Vlk
7
The files are fairly large, between 30 and 60 MB each.
I can send you the smallest one, as long as you don't mind such a large email attachment. I could also make it available via FTP. I could probably reduce the file size significantly if I compress it, but I don't know if that might potentially be a problem (given that they are reportedly 'infected').
OK, TIFFs are known to compress very well. Please ZIP one of the files and put it on your FTP server. Then send its URL to the virus labs - virus@avast.com, putting a link to this thread in the message body.
I'm interested to know that it might actually be possible for a virus to exist within an image format. However - if this is the case I wonder where the virus might have originated. I created these files based on source files from a client, but a thorough scan of my system didn't identify any other infected files (including the source of these images).
By definition, a virus is a piece of code (either directly machine code or some kind of pseudocode). Therefore it cannot be contained in files such as plain text, plain graphics bit etc., provided these are not further interpreted as code by some application (e.g. batch files or vbs scripts in case of plain text).
It’s generally impossible for the AV to a priori know if a given file is going to be interpreted as code or not. Therefore, the only thing that remains is to treat all files (especially when scanning with the highest sensitivity) as possibly code-containing.
Many today’s formats (e.g. Office files [Word Excel etc], mail files, etc.) are also able to contain embedded objects - files of other types than themselves. It is a virtue of any AV to be able to detect those.
Specifically, I’m not sure about TIFFs. I’ve the impression that these files are really plain image-bits only, but let’s wait for the virus guys to find out more.
Vlk