can video files be a virus?

[Quatro]

well my sister was downloading a video file over kazaa. and when I do my regular virus scan, the scanner detected it to have some sort of virus! is it possible? the download is not yet finish and I haven't decided to delete it or what...

[Gamer1]

yes it's possible, you can put a virus over anything.

[Quatro]

argh... what are win32 Hanater(?) virus? are they worms? I tried looking for the virus info but couldn't find one...

[cperezprg]

to Gamer1. This is the first new I read about virus in videos.
How did you know? Did you read it somewhere on the web? Can you post a link?

I also download many videos, and I want to know more about this.

Thanks!

[Quatro]

well I had my regular virus scan and spot this virus( the virus I posted above but not sure if I have typed it correctly) and I browse for that file... its a video file and the download is not yet complete but its already at 10Mb ++... I can't determine the filename at the moment because there are similar video files that I'm downloading that have the same filesize...

but the video files I'm downloading are Love Hina and a music video of F4 (my sister's)

[N1ghtw0lf]

I'de think if they can make a virus that can be put on your computer by viewing a picture on a webpage...they can put on in a video file...and virus's can ahve any extension diguised on them so yes...as long as im not prove wrong by a genius...i'de say yes...definately

[Shin_Gouki]

hm it would be VERY difficult to find the diffrence between real video file or Virus modified video file...There should be some kind of checksum which indicates that if there is any "abnormal data" normaly header + video data it self can be identifeid quit easy.
e.g .avi is a windows video contaiener... hm if you have resolution from video codec.. may be you can calculate... ..ah it´s too hot i need a break
wbr Shin Gouki

[Galway no Sora]

I never heared about video containing virus. The one I know is a file name that most likely a video but actually after you activated the "long file name" extension, it will revealed the true extension of the files. Eq : video.avi --> video.avi.exe.

Correct me if I'm wrong. Hope this can help.

[cperezprg]

I agree. It's obvious that a video can be manipulated because it's data. But a Virus must be activated. It activates when you launch a .exe or with MS Office's Macros (due to a bug).

But in a video, it seems difficult. The only think I can imagine is that the videoplayer has a bug (like MS Office) and a virus can use it. But this is also rare, because a normal player is reading the information of the file and translating it to show the movie, not executing that information (like EXE or Macros).

[JNS]

hi!

Theoretically it's not possible, that a virus get executed while watching a movie. The same counts for any other file, which doesn't get executed (like txt-files, jpg's, bmp's, tif's, mp3's and whatever), since the processor (the player-program) does not execute the content of the file.
On the other side, the data of the file could be manipulated, so that a specific (badly coded) player, interpret the data wrong and cause a buffer overflow. This buffer overflow could be used to get the virus-code executed on the computer.
But i think the chance that someone use such a bug in a player, to get a virus executed on your computer is very very small ... i assume that's just a badly coded virus-detection routine in your antivirus program, which interpret the video-data wrong.

Cu, JNS
---
http://www.emucheater.com
http://cyberpad.psxemu.com

[dukenukem]

load the incomplete avi file into virtualdub and see what it says and see if there is any video in it.

[Demigod]

Originally posted by Gamer1
yes it's possible, you can put a virus over anything.

Viruses need to be executed for them to do anything and as such, they need to be in an executable file. It's like a game or application. You need to run the executable to make them work or even do anything. But as JNS stated viruses can be executed if the input file were to cause a buffer overflow and write the code into memory. However, as he also stated the chances of that are extremely small. The virus coder would have to know the exact input buffer size of the player, otherwise it won't do anything. I agree with JNS, the anti-virus program is probably just messing up. There is some genuine code that look like a virus (programs that overwrite drivers or OS files or do other potentially dangerous things) but it's not really a virus.

[Gamer1]

I did state that it is possible didn't i?

That's why i don't trust kazaa w/o a virus scanner. Thank god for pc-cillin.

[Quatro]

well it still registered as a virus... I haven't got any luck to know what the virus means... and it can't be cleaned... and no .ave.exe extension... I'll update you guys when I found out more...

[aldo]

Some video formats (like the ones from Microsoft) allow to have internal tags with URL that will open automatically when the video is played in a popular player (like Windows Media Player) that can interpret those tags.

Some of those URLs could open a web page containing some kind of virus in javascript, exploit some bug in the browser, create some cookies with spyware, install some unsigned plugin or malware with virus, among other side effects.

So, the answer is YES, it is possible to get a virus from a regular video or audio file. But it depends of the player that you use.

The method of infection is the same as if you browse directly to the URL containg that virus code.

[Galway no Sora]

Basically, do not open any files directly from the net. Download them, scan them and if found one, delete it.

[Quatro]

well I'm waiting for the file to finish to determine what file it is... I thanks aldo... now we know that video files could be also be infected...

just need some help:

I've been trying to fine what kind of virus it is but to no avail.. so can someone please help me find what win32/hanater virus is? thanks...

[cperezprg]

Maybe it's not a video. It can be a executable file with its extension renamed to .avi, so the virus scan has found that virus pattern inside the file.

In this case, when you'll try to open the file, the video player won't start the movie (because it isn't a video), and the virus won't be activated because it hasn't been launched like an .exe file

[Quatro]

> Maybe it's not a video. It can be a executable file with its extension renamed to .avi, so the virus scan has found that virus pattern inside the file.

at 10mb ++???

[cperezprg]

>>at 10mb ++???

You can't never find out if a file has a virus by its filesize. It can be filled with dummy bytes.

I have also searched information about that virus and I've found nothing.

What is your virus scanner? Have you check spelling?