Please Someone! Settle a disagreement.

[Mac53]

I'm in dispute with someone about viruses.
It is my belief that if I download a zipped file which contains a virus and
open this file then
my system would most likely become infected.
An example would be a zipped file containing an image file containing a
virus. If I unzip the file and view the image without extracting it would it
infect my system or do I need to extract the image to a folder and then view
it. What kind of viruses am I talking about?
Can anyone knowledgeable in this please reply and elaborate.

TIA

 

[Robert Moir]

I'm in dispute with someone about viruses.
It is my belief that if I download a zipped file which contains a virus
and open this file then
my system would most likely become infected.
An example would be a zipped file containing an image file containing a
virus. If I unzip the file and view the image without extracting it would
it infect my system or do I need to extract the image to a folder and then
view it. What kind of viruses am I talking about?
Can anyone knowledgeable in this please reply and elaborate.

The answer isn't clear-cut I'm afraid.

First of all the bit that IS clear.
Viruses are malicious computer code. Computer code has to be 'executed',
that is, loaded into memory and run as if it were a program, before it can
do anything. Therefore malicious code such as a virus has to be *executed*
in order to harm you. There is nothing magical about a computer virus that
means that simply downloading one on your computer or viewing a
non-executable file (such as a graphical image file like you talk about
here) that can cause a virus to be executed.

Simply downloading a zipped-up file does not execute the contents of the
zipped up file to be 'executed', therefore the malicious code will not run.
Likewise, opening the zip file with winzip or winrar and dragging the
infected file onto your desktop will not cause the virus code to be
executed.

Viruses can not magically infect your system because they were contained in
a zipped up file that you downloaded. Nor will they infect you just because
you opened the zip file and extracted the infected file. Only if you do
something that causes the file to be 'executed' then it can become harmful.
Of course, you talk about image files (look, I'm going to refer to it as a
JPEG from now on because that's less typing and it also ties nicely into
where I want to take this discussion) and as these are not executable files
then even loading this jpeg into paint or photoshop or whatever you use will
not cause the code inside it to be 'executed' even though the file is loaded
into memory.

That was the simple part. Now here comes the not so simple part.

!! BUT !!...

So far we've been talking about things in the assumption that your operating
system and the programs on it behave perfectly in every way. In other words,
I'm assuming that the operating system and your applications don't have an
accident or get tricked into executing the contents of the JPEG file as if
it were code even though it shouldn't.

That's where the whole house of cards wobbles a bit, all computers have
bugs, faults in the computer code where things don't happen as planned (I'm
sure you already know that!). Some of these bugs can be exploited in order
to allow something that should never be executed as code to be executed.

For example, there could be a bug in the program that handles zip archives
that can be exploited to allow a file being unzipped to get executed
automatically.

There could be a bug in the way the operating system and even some
applications hanldes graphics files that can be exploited to 'trick' the
system into executing the contents of the JPEG file as if they were code,
hence allowing your virus to run on the target system.

These are not hypothetical situations here. I've contrived this part of the
discussion to lead on to some fairly nasty examples such as this one:

http://www.f-secure.com/v-descs/ms04-028.shtml

And just to prove this isn't a problem exclusive to Microsoft, I want to
link to an equally stupid bit of work on the part of Apple (and also
shamelessly plug my own website, where I document this one!):

http://rhymeswithgeek.com/blogs/someone_else/archive/2006/02/21/2109.aspx
Hmmm, speaking of which, I may recycle this reply into a blog post...

Anyway, this reply is quite long and I'm sorry to say hasn't really given
you a definitive "YES or NO" answer. The theory is that you're totally safe
but in practice some mistakes have been made which could see some risk from
doing what you describe.

Regards,
Rob

 

[Mac53]

The answer isn't clear-cut I'm afraid.

First of all the bit that IS clear.
Viruses are malicious computer code. Computer code has to be 'executed',
that is, loaded into memory and run as if it were a program, before it can
do anything. Therefore malicious code such as a virus has to be *executed*
in order to harm you. There is nothing magical about a computer virus that
means that simply downloading one on your computer or viewing a
non-executable file (such as a graphical image file like you talk about
here) that can cause a virus to be executed.

