Guys - Now I am really lost with this mess.
I ran the GUI version of the tool on SANS on my [EMAIL PROTECTED] SP4 patched current system. I found at least 20 occurences of vulnerable versions of the gdi files. Look what just my D drive shows. Seems odd to think we should be manually replacing all of these copies of files does it not? Thoughts anyone? DC Scanning Drive D:... D:\apps\Microsoft Office\OFFICE11\GDIPLUS.DLL Version: 6.0.3260.0 <-- Vulnerable version D:\CD Flat\msdn-extract\Visio Ent-ARCH\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL Version: 10.0.2625.0 <-- Possibly vulnerable (Under OfficeXP only) D:\CD Flat\msdn-extract\Visio Ent-ARCH\Program Files\Microsoft Office\Visio10\gdiplus.dll Version: 5.1.3079.3 <-- Vulnerable version D:\CD Flat\msdn-extract\VisioPro\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL Version: 10.0.3501.0 <-- Possibly vulnerable (Under OfficeXP only) D:\CD Flat\msdn-extract\VisioPro\Program Files\Microsoft Office\Visio10\gdiplus.dll Version: 5.1.3099.0 <-- Vulnerable version D:\CD Flat\Office Premium\CD 1\PFILES\COMMON\MSSHARED\VGX\VGX.DLL Version: 5.0.3014.1003 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only) D:\windist\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLUS.DLL Version: 5.1.3097.0 <-- Vulnerable version Scan Complete. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Friday, September 24, 2004 8:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] F-Prot/GDI+ FYI Greg, Here's a tool to scan everything on the machine: http://isc.sans.org/gdiscan.php Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
