Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Just because of curiosity, Is it possible to have virus or any malware in images with normal extension?

Thanks

share|improve this question

closed as not a real question by Breakthrough, Karan, TFM, Graham Wager, Dave M Jan 30 '13 at 18:43

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Yes its possible to place exploit code within the file when read would cause any vulerable program to crash. –  Ramhound Jan 30 '13 at 17:01
    
What's a "normal extension"? –  Karan Jan 30 '13 at 17:04
    
    
Thanks for your answers. So I can't trust an image from internet. @Karan, Normal extension means .gif, .jpg, .bmp etc and NOT .exe –  Justine Feb 1 '13 at 4:44
    
Then just say "images", since exe files aren't images and of course there are no "abnormal" extensions. Also, while you meant graphic files and everyone answering assumed the same thing, images could just as well refer to disk images (as the tag description rightly states). –  Karan Feb 1 '13 at 4:58

4 Answers 4

Is it possible to have virus or any malware in images with normal extension?

Yes, but that's just since a file is a file, and the extension is just part of the file name. By itself, a file extension has no relationship to the contents. The extension just denotes what the file should contain.

If the file is not executable, the virus payload must be added in such a way to exploit a particular program that opens and parses the file. Commonly, this is done by manipulating the file's structure (at the byte-level) in order to cause a buffer/stack overflow in the program parsing the file.

share|improve this answer
    
So is there any way to identify and remove malware? Thanks –  Justine Feb 1 '13 at 4:53
1  
@Justine yes, by using an antivirus program. –  Breakthrough Feb 1 '13 at 12:45

The virus is the program. And programs are stored in binary files. Images are also stored in files. Thus, viruses can be stored in image files. But there's a problem with running code of the virus stored in non-executable file type.

share|improve this answer
3  
There is no problem in running code in a non-executable file type if it takes a advantage of an exploit in say that standard. This has been the case for .pdf files, .doc files, and various image file formats in the past. –  Ramhound Jan 30 '13 at 17:04

As Ramhound said, its theorically possible. Images are files that some executable like Microsoft Photo Viewer will parse and render on the screen. If the executable has a vulnerability, then a malicious person can create a special payload (image) that will exploit the vulnerability and then execute the malicious payload in the context of the application.

This was exactly what Stuxnet did with shortcuts(*.lnk) Stuxnet takes advantage of a vulnerability in parsing shortcut (.LNK) files in order to execute a malicious Control Panel module.

share|improve this answer
    
While Ganesh R. used Microsoft Photo Viewer and Explorer as examples, there have been many more examples of exploits in Microsoft Word, Adobe Acrobat, Adobe Reader, Adobe Flash, and far to many others to name them all. All allowed content that should not be contained within the file to execute which resulted in a malicious executable to be placed into memory. Once this happens that executable in memory can do anything it was designed to do. Most often it was designed to download a small encrypted payload that opened the door for other malicious content ( i.e. Conficker's behavior ). –  Ramhound Jan 30 '13 at 17:23

Malware probably won't distribute itself via image files, but historically there are exploits that use a malformed image file to cause the loading application to perform bad actions. check out these vulnerabilities: http://technet.microsoft.com/en-us/security/bulletin/ms11-029

http://technet.microsoft.com/en-us/security/bulletin/MS09-062

http://technet.microsoft.com/en-us/security/bulletin/ms04-028

this is not technically malware, but it is a means to run malcode on a target system. Its not unlike a website that leverages a Flash/acrobat exploit to run code within the plugin to download and execute a trojan on the localhost.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.