The first effective JPEG trojan has been posted to USENET. Read about it on slashdot here.
A team at easynews.com has picked the trojan apart, and have even created a PERL script to detect the image:
>@stat = stat($file);
$size = $stat[7];
open HANDLE, $file;
sysread(HANDLE, $input, $size);
close HANDLE;
if ($input !~ /^\xff\xd8/) {
print "not a jpeg\n";
exit;
}
if ($input =~ /\xff\xfe\x00[\x00\x01]/s) {
@debug = `djpeg -debug $file 2>&1 > /dev/null`;
if (grep (/Comment, length \-*[01]:/i, @debug)) {
print "jpeg has trojan\n";
}
}
The link to that page, which has a LOT of good technical information about the trojan and how it works, is: http://www.easynews.com/virus.html
Unfortunately, a downloaded image, whether it came from a website or was downloaded from Kazaa, could infect your computer by even hovering your mouse over it in Windows' File Explorer (explorer.exe).