Forum Thread: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP...

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Office PowerPoint Viewer 2003

This thread has been marked as locked.
TGHockett Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 15:24
Ranking: 0
Posts: 1
User Since: 30th Mar, 2009
System Score: N/A
Location: N/A
I have read the other threads on the false positives for Powerpoint 2003 viewer and assume its similar to the one I am getting for both PowerPoint 2003 and the viewer. Since I have verified via add/remove programs I do have the most recent version for PowerPoint (the viewer is not installed on my XP SP3 machine, and the files are located in the correct C:\Program Files\Microsoft Office\OFFICE11 folder per PSI -- how do I get PSI reset so it will monitor PPT going forward? And am I correct I can just hit the PSI "ignore program" for PPT Viewer since I don't need the viewer?

Thanks ... TGH

Programmer RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 18:21
Score: 0
Posts: 1
User Since: 14th Dec 2008
System Score: N/A
Location: N/A
Hi,

As far as I can tell, Secunia's PSI is correctly reporting that my PPTVIEW.EXE file is outdated. I am running WinXP SP3 with a full and updated version of Office 2003 (with SP3) but for some reason (and that *might* be the problem or, at least, the reason behind the "false positive"), besides PowerPoint 2003 I *also* have the PPTVIEW.EXE file (PowerPoint 2003 Viewer) in the Office 2003 installation folder (C:\Program Files\Microsoft Office\OFFICE11).

Now, I've managed to solve this "false [true, though] positive" quite easily:

1. I've took PSI's suggested action (followed the http://www.microsoft.com/downloads/details.aspx?fa... link to download the 'Security Update for PowerPoint Viewer 2003 (KB969615)' binary [MS09-017 bulletin]).

2. Instead of *running* the downloaded office2003-kb969615-fullfile-x86-en-us.exe file, I've *unpacked* it. Comparing the unpacked files from the files I've had installed on my system I realized all of them were updated, with the *exception* of PPTVIEW.EXE itself:

a) My PPTVIEW.EXE file was v11.0.8164.0 (April 19th, 2007);
b) The new (downloaded) PPTVIEW.EXE file was v11.0.8305.0 (March 29th, 2009);

3. Thus, I simply *renamed* my current PPTVIEW.EXE file to PPTVIEW.EX_.BAK and copied the new PPTVIEW.EXE file to the Office 2003 installation folder.

Then I rescanned my system and PSI told me I was back to the usual 100% safety rating. :)

Considering the complexity behind Microsoft's quality assurance procedures before releasing updates and hotfixes and considering past incidents my bet is that this incident is probably related to some recent Microsoft Office 2003 update that probably was packed with an old version of PPTVIEW.EXE (that was overwritten and/or added to the Office 2003 installation folder during the patch/update process).

My "solution" is a general purpose, safe approach that has the benefit of keeping the original file on the system (just rename it so that you might roll back in case something goes wrong), until the answer comes up (we'll probably be hearing about this in the next few days - either from Microsoft or from Secunia ;)

Cheers,
Mike
Was this reply relevant?
+0
-0
samcoe RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 19:09
Score: 0
Posts: 3
User Since: 17th May 2008
System Score: N/A
Location: N/A
I have the same situation, except I have XP SP2.

I follow your solution, except this: how do you "unpack" the office2003-kb969615-fullfile-x86-en-us.exe file?

Thanks.
Was this reply relevant?
+0
-0
rdemand RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 20:09
Score: 0
Posts: 1
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
Open the exe file with WinZip
Was this reply relevant?
+0
-0
cbm128 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 21:16
Score: 3
Posts: 2
User Since: 19th Mar 2009
System Score: N/A
Location: IL
to extract the files packed inside office2003-kb969615-fullfile-x86-en-us.exe, just open a command prompt window at the folder in which the file is located, and execute:
office2003-kb969615-fullfile-x86-en-us.exe /?

