Is there any point in scanning multimedia files?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by FriendlyGuy, Sep 19, 2006.

  1. FriendlyGuy

    FriendlyGuy Private E-2

    This isn't a removal issue, but as far as I can tell, this is the most appropriate forum.

    I'd like some expert opinion on whether or not there's any point in scanning a multimedia file with an antivirus, and what file types can be used as malware.
    The reason I'm asking is that I got into a debate with someone who claimed any file type can be a virus (that statement in itself denotes a poor understanding of what a virus is, but let's not nitpick). I think this is completely untrue. You can scan a text file for viruses all you want, but it will never contain malware. It simply can't. The same goes for MPEG, AVI videos. No support for DRM or scripts = no malware. True or false?

    And then I question the usefulness antiviruses against multimedia file type threats. For example, I believe an antivirus wouldn't be able to tell the difference between a WMV that uses DRM to download spyware from a legitimate one. How would it know what the file is trying to download without actually downloading it? To test this theory, I downloaded one of the many malicious WMVs from P2P and scanned it with AVG Free Edition and the much-touted NOD32. "No virus found" in both cases. Windows Defender was also clueless.

    Please correct me if any of the following are wrong:
    • Only executable files such as programs, self-extracting archives, batch files, screen savers, Java applets, ActiveX controls and scripts can be viruses per-se.
    • Archives may contain viruses, but they cannot be viruses, nor will extracting their contents infect your computer unless you actually run the virus.
    • Microsoft Office files with support for macros—a type of script—can also contain viruses.
    • Files with support for Digital Rights Management, such as WMA, WMV, MP3 and MOV can be used to download spyware. I've seen it done with WMAs and WMVs but not the other two.
    • Adobe PDF files support a form of JavaScript, so they may be used maliciously. Proof of concept posted at Virus Bulletin.
     
  2. matt.chugg

    matt.chugg MajorGeek

    These statments contradict each other so one or more of them must logically be wrong.
     
  3. FriendlyGuy

    FriendlyGuy Private E-2

    Huh :confused:
    Regarding whether or not the above files can be harmful, no, I don't think any of the above is incorrect. Maybe it's the terminology that you don't find appropriate. If so, corrections are always welcome, as I said :)
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The first to items in your list are wrong! Any file can be a virus/trojan. In fact we see hundreds of them per week. They just love to rename EXE and DLL files to things like .txt, .dat, .ini, .tmp, .gif, .jpg, .mpg, .zip, .pif, and more.
     
  5. FriendlyGuy

    FriendlyGuy Private E-2

    No, not any file type can be a virus. If you rename a virus to *.txt, then it will open in Notepad and you will see nothing but a bunch of garbled text there.
    A virus can pretend to be another file type by appending an extension (e.g. filename.jpg.exe). This may fool inexperienced users who have file extensions hidden in their Explorer preferences, but that doesn't make the file a JPEG, it's still obviously an executable.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds