patches, etc.). That was when VirusScan
reported this JPG with Exploit-ANIfile.c. The log states the file was
deleted so I don't know if we still have it in quarantine. I am scheduled
to meet with the developer when he returns from a trip to get more details.
At this point I have no idea how the "fake" JPG got there, and that is
obviously important.



Posted by David H. Lipman on April 20, 2007, 4:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
From: "Russell L. Smith" <r dot l dot smith at caci dot com>


|
| Thanks for the response. I think you are saying some vulnerability with the
| server allowed the JPG to replaced with a malicious ANI masquerading as a
| JPG. I am trying to figure out the sequence of events. The server was
| started after a scheduled building power outage. A developer coincidentally
| noticed less than 24 hours later that the VirusScan on-access scanner was
| disabled. I have noticed this very occasionally happens on restart with
| some of my internal development servers. The server was immediately pulled
| off line and fully scanned (VirusScan plus tools used our security group to
| check ports, vulnerabilities, patches, etc.). That was when VirusScan
| reported this JPG with Exploit-ANIfile.c. The log states the file was
| deleted so I don't know if we still have it in quarantine. I am scheduled
| to meet with the developer when he returns from a trip to get more details.
| At this point I have no idea how the "fake" JPG got there, and that is
| obviously important.
|

I am NO Computer Forensics expert.
However, you do need to check all logs. Also, look for HTML or other ASCII
script files on
the server that may have pointed to the JPG file. There must be downloadable
code used in
conjunction with the ANI-Exploit to infect unsuspecting computers.

Please do make sure that ALL software on the server is patched and is Up-To-Date
to mitigate
and exploitable vulnerabilities that may have led to the hacking of then server.
Also check
all accounts and security measures to make sure all passwords are STRONG and the
site is
secured.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
Urgent System Message; Virus --- #2 - Your computer is infect July 26, 2006, 6:20 pm
Zero kb files June 19, 2007, 12:08 pm
Re: Help with what to do with files August 15, 2007, 11:45 am
lost files July 1, 2005, 10:59 am
Something is blocking almost all .exe files! September 14, 2005, 2:05 pm
Files missing January 25, 2006, 3:46 am
Tag.sys files -- hacker? June 30, 2006, 3:41 pm
Mystical files February 5, 2007, 12:47 pm
Help determining what to do with files August 15, 2007, 10:38 am
Files Won't Open June 3, 2008, 2:26 pm

The site map in XML format XML site map

Contact Us | Privacy Policy