you'll get the rest from there...
Was this reply relevant?
+0
-0
bigfish2 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 22:26
Score: 0
Posts: 3
User Since: 16th May 2009
System Score: N/A
Location: N/A
Security Update for Microsoft PowerPoint 2003 (KB957784)
A security vulnerability exists in Microsoft PowerPoint 2003 that could allow arbitrary code to run when a maliciously modified document is opened. This update resolves that vulnerability.
Get help and support
http://support.microsoft.com/?LN=en-us
WE updated w/windows up date and the up date did NOT resolve the issue. Will have to await further update from microsoft as this one person is not that skilled to follow instructions to correct the errors.
what a mess.
Was this reply relevant?
+0
-0
bigfish2 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 22:26
Score: 0
Posts: 3
User Since: 16th May 2009
System Score: N/A
Location: N/A
Security Update for Microsoft PowerPoint 2003 (KB957784)
A security vulnerability exists in Microsoft PowerPoint 2003 that could allow arbitrary code to run when a maliciously modified document is opened. This update resolves that vulnerability.
Get help and support
http://support.microsoft.com/?LN=en-us
WE updated w/windows up date and the up date did NOT resolve the issue. Will have to await further update from microsoft as this one person is not that skilled to follow instructions to correct the errors.
what a mess.
Was this reply relevant?
+0
-0
samcoe RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 17th May, 2009 23:13
Score: 0
Posts: 3
User Since: 17th May 2008
System Score: N/A
Location: N/A
The evaluation copy of WinZip extracted the needed file as described by Programmer Mike. Following the rest of the process got me the file which was accepted by Secunia.

Also the procedure suggested by cbm128 worked for me.
The "rest from there..." was:

"C:\Downloads\Disposed Of\office2003-kb969615-fullfile-x86-en-us.exe" /?

which gives the extraction instructions, as follows:

/extract:path, extracts the content of the package to the path folder

such as:

"C:\Downloads\Disposed Of\office2003-kb969615-fullfile-x86-en-us.exe" /extract:c:\

[Note the placement of the quotation marks.]

Thanks
Was this reply relevant?
+0
-0
DJM RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 19th May, 2009 21:45
Score: 0
Posts: 2
User Since: 31st Oct 2008
System Score: N/A
Location: N/A
I have experienced similar issues except that I do not have PPT viewer 2003 on my PC, when I click got to folder where the program is installed the folder does not exist, I had previously downloaded the fix only to be told that I do not have the product. I do have office 2003 with ppt, fully up to date.
Was this reply relevant?
+0
-0
dave.martin RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 20th May, 2009 14:17
Score: 0
Posts: 2
User Since: 21st Nov 2008
System Score: N/A
Location: N/A
on 19th May, 2009 21:45, DJM wrote:
I have experienced similar issues except that I do not have PPT viewer 2003 on my PC, when I click got to folder where the program is installed the folder does not exist, I had previously downloaded the fix only to be told that I do not have the product. I do have office 2003 with ppt, fully up to date.


Well I had the same situation as you did, and I ended up installing both the PowerPoint Viewer 2003 and the PowerPoint Viewer 2007 plus a bunch of security patches .. some of which were recommended by Secunia and others by Microsoft Update. None of this fixed the problem, so I did what "Programmer Mike" suggested above, and it worked.

I had been using WinRar which I discovered would not unpack the office2003-kb969615-fullfile-x86-en-us.exe file, so I installed Winzip, extracted the file and got the pptview.exe and found the version numbers were as "Progammer Mike" said above, did what he had done, and it worked perfect, just as he said..... Thanks Mike!
Was this reply relevant?
+0
-0
Piney Pete RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 20th May, 2009 17:43
Score: 0
Posts: 1
User Since: 18th Dec 2008
System Score: N/A
Location: N/A
Download Power point viewer 2007 from the office update site.
Was this reply relevant?
+0
-0
Codewarrior52 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 21st May, 2009 02:53
Score: 0
Posts: 1
User Since: 18th Jan 2009
System Score: N/A
Location: N/A
the procedure to extract the updated file worked. just re-scanned and all insecure programs are patched! Thanks
Was this reply relevant?
+0
-0
hp pavilion RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 21st May, 2009 08:58
Score: 0
Posts: 3
User Since: 6th Dec 2008
System Score: N/A
Location: N/A
on 17th May, 2009 15:24, TGHockett wrote:
I have read the other threads on the false positives for Powerpoint 2003 viewer and assume its similar to the one I am getting for both PowerPoint 2003 and the viewer. Since I have verified via add/remove programs I do have the most recent version for PowerPoint (the viewer is not installed on my XP SP3 machine, and the files are located in the correct C:\Program Files\Microsoft Office\OFFICE11 folder per PSI -- how do I get PSI reset so it will monitor PPT going forward? And am I correct I can just hit the PSI "ignore program" for PPT Viewer since I don't need the viewer?

