Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I feel that it's going to be very difficult for a virus to infect an ISO file. What's your experience? Have you seen it happening ever? Is it not nearly unlikely?

I ask because I've just found that my computer is infected and I wish to salvage as much stuff as possible. So I was wondering if I could keep my ISO files.

share|improve this question
A virus can do virtually anything; the question is whether anyone would go through the trouble to write a virus that does that. I don't think infecting ISO files would get the virus anywhere. – Sasha Chedygov Jul 19 '10 at 1:49
up vote 9 down vote accepted

I doubt that a typical virus would inject itself into an ISO. Note that if your ISO contains a virus already (e.g. the file was infected then put into the ISO) then you'll have issues.

share|improve this answer
These ISO files have been on my computer way before the occurrance of this infection. So I'm certain they didn't have malicious code themselves. I was just wondering if a virus could inject new code into it and succeed. But that, to me, should be kinda impossible because the virus doesn't know which part of the ISO contains an EXE. Looks like the answers here confirm my hypothesis. – Frederick Aug 29 '09 at 13:49

The idea, and neccessary code, of infecting archives (which an .ISO basically is) has been around for a long time. It's actually quite trivial - append your virus to the archive, modify the index to include the virusfile's data, done. No compression or anything needed as most archive formats support storing files without compression. An .ISO additionally has the nice bonus of AUTORUN.INI, which Windows by default executes the minute you insert the the CD. Have it pointing to the virus file and include it along with it into the .ISO, and you have automatically started malware that gets run without the user starting any programs. I don't know if any virus which infects archives has ever been in the wild,but they do exist. And so do viruses which specifically target .ISOs for infection.

share|improve this answer

Not directly, but an ISO is a disc image - it could potentially contain files which could be viruses. Identical to how a ZIP file (or any other archive file format) could contain an infected file.

An ISO is generally less likely to contain malware, as a virus creator could just as easily infect peoples computers with much smaller files (single executables), which they would be more likely to download, but it is possible.

share|improve this answer

Anything is possible, but this would require the virus to contain the software necessary to edit the ISO, which is far from trivial.
So I would say that it's highly unlikely that the ISOs are infected, but, of course, you might scan them with a couple of antiviruses if you wish to be (feel) safer.

share|improve this answer
No software to edit ISOs is necessary - because ISO files store information "as is", in not compressed or encrypted form, you just scan an ISO file for well-known sequences of data, that indicate the start of executable section in an exe file for example, and overwrite it with your data – user7963 Aug 31 '09 at 20:01

I depends on how the iso image is mounted. A lot of software for mounting iso files merely exposes them as part of the file system, and handles updates to the file transparently. In fact, that's what makes the software useful. In that case, you might certainly find an iso on your system becomes infected at the same time as the rest of the system.

share|improve this answer

Whether it can be infected or not doesn't really matter when you can use something like Malwarebytes or AVG to scan it and attempt to heal it if it's infected (be warned if you have any cracked programs or tools for doing such, AVG loves to give false positives on those, but malwarebytes can't scan inside rar files so you almost need both). Just remember to scan it unmounted to check the ISO itself, then mounted to check the files on it.

I personally haven't ever seen an infected ISO, but ANY file could possibly get infected by a virus.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .