JPEGs affected by new virus

By Alun Williams

Posted on 14 Jun 2002 at 16:30

Another day, another virus. But this one infects JPEG files.

In terms of the threat posed by the new virus, experts rate it as low - W32.Perrun is only a proof-of-concept virus and does not cause much damage beyond the slight enlargement of JPEGs. Furthermore, infected files will not actually spread its malicious content to other computers. Essentially, if you receive an 'infected' JPG it will be harmless because the virus also requires the presence of an executable.

What happens is that the viral executable - W32.Perrun.dr - drops two files: Reg.mp3 to modify the Registry and Extrk.exe, which is the executable that will be used to open all JPEGs once the Registry has been modified.

JPEGs, of course, are the image files widely used on the Internet, and it's a file format previously considered safe from the risk of infection. This is the real significance of W32.Perrun - that it marks the incorporation of such data files into the realm of virus threats. More destructive versions could be around the corner.

All flavours of Windows could be affected, from Windows 3.x to Windows XP. An indication of Perrun's presence is the file Extrk.exe and that .jpg files, with a corrupted images, will have increased in size by approximately 11Kb.

You can find a list of the most recent virus-related threats on the Symantec Web site, where fixes are also available.