Thanks ... TGH

Was this reply relevant?
+0
-0
pagund RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 21st May, 2009 17:28
Score: 0
Posts: 1
User Since: 16th Dec 2008
System Score: N/A
Location: N/A
Last edited on 21st May, 2009 17:54
Forgive me for being so stupid but where exactly is the "Office 2003 installation folder?"

Got it. I missed the instruction because of small typeface in printout. System is now patched. Thank you for your help.

pagund
Was this reply relevant?
+0
-0
Dr. Dibble RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 24th May, 2009 01:25
Score: 0
Posts: 1
User Since: 17th Feb 2009
System Score: N/A
Location: N/A
Last edited on 24th May, 2009 01:26
Thank you to Programmer Mike for helping me resolve the ppt viewer 2003 problem. Microsoft should pay you royalties!

Thank you to Boomhauer (sp?)for the tip on using an evaluation copy of WinZip to accomplish the extraction of the updated file.

Mission Accomplished!
Was this reply relevant?
+0
-0
rmp236 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 24th May, 2009 04:30
Score: 0
Posts: 5
User Since: 8th May 2009
System Score: N/A
Location: N/A
I downloaded PP Viewer 2007, which now shows in 'Add/remove programmes. PP Viewer 2003 is not in Add/delete, however, a scan with Secunia still lists PP viewer 3 as Security Threat. I think well ok just leave things as is but I paid for Secunia so I should use it. All too muuch for a tyro like me. Has anybody got an answer out there in words of one syllable. (not really but hope you know what I mean.)It would be greatly appreciated.

Frustrated.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 24th May, 2009 10:20
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
If U paid for Secunia U are using CSI in which case they provide a full support function outside the forum.

What is the path to the 2003 insecurity?

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
halfprice RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 24th May, 2009 10:38
Score: 0
Posts: 2
User Since: 6th Feb 2008
System Score: N/A
Location: N/A
Thanks very much Mike for the instructions on clearly up the MS goof.

Ian
Was this reply relevant?
+0
-0
blutach RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 25th May, 2009 11:22
Score: 0
Posts: 5
User Since: 9th Nov 2008
System Score: N/A
Location: Melbourne, AU
Last edited on 25th May, 2009 11:24
I, too, got this but realised that PPTVIEW.EXE was totally unnecessary given I had a full install of Office 2003. However, as is noted above, there is no add/remove programs for it, so the easiest way to get rid of it is to simply delete it and run a good registry cleaner over your system.

Of course, if you don't have Powerpoint and really need the viewer, this course of action makes no sense.

Regards

--
Les
Was this reply relevant?
+0
-0
cleopatra RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 25th May, 2009 13:39
Score: 0
Posts: 2
User Since: 2nd Apr 2009
System Score: N/A
Location: N/A
Last edited on 25th May, 2009 13:44
on 17th May, 2009 20:09, rdemand wrote:
Open the exe file with WinZip


Thank you :).

Cleo
Was this reply relevant?
+0
-0
cleopatra RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 25th May, 2009 13:43
Score: 0
Posts: 2
User Since: 2nd Apr 2009
System Score: N/A
Location: N/A
Last edited on 25th May, 2009 13:45
Many thanks Mike (Programmer)

I followed your instructions after unzipping the latest download as per Boomhauer's comment and all is working fine now on my PC :).

Thanks y'all and also thank goodness for Forums - Phew! :).

Cheers
Cleo
Was this reply relevant?
+0
-0
bigfish2 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 25th May, 2009 14:06
Score: 0
Posts: 3
User Since: 16th May 2009
System Score: N/A
Location: N/A
Wow what a deal!!!
Thanks fo all the input, but deleated Power Point becuae we don't use it.
That solved it all.
Thanks again for all the advise
bye, ole potts.
Was this reply relevant?
+0
-0
istanbul RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 25th May, 2009 17:38
Score: 0
Posts: 1
User Since: 25th May 2009
System Score: N/A
Location: N/A
on 17th May, 2009 15:24, TGHockett wrote:
I have read the other threads on the false positives for Powerpoint 2003 viewer and assume its similar to the one I am getting for both PowerPoint 2003 and the viewer. Since I have verified via add/remove programs I do have the most recent version for PowerPoint (the viewer is not installed on my XP SP3 machine, and the files are located in the correct C:\Program Files\Microsoft Office\OFFICE11 folder per PSI -- how do I get PSI reset so it will monitor PPT going forward? And am I correct I can just hit the PSI "ignore program" for PPT Viewer since I don't need the viewer?

