Virus through posted images?

[matthewamzn]

Is this possible. One of my members says they are receiving a virus while downloading images in my forum. The virus message is this:

Scan type: Auto-Protect Scan
Event: Threat Found!
Threat: Dialer.7AdPower
File: C:\Documents and Settings\jlo\Local Settings\Temporary Internet Files\Content.IE5\4HE7GDMN\int_ver34[1].CAB
Location: C:\Documents and Settings\jlo\Local Settings\Temporary Internet Files\Content.IE5\4HE7GDMN
Computer: COMP0***
User: COMP0***\JLO
Action taken: Pending Side Effects Analysis
Date found: Tuesday, May 23, 2006 8:43:02 AM

[rogerd]

Assuming that you are talking about an uploaded image, it seems unlikely that the image is the source of the infection. Per Symantec, "Dialer.7AdPower is an ActiveX component that can be used by Web pages to download dialer programs, which may be used to access premium rate services."

I think it is more likely that this ActiveX control was installed by a web page visited by the user. Nevertheless, be sure your forum software, PHP, Apache, etc., are up to date - some exploits have used features like image uploads to take advantage of buffer overloads or other flaws. An unlinked image itself, though, shouldn't be able to infect a user.

I assume that you have tried doing what the user says he did and your AV software didn't sound any warnings.

[chance1376]

This pertains to vBulletin but should answer your question.

The vulnerability is caused due to an input validation error in the image upload handling. This can exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by uploading a specially crafted valid image containing embedded HTML and script code.

[secunia.com...]

[matthewamzn]

I am running 3.5.4, this page suggests that the problem was solved in 3.5.1. Do you think it's still vulnerable.

[rogerd]

You should be OK, but it wouldn't hurt to check. If you have only had one complaint and can't reproduce the problem yourself, you are probably fine.