Simply downloading a zipped-up file does not execute the contents of the
zipped up file to be 'executed', therefore the malicious code will not
run. Likewise, opening the zip file with winzip or winrar and dragging the
infected file onto your desktop will not cause the virus code to be
executed.

Viruses can not magically infect your system because they were contained
in a zipped up file that you downloaded. Nor will they infect you just
because you opened the zip file and extracted the infected file. Only if
you do something that causes the file to be 'executed' then it can become
harmful. Of course, you talk about image files (look, I'm going to refer
to it as a JPEG from now on because that's less typing and it also ties
nicely into where I want to take this discussion) and as these are not
executable files then even loading this jpeg into paint or photoshop or
whatever you use will not cause the code inside it to be 'executed' even
though the file is loaded into memory.

That was the simple part. Now here comes the not so simple part.

!! BUT !!...

So far we've been talking about things in the assumption that your
operating system and the programs on it behave perfectly in every way. In
other words, I'm assuming that the operating system and your applications
don't have an accident or get tricked into executing the contents of the
JPEG file as if it were code even though it shouldn't.

That's where the whole house of cards wobbles a bit, all computers have
bugs, faults in the computer code where things don't happen as planned
(I'm sure you already know that!). Some of these bugs can be exploited in
order to allow something that should never be executed as code to be
executed.

For example, there could be a bug in the program that handles zip archives
that can be exploited to allow a file being unzipped to get executed
automatically.

There could be a bug in the way the operating system and even some
applications hanldes graphics files that can be exploited to 'trick' the
system into executing the contents of the JPEG file as if they were code,
hence allowing your virus to run on the target system.

These are not hypothetical situations here. I've contrived this part of
the discussion to lead on to some fairly nasty examples such as this one:

http://www.f-secure.com/v-descs/ms04-028.shtml

And just to prove this isn't a problem exclusive to Microsoft, I want to
link to an equally stupid bit of work on the part of Apple (and also
shamelessly plug my own website, where I document this one!):

http://rhymeswithgeek.com/blogs/someone_else/archive/2006/02/21/2109.aspx
Hmmm, speaking of which, I may recycle this reply into a blog post...

Anyway, this reply is quite long and I'm sorry to say hasn't really given
you a definitive "YES or NO" answer. The theory is that you're totally
safe but in practice some mistakes have been made which could see some
risk from doing what you describe.

Regards,
Rob
Thanks Rob for replying, very informative.

I thought a virus could be extracted with other zipped files into a folder
and wait for a certain
clock setting or other event before it activates, just like the expected y2k
virus was expected to behave.

Mac53

 

[Robert Moir]

I thought a virus could be extracted with other zipped files into a folder
and wait for a certain
clock setting or other event before it activates, just like the expected
y2k virus was expected to behave.

Ah, no.
The term "Y2K Virus" was a misnomer, coined by journalists too stupid to
understand the problem that was described to them. The Y2K problem wasn't
any kind of virus, but rather a simple limit in how programs handled dates
after 23:59 on December 31st 1999.

Viruses are just code. Something has to cause that code to be loaded and
executed as a program before they can do anything, A file sitting on your
hard drive minding its own business is just that and nothing more,
regardless of its contents, until if or when you or the system itself does
something with it.

Of course that's 'theory vs. real world' again. That was the theory. In
practice, it's proven so simple over the years to trick people into running
malicious code that has been 'sneaked' onto a computer that you shouldn't
regard this as a barrier to your computer's safety.

 

[Enkidu]

I'm in dispute with someone about viruses.
It is my belief that if I download a zipped file which contains a virus and
open this file then
my system would most likely become infected.
An example would be a zipped file containing an image file containing a
virus. If I unzip the file and view the image without extracting it would it
infect my system or do I need to extract the image to a folder and then view
it. What kind of viruses am I talking about?
Can anyone knowledgeable in this please reply and elaborate.

In addition to what Robert says in his excellent post, the key point is
that the file has to be executed. That's not much of a comfort because
you download files in order to do something with them and that usually
means installing or running them!

A virus *could* be installed but not run at that time. However, it would
need to be placed in a location or situation where it *could* run later
- this is what I think you were thinking of when you mentioned timed
viruses.

Images as a rule don't have much risk. However some sites (notably the
XXX ones!) will try to download and get you to run an executable in
order to view the images. Normally you would get prompted for permission
to run an executable from a web page.

Cheers,

Cliff