Thanks ... TGH

Was this reply relevant?
+0
-0
StanD RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 26th May, 2009 21:11
Score: 0
Posts: 5
User Since: 25th Aug 2008
System Score: N/A
Location: N/A
I'm getting a real inferiority complex, here, first I realise when programmer says 'unpack it', i have no idea how to.
I read CBM128 'Just open a command prompt window' & I don't know how to do that, either and it then says 'you'll get the rest from there'.
then Samcoe gives me the 'rest from there' and I barely understand ANY of that!
I wrote 'how to' articles for a dollhouse magazine and I know it can be very difficult to realise just how dumb some of the readers can be - and I'm dumb in this situation, I'm LOST!
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 27th May, 2009 00:14
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@StanD

What Programmer means by unpacking is.
1. Follow his link to the download site.
2. Rather that RUN select SAVE
3. Save the file to DESKTOP.
You now require WINZIP - this can be downloaded as a trial for 45 days.
Site is here:
http://www.winzip.com/prod_down.htm
4. Once Winzip is installed RIGHT click on the Microsoft download you saved earlier.
5. Winzip gives U options - one of which is EXTRACT
6. Prior to EXTRACTING create a folder on the desktop called WINZIP & extract the files to this folder.
7. U can now carry out the rest the procedure discribed by Programmer by using Windows Explorer.
8. Once done delete the folders created on the desktop.
9. U can keep Winzip but U will be nagged after 45 days for payment so U may wish to uninstall that as well.


--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
dempewolff RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 28th May, 2009 18:26
Score: 0
Posts: 1
User Since: 4th Jan 2008
System Score: N/A
Location: N/A
This worked - Thanks
Was this reply relevant?
+0
-0
streek53 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 28th May, 2009 19:36
Score: 0
Posts: 2
User Since: 2nd Nov 2008
System Score: N/A
Location: N/A
Thanks for the tip, Mike. (And yes, I'm an idiot who didn't get "*unpacked*" until Boomhauer explained it, for which I am also grateful.)

The "Patched Program" that pops up from the taskbar PSI icon confirmed it shortly, where I had anticipated having to do a scan.

You guys are great.



Was this reply relevant?
+0
-0
This user no longer exists RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 28th May, 2009 20:05
Hi.
I sustain the response of Maurice Joyce, and if you don't want to use WinZip ( hwich is an eval ) U can Google for 7-Zip ,it's free and you can see the responces of the users from : www.download.com

Good luck
Was this reply relevant?
+0
-0
bgfores RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 31st May, 2009 16:12
Score: 1
Posts: 12
User Since: 25th Nov 2008
System Score: N/A
Location: PH
Thank you guys for all your help, I too had this problem. All's well now.
Was this reply relevant?
+0
-0
DJM RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 31st May, 2009 16:48
Score: 0
Posts: 2
User Since: 31st Oct 2008
System Score: N/A
Location: N/A
Can anyone tell me how to unsubscribe from this? The link that is emailed does not work. I've tried untiching the box at the bottom this entry screen.
Was this reply relevant?
+0
-0
F_BIG RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 5th Jun, 2009 07:27
Score: 4
Posts: 19
User Since: 14th May 2009
System Score: N/A
Location: US
I tried the patch file as downloaded on 3 machines. Wound up deleting the viewer on all of them because I have O2K3 Student & Teacher, which has the full PPT2K3 in it. (I suppose a PPT script could slip in and get away under the full release vs. the viewer, but I always seem to use the full program.)....
Had not thought to unpack the patch and do a file comparison.
--------
BTW, Nirsoft, at http://www.nirsoft.net/ has a nifty fast, little program called HashMyFiles. Fast, gives selection of CRC32, MD5 and SHA-1 hashes. You also can get dates, file and program versions listed too....
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 5th Jun, 2009 16:37
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 5th Jun, 2009 16:38
@DJM
Scroll to the top of this post. Next to the Subcription is a link to switch it off.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
nsteele RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 9th Jun, 2009 17:44
Score: 0
Posts: 2
User Since: 26th Feb 2008
System Score: N/A
Location: N/A
on 27th May, 2009 00:14, Maurice Joyce wrote:
@StanD

