Virus Warning

"ASTRO: out of focus," from md - located in the usenet group
alt.binaries.pictures.astro - contains a virus.



--
Martin R. Howell
"Photographs From the Universe of Amateur Astronomy"
http://members.isp.com/universeofama...nomy%40isp.com

On Sat, 2 Apr 2005 06:19:29 -0800, "Martin R. Howell"
wrote:

"ASTRO: out of focus," from md - located in the usenet group
alt.binaries.pictures.astro - contains a virus.

I suspect that whatever you are using for virus scanning is giving you a
false alarm. The file in question is a perfectly ordinary JPEG, properly
constructed. There is no virus, and the image can be opened safely.

_________________________________________________

Chris L Peterson
Cloudbait Observatory
http://www.cloudbait.com

On Sat, 02 Apr 2005 15:07:15 GMT, Chris L Peterson wrote:

On Sat, 2 Apr 2005 06:19:29 -0800, "Martin R. Howell"
wrote:

"ASTRO: out of focus," from md - located in the usenet group
alt.binaries.pictures.astro - contains a virus.

I suspect that whatever you are using for virus scanning is giving you a
false alarm. The file in question is a perfectly ordinary JPEG, properly
constructed. There is no virus, and the image can be opened safely.


avast! Antivirus: Inbound message INFECTED:
\outoffocus.jpg#193778237 (Trident TPE ver 1.4) was deleted from the
message.

Virus Database (VPS): 0513-2, 04/01/2005
Tested on: 4/2/2005 6:01:31 AM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

--
Martin R. Howell
"Photographs From the Universe of Amateur Astronomy"
http://members.isp.com/universeofama...nomy%40isp.com

"Martin R. Howell" wrote in message
news:1112455040.e8d866069182752b7750ecdcff185104@t eranews...
On Sat, 02 Apr 2005 15:07:15 GMT, Chris L Peterson wrote:

On Sat, 2 Apr 2005 06:19:29 -0800, "Martin R. Howell"
wrote:

"ASTRO: out of focus," from md - located in the usenet group
alt.binaries.pictures.astro - contains a virus.

I suspect that whatever you are using for virus scanning is giving you a
false alarm. The file in question is a perfectly ordinary JPEG, properly
constructed. There is no virus, and the image can be opened safely.


avast! Antivirus: Inbound message INFECTED:
\outoffocus.jpg#193778237 (Trident TPE ver 1.4) was deleted from the
message.

Virus Database (VPS): 0513-2, 04/01/2005
Tested on: 4/2/2005 6:01:31 AM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

--
Martin R. Howell
"Photographs From the Universe of Amateur Astronomy"
http://members.isp.com/universeofama...nomy%40isp.com

Martin, I see you are posting messages all over the place warning people about a virus in a
message I sent. Please make sure it is a virus before continuing doing this! In this way you
are getting me into other peoples killfiles which I do not like!
--
md
10" LX200GPS-SMT
ETX105
www.xs4all.nl/~martlian

On Sat, 2 Apr 2005 07:17:13 -0800, "Martin R. Howell"
wrote:

avast! Antivirus: Inbound message INFECTED:
\outoffocus.jpg#193778237 (Trident TPE ver 1.4) was deleted from the
message.

Virus Database (VPS): 0513-2, 04/01/2005
Tested on: 4/2/2005 6:01:31 AM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

Exactly. False positives are a common enough problem with antivirus
software. In this case, you have an ordinary JPEG image, nothing else.
While it is possible for specially crafted JPEG files to execute code on
unpatched XP SP1 computers (a fix for this has been out for a long time
now), this particular file does not contain the tweaked header. In other
words, your virus detection software has choked on a section of image
data that happens to have the same sequence of bytes as a virus
signature it uses.

Thanks for the warning, but it is a false alarm. The image appears to
show a slightly miscollimated star pattern, and is harmless for anyone
to open.

