Rickresource Rickenbacker Forum

Hello, twice today I visited the topic "Dear John Hall" page 7, and on both occaisions got this from my virus protection software:

Yes -- the same thing happened to me on that same page....

Happened to me twice also.

It also happened to me.

Hmm.........I think I will avoid that thread until further notice. Perhaps given the nature of that thread it should be deleted, anyway?

jps wrote:Hmm.........I think I will avoid that thread until further notice. Perhaps given the nature of that thread it should be deleted, anyway?

For a variety of reasons I don't think that is an option at the moment Jeff. Besides I have asked Gil to look at that JPG file.

Maybe then we can take a look at the thread in the cold light of day to see if it truly needs some further attention.

Gil has deleted the virus laden JPG. Thanks for bringing this matter to our attention guys.

Me too. Really messed up my PC yesterday, and it took me a whole day to get it sorted.

Glad to hear it's fixed.

So, what sort of mischief did it do? I loaded the page many times (even after the notice about the virus just to see if I got a message ) and never got any sort of indication anything was amiss.

I ran a scan on my disk afterwards just in case and saw nothing there either, so hopefully I'm OK...

I didn't know that a virus can be attached to a JPG. How is this so?

Browsers load pages and images into memory called buffers. The browser must be responsible for loading only the amount of data for which memory has been allocated. Sometimes, objects such as images can be manipulated to load into a buffer for which there hasn't been enough space allocated. They call that condition a "buffer overrun". Clever exploitation can be used to actually execute code contained in the overrun part of the data.

Halbert wrote:Browsers load pages and images into memory called buffers. The browser must be responsible for loading only the amount of data for which memory has been allocated. Sometimes, objects such as images can be manipulated to load into a buffer for which there hasn't been enough space allocated. They call that condition a "buffer overrun". Clever exploitation can be used to actually execute code contained in the overrun part of the data.

E'rr, My cat's breath smells like fish!

Eden.

One common method, that uses JEG images, doesn't directly run from the image itself. A JPEG image is a data file and is never actually executed. But, it can contain data fields that are not interpreted by most browsers or image viewers.

But, if one happens to click on some attachment or other such "normal" way to get infected by a virus, that code will modify the JPEG handler and drop a special extractor on the system that will then run the malicious code that comes attached to a JPEG image. This means that the malicious part of the image will only run on a system that is already "infected". A clean system won't have the code to run the JPEG attachment, but you may not know it's there until you happen to come across an infected image file...

You have to wonder why people create these things, what is the point of a computer virus? Do they do it just for kicks?

Eden.

From what I've read, it's a power trip sort of thing, feeling like you have control over the people who are too stupid to avoid or fix the virus.

I do vaguely understand the feeling. Way back when, when some friends and I used to hack into various systems, there was quite a good feeling when you finally beat the system and got in. But we were never into the destructive vandalism type activities that seem to have become so pervasive these days...