New virus is first to infect image files

A new virus can, for the first time, infect image files, according to antivirus software company McAfee Security, a division of Network Associates Inc. This means that the virus could be spread through Web sites containing infected image files, and force antivirus companies to re-engineer their products, McAfee officials said.

The virus, which is being called W32/Perrun by McAfee, is not yet in the wild -- meaning it is not spreading on the Internet -- and was sent to McAfee by its author early Thursday morning Eastern time, said Vincent Gullotto, senior director for McAfee AVERT (Anti-Virus Emergency Response Team), located in Santa Clara, California.

The virus is built to spread first as an executable, or .exe, file and then in JPEG (Joint Photographic Experts Group) image files, he said. The virus, were it to be spread in the wild, would appear as an executable which would infect JPEGs when it was run, he said. The executable can be transmitted in standard ways, such as by downloading and via e-mail. The first JPEG viewed after the executable is run will have the virus code appended to it, Gullotto said. The virus will then seek out other JPEG files in the same directory and try to infect them, he said.

W32/Perrun is the first virus to infect JPEGs, according to McAfee.

Only machines that already have the executable file on them could be infected because of the way the virus is written, he said. It's possible, though, that future derivatives of the virus could do away with the executable as a prerequisite for infection, he added.

Because JPEGs are a common image format on the Web, the virus poses a risk of infecting any user who views an infected file on a Web site, Gullotto said. Users would have to have the executable on their systems for this to occur, he said.

The initial version of W32/Perrun that McAfee has examined does nothing more than try to infect other JPEG files, but future versions could be modified to include all manner of code, including Trojan horses and other programs that could potentially leave PCs open to attackers, he said. Future versions of the virus could also be modified to attack other file types, including text files, MP3s and more, he said.

"This may begin to change the face of what files virus writers start to pay attention to," Gullotto said. "While these files have been safe, we may see a time in the future when these files are not safe."

Such a circumstance could also force antivirus companies to re-engineer their products, he said. Current antivirus software would experience serious performance degradation if it had to scan image and other files for viruses, he said. If this type of virus attack becomes more prevalent, antivirus software will have to be modified to handle it, he said.

» posted by abennett

IDG News Service

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine