From: "Roger Wilco" <
[email protected]>
|
| Jpg files aren't infectable - they're data files, only programs can be
| infected. Also, every partition contains a program - although, as you
| state, if only exe files are targeted then partitions without any exe
| files won't have infected programs because of the lack of infectable
| programs (as defined by the virus in question).
|
| The OP would be better served by asking about the payload of any malware
| having affect on multiple partitions rather than viruses specifically.
| There was a 'so-called' virus posted to usenet not long ago that
| converted MP3 files (data files) into do-nothing executables and then
| 'infected' those executables with a copy of itself. This so-called
| virus, according to the purported author, would 'infect' a called MP3
| and all MP3s in the directory path destination the one was called from.
| The end result being mp3 data files (perhaps in data partitions) having
| been converted into droppers of the malware.
||
| No.
||
| Drives don't get infected, programs do. But as above, data can be
| converted or otherwise modified by the payload of malware so that where
| you thought only data files existed - you now have executable malware
| droppers.
||
| Having multiple partitions as you suggest is 'good housekeeping'
| generally (part of a good data backup plan for instance) but affords
| little if any "protection" against malware you allow to execute on your
| machine.
|
Well that's not entirely true... ;-)
There have been demonstration viruses which can code a virus in a JPEG but it requires a
"helper" program to be pre-installed on the destination platform to remove the virus and run
it. It is just easier to have the "helper" application be the actual infector. Albeit,
maybe said application could receive a "plug-in" to add additional functionality to the
infector. I know that there have been viruses using UseNet to obtain plug-ins to add
functionality.
W32/Perrun --
http://vil.nai.com/vil/content/v_99522.htm
"This appending virus is the first reported JPEG infector. It is multi-component in nature,
requiring an extractor file to extract (and execute) the virus body from infected JPEG
files.
Infected JPEGs are unable to replicate on non-infected machines - ie. machines without the
extractor component installed (hooked in the Registry)."
The other problem is that a specialy crafted JPEG, GIF or other image file may cause a
buffer overflow condition in the Microsoft GDI+ rendering engine and thus could be
exploited.
http://vil.nai.com/vil/content/v_128356.htm
Microsoft Security Bulletin MS04-028
Buffer Overrun in JPEG Processing Could Allow Code Execution (833987)
http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx