McAfee: New virus is first to infect image files

IDG News Service - A new virus can, for the first time, infect image files, according to antivirus software company McAfee.com Corp., a division of Santa Clara, Calif.-based Network Associates Inc. That means the virus could be spread through Web sites containing infected image files and force antivirus companies to re-engineer their products, McAfee officials said.
The virus, which McAfee is calling W32/Perrun, isn't yet spreading on the Internet and was sent to McAfee by its author early today, said Vincent Gullotto, senior director at the McAfee Anti-Virus Emergency Response Team (AVERT) in Santa Clara.
The virus is built to spread first as an executable, or .exe, file and then in JPEG image files, he said. If the virus were to spread in the wild, it would appear as an executable file that would infect JPEGs when it was run, he said.
The virus can be transmitted in standard ways, such as by downloading it or receiving it via e-mail. The first JPEG viewed after the executable is run will have the virus code appended to it, Gullotto said. The virus then seeks other JPEG files in the same directory and tries to infect them, Gullotto said.
W32/Perrun is the first virus to be able to infect JPEGs, according to Sunnyvale, Calif.-based McAfee.
Only machines that already have the executable file on them could be infected because of the way the virus is written, Gullotto said. It's possible, though, that future derivatives could do away with the executable as a prerequisite for infection, he said.
Because JPEGs are a common image format on the Web, the virus poses a risk of infecting any user who views an infected file on a Web site, Gullotto said. Users would have to have the executable on their systems for this to occur, he said.
The initial version of W32/Perrun that McAfee has examined does nothing more than try to infect other JPEG files, but future versions could be modified to include all manner of code, including Trojan horses and other programs that could potentially leave PCs open to attackers, he said. Future versions could also be modified to attack other file types, including text files, MP3 audio files and more, he said.
"This may begin to change the face of what files virus writers start to pay attention to," Gullotto said. "While these files have been safe, we may see a time in the future when these files are not safe."
Such a circumstance could also force antivirus companies to re-engineer their products, he said. Current antivirus software would experience serious performance degradation if it had to scan image and other files for viruses, he said.
If this type of virus attack becomes more prevalent, antivirus software will have to be modified to handle it, he said.