I use RedHat Fedora 13. I have it on a high end 7 year old laptop.
1.3 Ghz / 2GB / 1440x1080 resolution. At work I have 64 bit Fedora 13
on a modern 64 bit laptop: Duo CPU  2.50GHz / 4GB / 1280x1024 and I
use a desktop monitor.
    They both perform well. I use Sun's, now Oracle's VirtualBox, to
run XP. VirtualBox is free software virtual machine. It is a no
brainer to install and run. I mostly run VirtualBox at work for
Outlook email client. We have Exchange mail server and to take
advantage of all the features requires Outlook newest version.
    I was using Crossover Office, (pay version of WINE, Windows
emulation) for Linux to run Outlook, but I couldn't get the new
required version of Outlook to work. So, I dedicate 1GB memory to a
virtual machine running XP/Outlook.
    I use Google Chrome (web browser) and it is very snappy; loads and
runs fairly fast. I also use Google Mail, and of course Google web
apps run real well in Google Chrome.
    I do not know of a virus that I have had in the last 13 years of
RedHat. Of course I am sure I have had them, they just do not affect
the OS/machine. The problem with that is: you can have a virus in a
jpeg image, send it to a Windows luser and infect their machine.

Blake

You brought up a very interesting subject.
I was surprised that a jpg could contain a virus. I have no doubt it
is possible. In my ignorance on this subject I just thought
a jpg was a collection of bytes that another program, called
a viewer, read one at a time and copied them to a section of screen
memory.

How does the viewer lose control?

How does the virus buried in the jpg become a program and
start executing?

What part of the jpg does the virus reside in?

Here is a screen capture of a hex editor looking at a jpg.

I would like to know how to determine if a jpg actually has
an embedded virus because as you know we send out a lot
of jpgs. I don't want to be sending them out if they have
a virus of course.


Paul Lamar


It is usually done through Steganography by hiding the viral payload inside an
image's code: Here's an explanation:
http://www.gfi.com/blog/threats-steganography/

Regards,

Jack

Jack Hilditch, MCP

Thanks Jack. As I see it these are some of the possibilities.


1. One of the simplest ways to hide malware is to use double
extensions. A file would be named for example as
“cutekitten.jpg.exe”. When this is clicked, Windows will look
only at the last part of the extension and therefore treats it
as an executable. For an unprotected computer this method is
particularly effective as this can be received as an attachment
and, by default, Windows hides the last extensions of its files
and therefore this is shown as a jpg file and can be overlooked
and executed. An example was the Anna Kournikova virus which was
sent via email as an attachment “AnnaKournikova.jpg.vbs”. A
similar technique is with URL links. These may be fashioned to
show that they are directed to a jpg, mp3 etc but when clicked,
the user is redirected to an executable.

Easy to counteract as I check all jpg file names before I send
them out. If I see an .exe I know it is executable.

2. As stated before, text can be embedded in pictures. This may
take the form of malicious code. Though harmless on its own, it
can have a companion malware process which loads the program
from the carrier picture. The main advantage is that in some
systems, picture files are not scanned and the companion process
will not have a virus signature.

This is what I am primarily worried about.
Just how is this done? How is the companion malware process loaded
and run?


Paul Lamar