I'm running Vista Home Premium with Norton. When I run Windows Photo
Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
detected. I get a popup with that message every second or two while the
program is running and usually for a while after I close the program. Any
suggestions on how to fix this?

> I'm running Vista Home Premium with Norton. When I run Windows Photo
> Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> detected. I get a popup with that message every second or two while the
> program is running and usually for a while after I close the program. Any
> suggestions on how to fix this?

How old is your Norton installation? Symantec detects that particular piece
of malware as Trojan.Ducky.B since 2004! Any Norton program and signatures
created since September that year should be showing the new name.

It is almost certainly a false alarm, caused by an extremely outdated
version of Norton. Trojan.Ducky.B is a trojan horse exploiting a
vulnerability patched in 2004 (MS04-028). Even if you have some JPG files
carrying the exploit they pose no threat to Windows Vista. More likely,
however, is that your version of Norton is so out of date that it mistakenly
detects this in perfectly legitimate JPG files that have metadata that Norton
was not designed to understand.

This information is good news however, I am also running Vista Home Prmium
and having the same issue with the continuous popup of bloodhound.exploit.13
when I look at pictures in Windows Photo Gallery - the odd thing is that it
does not happen in the pictures tab and I am running Norton 2007. Any ideas
on how to get this to stop?

"Jesper" wrote:

> > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > detected. I get a popup with that message every second or two while the
> > program is running and usually for a while after I close the program. Any
> > suggestions on how to fix this?
>
> How old is your Norton installation? Symantec detects that particular piece
> of malware as Trojan.Ducky.B since 2004! Any Norton program and signatures
> created since September that year should be showing the new name.
>
> It is almost certainly a false alarm, caused by an extremely outdated
> version of Norton. Trojan.Ducky.B is a trojan horse exploiting a
> vulnerability patched in 2004 (MS04-028). Even if you have some JPG files
> carrying the exploit they pose no threat to Windows Vista. More likely,
> however, is that your version of Norton is so out of date that it mistakenly
> detects this in perfectly legitimate JPG files that have metadata that Norton
> was not designed to understand.
>
>

It sounds to me like there is a bug in the Norton definitions. I would prefer
that you call Symantec and ask them about it. There is a chance that this
could be legit, but I frankly think they have messed up their definitions.

I'd be very curious to hear what you find.

"Chloegirl" wrote:

> This information is good news however, I am also running Vista Home Prmium
> and having the same issue with the continuous popup of bloodhound.exploit.13
> when I look at pictures in Windows Photo Gallery - the odd thing is that it
> does not happen in the pictures tab and I am running Norton 2007. Any ideas
> on how to get this to stop?
>
> "Jesper" wrote:
>
> > > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > > detected. I get a popup with that message every second or two while the
> > > program is running and usually for a while after I close the program. Any
> > > suggestions on how to fix this?
> >
> > How old is your Norton installation? Symantec detects that particular piece
> > of malware as Trojan.Ducky.B since 2004! Any Norton program and signatures
> > created since September that year should be showing the new name.
> >
> > It is almost certainly a false alarm, caused by an extremely outdated
> > version of Norton. Trojan.Ducky.B is a trojan horse exploiting a
> > vulnerability patched in 2004 (MS04-028). Even if you have some JPG files
> > carrying the exploit they pose no threat to Windows Vista. More likely,
> > however, is that your version of Norton is so out of date that it mistakenly
> > detects this in perfectly legitimate JPG files that have metadata that Norton
> > was not designed to understand.
> >
> >

Same situation on my computer. It seems that Photo Gallery creates temporary
files from each JPG during folder scan - and every time it creates one the
message appears. luckily Norton says that protection is good enough.
Deinstalling Norton, new installation, liveupdate and complete system check
don't solve the problem. Any further ideas?


"TheBrat_75" wrote:

> I'm running Vista Home Premium with Norton. When I run Windows Photo
> Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> detected. I get a popup with that message every second or two while the
> program is running and usually for a while after I close the program. Any
> suggestions on how to fix this?

forget to mention that complete system scan after installation and update
including the questionable JPGs found no threat. it seems to be a problem of
Photo Gallery under VISTA......
I have the same JPGs on my second computer (XP-based) - no threats found
with Norton

"markus_xy" wrote:

> Same situation on my computer. It seems that Photo Gallery creates temporary
> files from each JPG during folder scan - and every time it creates one the
> message appears. luckily Norton says that protection is good enough.
> Deinstalling Norton, new installation, liveupdate and complete system check
> don't solve the problem. Any further ideas?
>
>
> "TheBrat_75" wrote:
>
> > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > detected. I get a popup with that message every second or two while the
> > program is running and usually for a while after I close the program. Any
> > suggestions on how to fix this?

WOW - I just spent 45 minutes with Norton no help - Now I'm off to chat with
HP... I'm having the same issue as describe in the thread - PLEASE HELP!!!!
--
Bill C.


"markus_xy" wrote:

> forget to mention that complete system scan after installation and update
> including the questionable JPGs found no threat. it seems to be a problem of
> Photo Gallery under VISTA......
> I have the same JPGs on my second computer (XP-based) - no threats found
> with Norton
>
> "markus_xy" wrote:
>
> > Same situation on my computer. It seems that Photo Gallery creates temporary
> > files from each JPG during folder scan - and every time it creates one the
> > message appears. luckily Norton says that protection is good enough.
> > Deinstalling Norton, new installation, liveupdate and complete system check
> > don't solve the problem. Any further ideas?
> >
> >
> > "TheBrat_75" wrote:
> >
> > > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > > detected. I get a popup with that message every second or two while the
> > > program is running and usually for a while after I close the program. Any
> > > suggestions on how to fix this?

Thanks for the info Jesper. My computer is brand new and came with Norton.
I'll contact Symantec.

"Jesper" wrote:

> It sounds to me like there is a bug in the Norton definitions. I would prefer
> that you call Symantec and ask them about it. There is a chance that this
> could be legit, but I frankly think they have messed up their definitions.
>
> I'd be very curious to hear what you find.
>
> "Chloegirl" wrote:
>
> > This information is good news however, I am also running Vista Home Prmium
> > and having the same issue with the continuous popup of bloodhound.exploit.13
> > when I look at pictures in Windows Photo Gallery - the odd thing is that it
> > does not happen in the pictures tab and I am running Norton 2007. Any ideas
> > on how to get this to stop?
> >
> > "Jesper" wrote:
> >
> > > > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > > > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > > > detected. I get a popup with that message every second or two while the
> > > > program is running and usually for a while after I close the program. Any
> > > > suggestions on how to fix this?
> > >
> > > How old is your Norton installation? Symantec detects that particular piece
> > > of malware as Trojan.Ducky.B since 2004! Any Norton program and signatures
> > > created since September that year should be showing the new name.
> > >
> > > It is almost certainly a false alarm, caused by an extremely outdated
> > > version of Norton. Trojan.Ducky.B is a trojan horse exploiting a
> > > vulnerability patched in 2004 (MS04-028). Even if you have some JPG files
> > > carrying the exploit they pose no threat to Windows Vista. More likely,
> > > however, is that your version of Norton is so out of date that it mistakenly
> > > detects this in perfectly legitimate JPG files that have metadata that Norton
> > > was not designed to understand.
> > >
> > >

So far after 20 minutes chatting with an analyst from Symantec, all I've
gotten is "Pramod(Mon Mar 26 14:29:23 PDT 2007): Please note that this is a
alert form Norton program. This message itself says that it has blocked the
attack and your computer is secure.

Pramod(Mon Mar 26 14:29:43 PDT 2007): Do not worry about this error message."

Really helpful. *sigh*



"Jesper" wrote:

> It sounds to me like there is a bug in the Norton definitions. I would prefer
> that you call Symantec and ask them about it. There is a chance that this
> could be legit, but I frankly think they have messed up their definitions.
>
> I'd be very curious to hear what you find.
>
> "Chloegirl" wrote:
>
> > This information is good news however, I am also running Vista Home Prmium
> > and having the same issue with the continuous popup of bloodhound.exploit.13
> > when I look at pictures in Windows Photo Gallery - the odd thing is that it
> > does not happen in the pictures tab and I am running Norton 2007. Any ideas
> > on how to get this to stop?
> >
> > "Jesper" wrote:
> >
> > > > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > > > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > > > detected. I get a popup with that message every second or two while the
> > > > program is running and usually for a while after I close the program. Any
> > > > suggestions on how to fix this?
> > >
> > > How old is your Norton installation? Symantec detects that particular piece
> > > of malware as Trojan.Ducky.B since 2004! Any Norton program and signatures
> > > created since September that year should be showing the new name.
> > >
> > > It is almost certainly a false alarm, caused by an extremely outdated
> > > version of Norton. Trojan.Ducky.B is a trojan horse exploiting a
> > > vulnerability patched in 2004 (MS04-028). Even if you have some JPG files
> > > carrying the exploit they pose no threat to Windows Vista. More likely,
> > > however, is that your version of Norton is so out of date that it mistakenly
> > > detects this in perfectly legitimate JPG files that have metadata that Norton
> > > was not designed to understand.
> > >
> > >

OK, I don't know if everyone has their pictures on disk back up and if you
are willing to put the time in, but I think I have found a way to stop the
problem. I don't know what is causing it but I have been playing around and
if you delete the files from my pictures and there by removing them from the
windows photo gallery and reinstall them by opening the file on the disk and
them using the copy/paste function to move the file to pictures it seems to
make the bloodhound message go away. It also works with the HP Photosmart
transfer programs if you have that available (I don't know what system
everyone is using). I have only done this with a couple of files so far but
have not had the issue yet and these were the same pictures that gave the
message before. So if you are willing to spend the time and have backups it
may work for you too.

"William" wrote:

> WOW - I just spent 45 minutes with Norton no help - Now I'm off to chat with
> HP... I'm having the same issue as describe in the thread - PLEASE HELP!!!!
> --
> Bill C.
>
>
> "markus_xy" wrote:
>
> > forget to mention that complete system scan after installation and update
> > including the questionable JPGs found no threat. it seems to be a problem of
> > Photo Gallery under VISTA......
> > I have the same JPGs on my second computer (XP-based) - no threats found
> > with Norton
> >
> > "markus_xy" wrote:
> >
> > > Same situation on my computer. It seems that Photo Gallery creates temporary
> > > files from each JPG during folder scan - and every time it creates one the
> > > message appears. luckily Norton says that protection is good enough.
> > > Deinstalling Norton, new installation, liveupdate and complete system check
> > > don't solve the problem. Any further ideas?
> > >
> > >
> > > "TheBrat_75" wrote:
> > >
> > > > I'm running Vista Home Premium with Norton. When I run Windows Photo
> > > > Gallery, I'm getting almost continuous warning that bloodhound.exploit.13 was
> > > > detected. I get a popup with that message every second or two while the
> > > > program is running and usually for a while after I close the program. Any
> > > > suggestions on how to fix this?