Possible Bug?

Hi LDMartin1959,

Thanks for bringing this issue up. Yes its cause for concern, but not panic. The detection logic for this particular file type (Exp/MS04-028) is attempting to find JPEG files which exploit a known weakness in the Windows gdiplus.dll. So the fact that JPEG files were identified is correct and reasonably useful. The fact that files might be detected in your Time Machine backup but not on disk is odd but not entirely unbelievable - Time Machine backups are decoded and parsed differently than "regular files". This isn't supposed to lead to false positives or false negatives, of course, but please understand that it isn't entirely impossible.

The detection logic for this particular item (Exp/MS04-028) was updated within in the last few weeks. If you hadn't run a full scan recently (e.g. within the last few weeks) then perhaps the older detection logic would have generated a false positive or false negative. But assuming your system is up to date and you have run a scan recently (which I believe you say you did in your recent postings) then this is further evidence of a potential product defect.

Unfortunately we cannot reproduce your situation in our lab (although we have tried). Other than obtaining a copy of your Time Machine backup, we are stuck having to ask and answer pretty basic questions in order to get to the bottom of the issue. I don't think anyone has attempted to "shift blame to the user" as you've suggested. As a software vendor we must be open to the idea that our software is less than perfect, and respond appropriately. There are zero posts in this forum by a Sophos employee that would suggest otherwise.

I would say that we have taken reasonable steps to further understand the root of the problem you started to describe (and from reading this thread, your problem report changed over time). The fact that you posted a lot of detail in response to these types of questions effectively proves the point of why we might be asking these questions in the first place. I'm sorry you took offense, but please consider those posts from others at Sophos in the context of trying to find out more detail for what is obviously a non-obvious problem.

So far we know that the image you attached to your recent post does not trigger a detection for Exp/MS04-028. But then your own machine gets that same result. Any suggestions about how we can make your problem reproducible in our test lab will be very helpful.

Hi LDMartin1959,

Thanks for bringing this issue up. Yes its cause for concern, but not panic. The detection logic for this particular file type (Exp/MS04-028) is attempting to find JPEG files which exploit a known weakness in the Windows gdiplus.dll. So the fact that JPEG files were identified is correct and reasonably useful. The fact that files might be detected in your Time Machine backup but not on disk is odd but not entirely unbelievable - Time Machine backups are decoded and parsed differently than "regular files". This isn't supposed to lead to false positives or false negatives, of course, but please understand that it isn't entirely impossible.

The detection logic for this particular item (Exp/MS04-028) was updated within in the last few weeks. If you hadn't run a full scan recently (e.g. within the last few weeks) then perhaps the older detection logic would have generated a false positive or false negative. But assuming your system is up to date and you have run a scan recently (which I believe you say you did in your recent postings) then this is further evidence of a potential product defect.

Unfortunately we cannot reproduce your situation in our lab (although we have tried). Other than obtaining a copy of your Time Machine backup, we are stuck having to ask and answer pretty basic questions in order to get to the bottom of the issue. I don't think anyone has attempted to "shift blame to the user" as you've suggested. As a software vendor we must be open to the idea that our software is less than perfect, and respond appropriately. There are zero posts in this forum by a Sophos employee that would suggest otherwise.

I would say that we have taken reasonable steps to further understand the root of the problem you started to describe (and from reading this thread, your problem report changed over time). The fact that you posted a lot of detail in response to these types of questions effectively proves the point of why we might be asking these questions in the first place. I'm sorry you took offense, but please consider those posts from others at Sophos in the context of trying to find out more detail for what is obviously a non-obvious problem.

So far we know that the image you attached to your recent post does not trigger a detection for Exp/MS04-028. But then your own machine gets that same result. Any suggestions about how we can make your problem reproducible in our test lab will be very helpful.