Accidentally tried to open an infected PDF, but MS Security Essentials gives false negative

Question

I received a couple of emails with attached PDFs from a fairly tech-savvy friend who never sends me cute/annoying forwards, so I thought they were safe to open but Adobe Reader X threw an error and would not display the files. I tried scanning the files with MS Security Essentials which said nothing was found, but I was paranoid so I used a web based scanner tool, and got these results:

http://virusscan.jotti.org/en/scanresult/794a9585299c2ab58e149d6adbeb8485b0490af6

I am not thrilled with the idea of installing another virus scanner just to make sure my system is clean, so I want to know if there is an alternative.

Answer 1

For this issue, so long as you have a version of Adobe Reader more recent than 8.1.2, you won't have issues.

Interesting thing about that report from Jotti is that many very highly recommended AV suites did not notice the virus, and that it was primarily the slower, less highly recommended tools that detected it. This seems to indicate to me that some of the AV tools may check dependencies and only inform you of the virus if your app versions are actually susceptible. For instance, I'd be interested in seeing what these various AV scanners report if you're running a very version of Adobe Reader on your computer that would actually be vulnerable to this exploit.

UPDATE citation for Adobe version 8.1.2:

http://www.f-secure.com/v-descs/exploit_js_pdfka_ti.shtml

Answer 2

According to FSecure, the exploit is question on your scan log is actually a feature of your application, which has now been identified as a vulnerability. The file just happens to depend on that "feature" which is now a vulnerability. Warnings don't go further about whether the file actually uses such vulnerability to launch something like Super Malware 2000.

Once you understand how virus scanners work, you'll realize that not everything is as black and white as you imagine. All they can tell you is that a file may look like a virus.

In a sense like your local police detectives, virus scanners may either ID a virus through a fingerprint or through profiling. A group of men wearing white T shirts and baggy pants may be walking straight for you. Whether they are going to do anything to you is a question neither the best and brightest minds of our generation would be able to answer.