I feel that it's going to be very difficult for a virus to infect an ISO file. What's your experience? Have you seen it happening ever? Is it not nearly unlikely?
I ask because I've just found that my computer is infected and I wish to salvage as much stuff as possible. So I was wondering if I could keep my ISO files.
16 Answers
I doubt that a typical virus would inject itself into an ISO. Note that if your ISO contains a virus already (e.g. the file was infected then put into the ISO) then you'll have issues.
1The idea, and neccessary code, of infecting archives (which an .ISO basically is) has been around for a long time. It's actually quite trivial - append your virus to the archive, modify the index to include the virusfile's data, done. No compression or anything needed as most archive formats support storing files without compression. An .ISO additionally has the nice bonus of AUTORUN.INI, which Windows by default executes the minute you insert the the CD. Have it pointing to the virus file and include it along with it into the .ISO, and you have automatically started malware that gets run without the user starting any programs. I don't know if any virus which infects archives has ever been in the wild,but they do exist. And so do viruses which specifically target .ISOs for infection.
Not directly, but an ISO is a disc image - it could potentially contain files which could be viruses. Identical to how a ZIP file (or any other archive file format) could contain an infected file.
An ISO is generally less likely to contain malware, as a virus creator could just as easily infect peoples computers with much smaller files (single executables), which they would be more likely to download, but it is possible.
Anything is possible, but this would require the virus to contain the software necessary to edit the ISO, which is far from trivial.
So I would say that it's highly unlikely that the ISOs are infected, but, of course, you might scan them with a couple of antiviruses if you wish to be (feel) safer.
I depends on how the iso image is mounted. A lot of software for mounting iso files merely exposes them as part of the file system, and handles updates to the file transparently. In fact, that's what makes the software useful. In that case, you might certainly find an iso on your system becomes infected at the same time as the rest of the system.
Whether it can be infected or not doesn't really matter when you can use something like Malwarebytes or AVG to scan it and attempt to heal it if it's infected (be warned if you have any cracked programs or tools for doing such, AVG loves to give false positives on those, but malwarebytes can't scan inside rar files so you almost need both). Just remember to scan it unmounted to check the ISO itself, then mounted to check the files on it.
I personally haven't ever seen an infected ISO, but ANY file could possibly get infected by a virus.
