Users question JPEG virus, McAfee stands firm

Users and antivirus vendors are questioning the seriousness of a virus announced last week by McAfee Security, a division of Network Associates Inc., as well as the manner in which McAfee doled out details about the virus.

On June 13, McAfee issued a press release about the W32/Perrun virus which is the first virus to infect JPEGs, a type of image file, McAfee said. Perrun, which McAfee received from its author, uses an executable file to infect image files and then tries to spread the infection to other image files in the same directory, according to McAfee. The virus requires the presence of the executable and cannot work without it, McAfee said.

The discovery of the virus could lead to the rearchitecting of antivirus programs, as well as possible mutations that could see the virus executable embedded in image files and on the Web, said Vincent Gullotto, senior director for McAfee AVERT (Anti-Virus Emergency Response Team), at the time.

Since McAfee's original announcement of the virus, users on Web pages and e-mail lists have disputed Gullotto's statement that executable files could be embedded in JPEGs.

"Viruses are more than just pieces of self-replicating code, they need to be delivered in such a way that causes them to be executed," wrote Kevin Austin, Assistant Professor of Computer Science at Fitchburg State University in Fitchburg, Massachusetts, in an e-mail to the IDG News Service. "JPEG files are never executed. They are instead opened as data files by application programs," he wrote. Applications do not look for executable code in data files and therefore would not run it, he said.

Images that contained executable code would either appear damaged or would not open at all when double-clicked, wrote David Stidolph, a programmer and consultant based in Austin, Texas, in another e-mail to the IDG News Service.

"Images may or may not appear 'damaged', but in no case will any of the picture code be executed, so you could never replicate a virus this way," he wrote.

Even some of Gullotto's colleague's in the antivirus field disagree. Sophos PLC, an antivirus firm that competes with McAfee, issued a press release at the time discounting the seriousness of the virus. Sophos had the virus in its labs two days before McAfee announced its existence, but chose not to say anything because the virus was "really just a proof-of-concept ... a real nonevent," said Chris Wraight, technology consultant at Sophos, in an interview Friday.

However, Gullotto isn't backing down from McAfee's original warning. McAfee "still (stands) behind what it was we said," he said in an interview Friday.

The original virus warning was not about the immediate threat posed by Perrun, which is tiny, but rather about the possibility that future changes in software and technology could cause greater problems, he said.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine