Register | Login
BootSkins XP
Cursor FX
Dream
Icon Packager
LogonStudio XP
LogonStudio
Object Dock
Sound Schemes
Suites
WallPapers
WindowBlinds
All

Search
Forum Home | Login
DavidK
DavidK
Join Date 03/2001
0

New Virus infects image file formats

External Link
June 16, 2002 1:30:11 AM from WinCustomize ForumsWinCustomize Forums
This appending virus is the first reported JPEG infector. It is multi-component in nature, requiring an extractor file to extract (and execute) the virus body from infected JPEG files.

Infected JPEGs are unable to replicate on non-infected machines - ie. machines without the extractor component installed (hooked in the Registry).

McAfee products running the 4185 DATs (or greater) with program heuristics enabled, detect both the virus body (11,780 byte PE) and its extractor component as virus or variant W32/Alcop@MM.

This virus is a proof of concept and it has not been seen in the wild.
Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
craeonics
Join Date 03/2001
0
Reply #1 June 16, 2002 9:17:00 AM
from WinCustomize ForumsWinCustomize Forums
Pay special attention to these bits:

"...requiring an extractor file to extract (and execute) the virus body from infected JPEG files.
Infected JPEGs are unable to replicate on non-infected machines - ie. machines without the extractor component installed (hooked in the Registry)."

...which means there is no such thing as a .jpg virus or so. It could hide in _any_ file. Translation: nothing new under the sun. Hype, hype.
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
Elwin
Join Date 03/2001
0
Reply #2 June 16, 2002 10:28:20 AM
from WinCustomize ForumsWinCustomize Forums
dejavu.
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
Nakor
Join Date 03/2001
+41 sdemployee
Reply #3 June 16, 2002 11:06:55 AM
from WinCustomize ForumsWinCustomize Forums
Now available to cool you off this summer: creamed ice!

One can go and append additional data to lots of files on the system, but you still have to be infected with a binary of the virus in the first place for this to happen.
Reason for Karma (Optional)
Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

DavidK
Hell Dragon
Join Date 03/2001
0
Reply #4 June 16, 2002 12:59:52 PM
from WinCustomize ForumsWinCustomize Forums
Listen to crae on this one... this thing is nothing more then hype, it's not technically a real virus since it requires pre-infection before it can execute .JPG's.

Barely worth mentioning to be honest
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
JMB1984
Join Date 03/2001
+47
Reply #5 June 16, 2002 4:29:52 PM
from WinCustomize ForumsWinCustomize Forums
hah i can't believe i wasted my time actually reading that article. Yes McAfee briliant lets scare more people so they'll buy your software.

There is no such thing as a virus that can be transmitted via JPEG's nor will there ever be. The fact that it inserts itself in JPEG's means nothing (unfortunary of course for them)... its kind of like the virus inserting itself into files that are in the recycle bin Quite retarded. Oh well.
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
werewolf
Join Date 04/2001
+28
Reply #6 June 17, 2002 11:00:29 AM
from WinCustomize ForumsWinCustomize Forums
Crae... Hypothetically speaking:

If a virus scanner couldn't find the binary portion of this tangled mess, (or if the user wasn't running a virus scanner) and it ended up on your machine, wouldn't you then be in danger of d/ling an infected .jpg? Really doesn't sound like an impossibility.

Powered by SkinBrowser!
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
Burn_Overdrive
Join Date 11/2001
0
Reply #7 June 17, 2002 10:32:36 PM
from WinCustomize ForumsWinCustomize Forums
SOUND COOL>>>> NEVER THOUGHT OF A VIRUS IN THAT FASSION>>>>
Reason for Karma (Optional)
Successfully updated karma reason!
DavidK
craeonics
Join Date 03/2001
0
Reply #8 June 18, 2002 3:38:19 AM
from WinCustomize ForumsWinCustomize Forums
But it still doesn't execute itself. Besides, on the rare occasion that I do run a virus scanner, I scan every file on the system, not just .exes.
Reason for Karma (Optional)
Successfully updated karma reason!
View all recent posts
Mark all posts as read Delete cookies created by the forum Return to Top
Stardock Forums v        Server Load Time:   Page Render Time:


Home | About | Privacy | Upload Guidelines | Terms of Service | Help
WinCustomize © 2025 Stardock. All Rights Reserved.