I believe that any file type that is handled by the interpreters containing potential JPG exploits can in fact itself be infected. In other words, take an infected JPG and rename it to TIFF and double clicking on it should produce the same result with an unpatched program.

For some reason JPG viruses haven't caught on, maybe because Outlook and IE were patched for this months before the exploit was shared publically, and trying to infect through a secondary program isn't very effective...or maybe the hobbyist type virus writers didn't want to mess with fire. I don't know. Anyway, it seems like it would be your choice what to do with TIFF, though personally, I would not bother scanning it unless I was made aware of JPG viruses spreading and morphing into other extensions.

Matt



David Sullivan wrote:

Does anyone know a reason why .tiff should not be excluded from
scanning? I was going to add .tiff to my don't scan list. Didn't see
any know exploits using .tiff but thought it'd be a good idea to see
what everyone here thought.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.

Reply via email to