Users question JPEG virus, McAfee stands firm
Users and antivirus vendors are questioning the seriousness of a virus announced last week by McAfee Security, a division of Network Associates Inc., as well as the manner in which McAfee doled out details about the virus.
On June 13, McAfee issued a press release about the W32/Perrun virus which is the first virus to infect JPEGs, a type of image file, McAfee said. Perrun, which McAfee received from its author, uses an executable file to infect image files and then tries to spread the infection to other image files in the same directory, according to McAfee. The virus requires the presence of the executable and cannot work without it, McAfee said.
The discovery of the virus could lead to the rearchitecting of antivirus programs, as well as possible mutations that could see the virus executable embedded in image files and on the Web, said Vincent Gullotto, senior director for McAfee AVERT (Anti-Virus Emergency Response Team), at the time.
Since McAfee's original announcement of the virus, users on Web pages and e-mail lists have disputed Gullotto's statement that executable files could be embedded in JPEGs.
"Viruses are more than just pieces of self-replicating code, they need to be delivered in such a way that causes them to be executed," wrote Kevin Austin, Assistant Professor of Computer Science at Fitchburg State University in Fitchburg, Massachusetts, in an e-mail to the IDG News Service. "JPEG files are never executed. They are instead opened as data files by application programs," he wrote. Applications do not look for executable code in data files and therefore would not run it, he said.
Images that contained executable code would either appear damaged or would not open at all when double-clicked, wrote David Stidolph, a programmer and consultant based in Austin, Texas, in another e-mail to the IDG News Service.
"Images may or may not appear 'damaged', but in no case will any of the picture code be executed, so you could never replicate a virus this way," he wrote.
Even some of Gullotto's colleague's in the antivirus field disagree. Sophos PLC, an antivirus firm that competes with McAfee, issued a press release at the time discounting the seriousness of the virus. Sophos had the virus in its labs two days before McAfee announced its existence, but chose not to say anything because the virus was "really just a proof-of-concept ... a real nonevent," said Chris Wraight, technology consultant at Sophos, in an interview Friday.
However, Gullotto isn't backing down from McAfee's original warning. McAfee "still (stands) behind what it was we said," he said in an interview Friday.
The original virus warning was not about the immediate threat posed by Perrun, which is tiny, but rather about the possibility that future changes in software and technology could cause greater problems, he said.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.