What Programmer means by unpacking is.
1. Follow his link to the download site.
2. Rather that RUN select SAVE
3. Save the file to DESKTOP.
You now require WINZIP - this can be downloaded as a trial for 45 days.
Site is here:
http://www.winzip.com/prod_down.htm
4. Once Winzip is installed RIGHT click on the Microsoft download you saved earlier.
5. Winzip gives U options - one of which is EXTRACT
6. Prior to EXTRACTING create a folder on the desktop called WINZIP & extract the files to this folder.
7. U can now carry out the rest the procedure discribed by Programmer by using Windows Explorer.
8. Once done delete the folders created on the desktop.
9. U can keep Winzip but U will be nagged after 45 days for payment so U may wish to uninstall that as well.


Thank you for this information on the PPTVIEW file, I have been able to get a clean PSI scan on that file however I have run into another problem that Secunia is pointing out.

In addition to the PPTVIEW file, it is pointing out the
c:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE file. I have downloaded the fix using the link provided by Secunia and when I try to run the program I get an error message stating "Update cannot be applied"

I then tried the winzip approach and when I extract the files I find a
POWERPNTNMinus1.msp file that I cannot open. I get the following error
The installation source for this product is not available. Verify that the source exists and that you can access it.

Now what do I do???

Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 9th Jun, 2009 21:14
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 9th Jun, 2009 21:15
Try this download link:
http://www.microsoft.com/downloads/details.aspx?fa...

I have just tested it as per the instructions U are using and all was OK.

When U open the folder U extracted to there is a Winzip Cab folder. Right click select open with Winzip & U should see the file U want.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
retusj RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 10th Jun, 2009 19:54
Score: 0
Posts: 8
User Since: 10th Jun 2009
System Score: N/A
Location: N/A
Last edited on 11th Jun, 2009 16:57
HELLO EVERYBODY

have any of you guys who have deleted
...\Microsoft Office\OFFICE11\PPTVIEW.EXE
researched if that file is neaded for the "Package for CD"
function in Power Point 2003?

I have this same problem with Secunia showing this file as unsecure.
I have not uninstallled or deleted the program, because when I try to uninstall it with Revo Uninstaller in Hunter mode (http://www.revouninstaller.com/) i get the office 2003 installer. And there is no option there to uninstall Power Point viewer.
Only an option to uninstall Power Point 2003-

Was this reply relevant?
+0
-0
lelandhamilton RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003: determining files to update
Member 10th Jun, 2009 20:05
Score: 2
Posts: 3
User Since: 14th Nov 2008
System Score: N/A
Location: US
I found out that several files were out of date compared to the "already installed" files. I used kdiff3 (http://sourceforge.net/projects/kdiff3/) to compare the extracted zip directory (see earlier in thread) against the installed directory and selected the view to only show files in goth "A & B". I then compared the dates for the files that were different and found both the viewer and at least one DLL were out of date. I renamed the installed copies and then copied the files from the zip directory to the install directory. Note that some files in the installed directory were actually more recent than those in the zip file.
Was this reply relevant?
+0
-0
retusj RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003: determining files to update
Member 11th Jun, 2009 14:41
Score: 0
Posts: 8
User Since: 10th Jun 2009
System Score: N/A
Location: N/A
Last edited on 11th Jun, 2009 16:55
- I have temporarily replaced the file
...\Microsoft Office\OFFICE11\PPTVIEW.EXE
by renaming it PPTVIEW.EXE_old and doing the workaround described by Programmer (extract the pptview.exe file from the archive office2003-kb969615-fullfile-x86-XX-XX.exe with 7zip http://www.7-zip.org/)
This new PPTVIEW.EXE file is working good - for now.




I have verified that ...\Microsoft Office\OFFICE11\PPTVIEW.EXE is a file that is used by Power Point 2003 Professional through the "package to cd" function.