_________________________________________________

Chris L Peterson
Cloudbait Observatory
http://www.cloudbait.com

Chris L Peterson:
Thanks for the warning, but it is a false alarm. The image appears to
show a slightly miscollimated star pattern, and is harmless for anyone
to open.

I was about the post the time-tested (or is that time-worn?) "Macs are
immune" rant, but you brought into play the dreaded "Miscollimated Star
Pattern" stratagem, which puts fear into _everyone_ ;)

Davoud

--
usenet *at* davidillig dawt com

On Sat, 2 Apr 2005 17:40:41 +0200, md wrote:

"Martin R. Howell" wrote in message
news:1112455040.e8d866069182752b7750ecdcff185104@t eranews...
On Sat, 02 Apr 2005 15:07:15 GMT, Chris L Peterson wrote:

On Sat, 2 Apr 2005 06:19:29 -0800, "Martin R. Howell"
wrote:

"ASTRO: out of focus," from md - located in the usenet group
alt.binaries.pictures.astro - contains a virus.

I suspect that whatever you are using for virus scanning is giving you a
false alarm. The file in question is a perfectly ordinary JPEG, properly
constructed. There is no virus, and the image can be opened safely.


avast! Antivirus: Inbound message INFECTED:
\outoffocus.jpg#193778237 (Trident TPE ver 1.4) was deleted from the
message.

Virus Database (VPS): 0513-2, 04/01/2005
Tested on: 4/2/2005 6:01:31 AM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

--
Martin R. Howell
"Photographs From the Universe of Amateur Astronomy"
http://members.isp.com/universeofama...nomy%40isp.com

Martin, I see you are posting messages all over the place warning people about a virus in a
message I sent. Please make sure it is a virus before continuing doing this! In this way you
are getting me into other peoples killfiles which I do not like!


My antivirus apparently mistakenly showed it as infected with a worm. I
felt it better safe than sorry. You are a well-known member of the
community and I acknowledge that you would have not placed a virus laden
post up. . .but. . .there used to be (a year or so back) a fellow from
Calgary, Alberta with the "md" initials, IIRC, and he caused much trouble
and anguish at this group. It occured to me that he somehow might have
copped your identity to cause a mess in a.b.p.a.



Martin

Too bad no one commented on your image instead of a non virus.

Brian

"Amyotte" wrote in message
...
Too bad no one commented on your image instead of a non virus.

Brian

yes, but well, that's not uncommon these days.

I did get some confirmation though that my scope is slight mis-colimated.
--
md
10" LX200GPS-SMT
ETX105
www.xs4all.nl/~martlian

Chris L Peterson wrote:
On Sat, 2 Apr 2005 07:17:13 -0800, "Martin R. Howell"
wrote:

avast! Antivirus: Inbound message INFECTED:

\outoffocus.jpg#193778237 (Trident TPE ver 1.4) was deleted from the
message.

Virus Database (VPS): 0513-2, 04/01/2005
Tested on: 4/2/2005 6:01:31 AM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

Exactly. False positives are a common enough problem with antivirus
software. In this case, you have an ordinary JPEG image, nothing else.
While it is possible for specially crafted JPEG files to execute code on
unpatched XP SP1 computers (a fix for this has been out for a long time
now), this particular file does not contain the tweaked header. In other
words, your virus detection software has choked on a section of image
data that happens to have the same sequence of bytes as a virus
signature it uses.

Thanks for the warning, but it is a false alarm. The image appears to
show a slightly miscollimated star pattern, and is harmless for anyone
to open.

That is a severe anti-recommendation for the AV product cited above.
(spurious false positives have serious nuisance value)

The OP posted in good faith but his AV software was defective.

There are only a handful of exploits that will work inside a JPEG file
and most of them require a very specific version of M$ Wintel insecure
software (pre XP SP2) to operate. It would be nice if one day Mickeysoft
made *all* their production code buffer overrun protected.

Regards,
Martin Brown