McAfee: Now image files face virus threat

Antivirus software company McAfee Security has warned of a virus that can infect image files. The virus could be spread through...

Antivirus software company McAfee Security has warned of a virus that can infect image files. The virus could be spread through Web sites containing infected image files, and force anti-virus companies to re-engineer their products.

The virus, which is being called W32/Perrun by McAfee, is not yet in the wild - meaning it is not spreading on the Internet - and was sent to McAfee by its author yesterday, said Vincent Gullotto, senior director of McAfee AVERT (Anti-Virus Emergency Response Team).

The virus is built to spread first as an executable, or .exe, file and then in JPEG image files, he said. If the virus were spread in the wild, it would appear as an executable that would infect JPEGs when it was run, Gullotto said.

The executable can be transmitted in standard ways, such as by downloading and via e-mail. The first JPEG viewed after the executable is run will have the virus code appended to it, Gullotto said. The virus will then seek out other JPEG files in the same directory and try to infect them.

W32/Perrun is the first virus to infect JPEGs, according to McAfee.

Only machines that already have the executable file on them could be infected because of the way the virus is written, he said. It is possible, though, that future derivatives of the virus could do away with the executable as a prerequisite for infection, Gullotto added.

Because JPEGs are a common image format on the Web, the virus poses a risk of infecting any user who views an infected file on a Web site, Gullotto said. For this to happen, users would have to have the executable on their systems.

The initial version of W32/Perrun that McAfee has examined does nothing more than try to infect other JPEG files, but future versions could be modified to include all manner of code, including Trojan horses and other programs that could, potentially, leave PCs open to attackers, he said.

Future versions of the virus could also be modified to attack other file types, including text files, MP3s and more.

"This may begin to change the face of what files virus writers start to pay attention to," Gullotto said. "While these files have been safe, we may see a time in the future when these files are not safe."

Such a circumstance could also force antivirus companies to re-engineer their products, he said. Existing antivirus software would experience serious performance degradation if it had to scan image and other files for viruses. If this type of virus attack becomes more prevalent, antivirus software will have to be modified.

Read more on Antivirus, firewall and IDS products