I sacrificed 3 blank CD's for the purpose of this discovery.
A1 - First I renamed the PPTVIEW.EXE file in the OFFICE11 folder to PPTVIEW.EXE_old
A2 - I then extracted the PPTVIEW.EXE file from the archive office2003-kb969615-fullfile-x86-XX-XX.exe with 7zip
A3 - I then copied the PPTVIEW.EXE file that i extracted and pasted it into the OFFICE11 folder
A4 - I then renamed the file that i just pasted into the OFFICE11 folder to PPTVIEW.EXE_new
A5 - I installed Power Point Viewer 2007
A6 - I Copied the PPTVIEW.EXE from the OFFICE12 folder and pasted it into the OFFICE11 folder
A7 - I renamed the file that I just pasted to PPTVIEW.EXE_2007
**************
A8 - I renamed the PPTVIEW.EXE_old to PPTVIEW.EXE
A9 - I opened Power Point 2003 and wrote Test1 on the first slide
A10 - I selected 'Package to CD' on the 'File' menu.
A11 - I examined the alternatives button and checked 'Include PowerPoint Viewer' and pressed 'OK'
A12 - I placed a blank CD in the CD-Drive
A13 - I hit the 'Copy to CD-ROM' button.
A14 - When the burning process was finished i closed Power Point 2003 ejected the CD and wrote Test1 with a cd marker pen on the cd.
****
**************
B8 - I renamed the PPTVIEW.EXE to PPTVIEW.EXE_old
B8.1 - I renamed the PPTVIEW.EXE_new to PPTVIEW.EXE
B9 - I opened Power Point 2003 and wrote Test2 on the first slide
B10 - I selected 'Package to CD' on the 'File' menu.
B11 - I examined the alternatives button and checked 'Include PowerPoint Viewer' and pressed 'OK'
B12 - I placed a blank CD in the CD-Drive
B13 - I hit the 'Copy to CD-ROM' button.
B14 - When the burning process was finished i closed Power Point 2003 ejected the CD and wrote Test2 with a cd marker pen on the cd.
****
**************
C8 - I renamed the PPTVIEW.EXE to PPTVIEW.EXE_new
C8.1 - I renamed the PPTVIEW.EXE_2007 to PPTVIEW.EXE
C9 - I opened Power Point 2003 and wrote Test3 on the first slide
C10 - I selected 'Package to CD' on the 'File' menu.
C11 - I examined the alternatives button and checked 'Include PowerPoint Viewer' and pressed 'OK'
C12 - I placed a blank CD in the CD-Drive
C13 - I hit the 'Copy to CD-ROM' button.
C14 - When the burning process was finished i closed Power Point 2003 ejected the CD and wrote Test3 with a cd marker pen on the cd.
**************
****
Then I tested the 3 CD's to see if they worked.
Test 1 - OK
Test 2 - OK
Test 3 - file missing
****
I also opened explorer to take a look at the files on the CD's,
I checked the version numbers on PPTVIEW.EXE to see if they matched.
Of course they did.

I tried a "package to cd" with the original PPTVIEW.EXE v. 11.0.8164.0
I tried a "package to cd" with the new one - PPTVIEW.EXE v. 11.0.8305.0
I also did a "package to cd" with the PPTVIEW.EXE v. 12.0.6502.5000
(This way I also discovered that Power Point 2003 can not use the Power Point Viewer 2007 in the "package to cd" function - this is reasonable)






Was this reply relevant?
+0
-0
Nanouk RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 11th Jun, 2009 19:41
Score: 0
Posts: 1
User Since: 30th Oct 2008
System Score: N/A
Location: N/A
This solution worked like a dream, no insecure programs.

Thanks
Was this reply relevant?
+0
-0
Old Phil RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 12th Jun, 2009 01:28
Score: -1
Posts: 45
User Since: 19th Apr 2009
System Score: N/A
Location: Jamesport, US
A very simple and much less confusing way in the post below.

http://secunia.com/community/forum/thread/show/189...


--
Home built fairly loaded box ASRock ConRoe1333-D667, 3.4 Intel Dual core, 2G ram, XP Home SP3 Linksys WRT160Nv2 router

733 Dell 512MB ram XP Pro SP3
Acer Aspire One baby lap top

100% Securnia score
Was this reply relevant?
+0
-0
rmp236 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 12th Jun, 2009 01:53
Score: 0
Posts: 5
User Since: 8th May 2009
System Score: N/A
Location: N/A
I would like to thank all those who took time to try and sort out my problem. Unfortunately due to my limited knowledge of computers and systems I was unable to understand most of what was written. - Not your fault mine. So I guess I will just muddle on. Thanks again.
Was this reply relevant?
+0
-0
retusj RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 12th Jun, 2009 02:36
Score: 0
Posts: 8
User Since: 10th Jun 2009
System Score: N/A
Location: N/A
Last edited on 12th Jun, 2009 02:53
Verification from microsoft

http://office.microsoft.com/en-us/powerpoint/HP052...

http://office.microsoft.com/en-us/powerpoint/HP030...

