Subject: IMPORTANT: JPEG virus alert

From: [email-masked] (derin sherman)
Date: Thu, 31 Mar 94 12:57:49 GMT

WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING

*******************************************************************************
*                                                                             *
* If you use a 386/486/Pentium machine to display your JPEG pictures, then    *
* you are at risk of catching the JPEG virus.  If you have an 8086 or 80286   *
* IBM compatible, then you are not at risk, although your JPEG files may      *
* still be infected and capable of infecting 386+ machines.                   *
*                                                                             *
*******************************************************************************

WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING

*******************************************************************************
*                                                                             *
* Although the JPEG virus is nominally benign, it can cause some multisync    *
* monitors to malfunction, effectively destroying the monitor.  In general,   *
* the more expensive your monitor, the more likely it is to suffer damage.    *
* In particular, SONY Trinitron monitors seem to be quite susceptible to      *
* damage.                                                                     *
*                                                                             *
*******************************************************************************

Even though the JPEG virus can not directly affect Macintosh systems, it can
cause problems on Macs.  In particular, Mac applications will report that the
JPEG image is corrupt/unsupported codec/invalid header, or some similar error,
depending upon the specific application.

JPEG virus infection can also cause some JPEG viewers to behave unpredictably,
producing poor quality output.  If your JPEG files don't look very good, they
may be infected and you should check them right away.  (Read the next sections
to find out how to check for JPEG virus infection.)

Most UNIX and Amiga JPEG viewers appear to be immune to the JPEG virus.

			HOW THE JPEG VIRUS WORKS:

The JPEG virus hides in the comment field of the JPEG (JFIF) file.  When the 
JPEG image is loaded into video memory, the JPEG virus is loaded into shadow 
RAM, affecting the video driver interrupts (int 0x10) and some of the DOS file
interrupts (int 0x21).  Shadow RAM is expanded/extended RAM which is loaded
with the contents of the BIOS ROMs when your computer is booted.  The reason
for shadow RAM is that conventional ROM is slow, while RAM is fast.  Once 
shadow RAM is loaded, your computer assumes that the shadow RAM acts just like
your system ROM.  Since most virus checkers assume that your ROMs are virus 
free, the JPEG virus can not be found using conventional virus detection
software.  Once loaded into shadow RAM, this virus can re-infect any JPEG file
which is subsequently loaded into video memory.

		HOW TO FIND OUT IF YOUR JPEG FILES ARE INFECTED:

At present, there are no anti-viral utilities which scan for the JPEG virus.
This is because several strains of the virus are known to exist, and there
is no simple common pattern which can be used to differentiate between valid
JPEG comment fields and infected JPEG files.  To be on the safe side, you can 
scan for the JPEG virus yourself.  Get a hex editor from WUARCHIVE (or your 
favorite ftp site) and examine the first few bytes of each one of your JPEG 
files.  The comment field comes in between the first three header bytes 
(FF D8 FF) and the file type label (4A 46 49 46 == "JFIF").  If you see no 
comment field, or a valid ASCII comment field, then your JPEG file is OK.  
However, if you see a random string of hex characters, then your JPEG file 
may be corrupt.

If you can not find a hex editor, then you may choose to use the following
HEXDUMP program.  UUDECODE this file, and run the HEXDUMP program on your
JPEG file i.e. invoke the command

	HEXDUMP foo.jpg | more

to display the contents of foo.jpg.  Note that HEXDUMP will display ASCII
characters as ASCII, and all other bytes as HEX.

Sample output from the HEXDUMP program is shown below on an uninfected JPEG
file.  Note that the comment field contains a valid ASCII comment between
bytes 0x06 and 0x4E.

00000000   ff d8 ff fe 00 K  *  *  *  *  J  P  E  G     C 
00000010   o  m  p  r  e  s  s  o  r     C  o  p  y  r  i 
00000020   g  h  t     (  C  )     1  9  9  1  -  1  9  9 
00000030   2     P  o  t  a  p  o  v     W  O  R  K  S  , 
00000040      S  T  O  I  K     L  t  d  .  *  *  *  *  ff
00000050   e0 00 10 J  F  I  F  00 01 01 00 00 01 00 01 00
00000060   00 ff db 00 C  00 0a 07 07 08 07 06 0a 08 08 08
00000070   0b 0a 0a 0b 0e 18 10 0e 0d 0d 0e 1d 15 16 11 18

The sample below is from an infected JPEG file.  Note the seemingly random
HEX codes in the comment field are actually 80386 instructions.

00000000   ff d8 ff fe 00 K  eb 0b 80 fc 5  s  05 ea 00 00
00000010   00 00 cf b8 1a 5  cd !  89 1e 08 01 8c 06 0a 01
00000020   1e 07 bf `  00 8b d7 b9 0b 00 be 02 01 f3 a4 b8
00000030   1a %  cd !  8b d7 cd `     G  o  t     Y  o  u 
00000040   !        A  P  R  I  L     F  O  O  L  S  !  ff
00000050   e0 00 10 J  F  I  F  00 01 01 00 00 01 00 01 00
00000060   00 ff db 00 C  00 0a 07 07 08 07 06 0a 08 08 08
00000070   0b 0a 0a 0b 0e 18 10 0e 0d 0d 0e 1d 15 16 11 18

Note that several variants of the JPEG virus have been found.  The particular
strain shown above is known as the "April Fools" virus because of the valid 
comment fragment found in the comment field header.

			History of the JPEG Virus:

The first known strain of the JPEG virus was discovered by Dr. Charles Forbin
at CERT on 31 October 1993.  He immediately informed NSA officials, who 
promptly declared that such a thing was "physically impossible."  In honor of
this profound judgement, Dr. Forbin named the first JPEG virus "Physically
Impossible."  Soon, other strains were discovered, most notably being the 
strains "Cruel Tricks 4", "Dear Friends", "Clueless", and "Brain-Dead".  If
you think your JPEG files are infected, it's probably Physically Impossible,
but it might also be Clueless and/or Brain-Dead.

WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING

*******************************************************************************
*                                                                             *
* One of the most recent strains of JPEG virus, known as DOPEY, can infect    *
* both the comment fields of JPEG and GIF89A files.  If you find any infected *
* JPEG files on your computer then check all the comment fields of your GIF   *
* files IMMEDIATELY!                                                          *
*                                                                             *
*******************************************************************************

			R E C O M M E N D A T I O N :

Do not view ANY JPEG files until you have scanned their headers.  Be wary of
JPEG files from disreputable sources (FTP/FSP sites, BBS, USENET, etc.)
Check the headers of all your JPEG files AT ONCE before they are infected.
You can use the HEXDUMP program below, or your favorite HEX editor to inspect
your JPEG files.

section 1 of uuencode 4.02 of file hexdump.exe    by R.E.M.

sum -r/size 44926/10660 section (from "begin" to "end")
sum -r/size 51458/7592 entire input file