The program is used by Package for CD feature.
*************



If you delete the file or just rename the file, without doing the procedure descibed extracting the pptview.exe file from this file:
http://www.microsoft.com/downloads/details.aspx?di...
Power Point 2003 will install the file the next time you use the Package for CD feature. The file that Power Point install is the old insecure file.

I await a solution from microsoft.

Was this reply relevant?
+0
-0
Bohica55 RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 12th Jun, 2009 04:51
Score: 0
Posts: 2
User Since: 3rd Nov 2008
System Score: N/A
Location: N/A
Last edited on 12th Jun, 2009 07:18
I think that you should check your settings as that is a SELF opening program. I have been downloading and installing them for years without ever having to resort to a Zip program.

Was this reply relevant?
+0
-0
retusj RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 12th Jun, 2009 05:04
Score: 0
Posts: 8
User Since: 10th Jun 2009
System Score: N/A
Location: N/A
Last edited on 13th Jun, 2009 19:17
on 12th Jun, 2009 04:51, Bohica55 wrote:
I think that you should check your settings as that is a SELF opening program. I have been downloading and installing them for years without ever having to resort to a Zip program.


The reason is that microsoft is letting you download this
http://www.microsoft.com/downloads/details.aspx?Fa...
the version inside the update mentioned in this thread is more recent.

And there is a notice
(unknown source)
NOTICE: This download will no longer be available after October 16, 2009. The newest version of the PowerPoint Viewer is available http://www.microsoft.com/downloads/details.aspx?fa...

It looks like they have dropped the support for power point 2003

Was this reply relevant?
+0
-0
wa2enm RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 13th Jun, 2009 16:23
Score: 0
Posts: 1
User Since: 1st Dec 2008
System Score: N/A
Location: N/A
Another happy camper! Thanks to Mike and all the others who hammered out the solution and their variations.

Paul
Was this reply relevant?
+0
-0
Old Phil RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 14th Jun, 2009 02:17
Score: -1
Posts: 45
User Since: 19th Apr 2009
System Score: N/A
Location: Jamesport, US
on 12th Jun, 2009 04:51, Bohica55 wrote:
I think that you should check your settings as that is a SELF opening program. I have been downloading and installing them for years without ever having to resort to a Zip program.


The object it to save the file then dissect it, pull the PPTVIEW.EXE out and replace it with the new version. There really is no other way to do it, it is quick and simple!

Phil

--
Home built fairly loaded box ASRock ConRoe1333-D667, 3.4 Intel Dual core, 2G ram, XP Home SP3 Linksys WRT160Nv2 router

733 Dell 512MB ram XP Pro SP3
Acer Aspire One baby lap top

100% Securnia score
Was this reply relevant?
+0
-0
bookman RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 29th Jun, 2009 12:51
Score: 0
Posts: 8
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
There is a lot of help here but my problem is that I can't find PPTVIEW.EXE in Windows Explorer. I have Office 2003 Professional and run Windows XP SP3. I also use auto update. I am viewing 'hidden files'. I can't see it under Office 11. Windows Search says it is in MSO Cache but I can't find it there. Any suggestions?
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 29th Jun, 2009 17:41
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@bookman

It is possible U have not got PPTVIEW installed. It is an option when U install from the disk.

I think U will find the cache file here:
Start>All Programs>Accesories>System Tools>Disk Clean Up.

Run the cleaner & if I remember correctly (I now use 2007 so going on memory) U will see Office files of about 221000KB.

If U can see this then U elected to leave them there on installation of 2003. They act as a repair tool/add/remove components.

Interested what U find before advising further. I assume PSI is pointing his insecurity finger at the cache file only?



--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
bookman RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 29th Jun, 2009 18:22
Score: 0
Posts: 8
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
You could well be right, Maurice. Office 2003 was installed by the man who built my machine. He could well have decided to leave PPTView in the Cache - though PSI points to the standard path via Program Files/MS Office/Office 11. So do I just ignore the warning?

bookman
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 29th Jun, 2009 22:09
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Provided it is not in Office 11 U should be fairly safe to ignore.

Just worth making a very small dummy presentation & then try the PACKAGE TO CD. That is the only reason U have PPTVIEW.

If U have not got PPTVIEW installed an attempt will be made to install it when U click Package To CD- click cancel & U will know for sure it is not installed.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
BTINAZ RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 30th Jun, 2009 07:45
Score: 1
Posts: 11
User Since: 1st Mar 2009
System Score: N/A
Location: US
Many of the 'insecure' programs on my PSI scan were in MS Office 2003, so I followed the instructions I got in response to my post to another thread, and I deleted all of the specified files. (They are still in the Trash, however.)
Now, I found this thread indicating that there is a false positive report on MS Powerpoint 2003 and PPViewer 2003, which were among the Office 2003 programs that were marked as insecure. When I wrote my question about 'MS Office 2003 insecure-NOT', I was assured these files really were insecure.
Now, unless I'm misreading something, I'm finding out some were not insecure after all.
Which is it? You can't have it both ways.
I don't created Powerpoint presentations, but I do use the viewer on occasion. If I deleted the OFFICE11/PPTVIEW.EXE FILE from my Office 2003 program files, have I just removed my ability to view .pps files?
After deleting the 'insecure' files, I went to the MS Office update site and was told there were no updates for my computer.
I realize most if not all of you are volunteers, but if I was misinformed, I will be one unhappy user. Could someone please clarify this for me?
Thank you.

--
HP Core 2 Duo; WIN XP Pro; NIS2009
Secunia score: 100%
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 30th Jun, 2009 10:31
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@BTINAZ

I have written a reply for U here:

http://secunia.com/community/forum/thread/show/203...

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
bookman RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 30th Jun, 2009 12:13
Score: 0
Posts: 8
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
I did the test you suggested - making a test presentation and then copying it to CD. It did copy and added Powerpoint viewer! I can only assume that the program fetched it from the cache. So far as I can see it is still not in Office 11. Is it vulnerable sitting in the cache?
Many thanks for your help so far - any further thoughts?
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 30th Jun, 2009 12:29
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
OK - We proved U did not have it as an insecurity.

U now need to disable the PPTVIEW file created by the trial as follows:

Right click on start>select Explore> navigate to Programs>Microsoft Office>Office 11>PPTVIEW.EXE

Right click & rename this file PPTVIEWER.EXE_OLD

That has removed the insecurity from the Office Programme.

U can create an ignore rule for the cache file.




--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
bookman RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 1st Jul, 2009 18:45
Score: 0
Posts: 8
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
Last edited on 1st Jul, 2009 19:00
Duplicate - deleted
Was this reply relevant?
+0
-0
bookman RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 1st Jul, 2009 18:58
Score: 0
Posts: 8
User Since: 27th Dec 2008
System Score: N/A
Location: N/A
Thank you, Maurice. However, PPTVIEW still does not appear in Office 11. This is frustrating, but I'm wondering if I can just do an ignore.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Handling Contributor 1st Jul, 2009 23:35
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Fine - provided it has not created a file in Office 2003 ignore it

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
lelandhamilton RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 3rd Jul, 2009 03:09
Score: 2
Posts: 3
User Since: 14th Nov 2008
System Score: N/A
Location: US
Note that the "False Positives" reported for Mpowerpoint an PP Viewer 2003 are actually complaining about a DLL that is out of date. See my post from June 10th about comparing the dates of currently installed version versus an extraction of the updates files. In my experience, severak DLLs in the update are old or current, and one or two DLLs are newer than the installed versions. Once the updated DLL(s) are installed and rescanned by Secunia, the compaint goes away.
Was this reply relevant?
+0
-0
trudi RE: Correcting PSI "False Positive" report re MS Powerpoint 2003 + PP Viewer2003
Member 8th Jul, 2009 10:30
Score: 0
Posts: 6
User Since: 21st Apr 2009
System Score: N/A
Location: N/A
on 17th May, 2009 23:13, samcoe wrote:
The evaluation copy of WinZip extracted the needed file as described by Programmer Mike. Following the rest of the process got me the file which was accepted by Secunia.

Also the procedure suggested by cbm128 worked for me.
The "rest from there..." was:

"C:\Downloads\Disposed Of\office2003-kb969615-fullfile-x86-en-us.exe" /?

which gives the extraction instructions, as follows:

/extract:path, extracts the content of the package to the path folder

such as:

"C:\Downloads\Disposed Of\office2003-kb969615-fullfile-x86-en-us.exe" /extract:c:\

[Note the placement of the quotation marks.]

Thanks

Was this reply relevant?
+0
-0

This thread has been marked as locked.