Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I received a couple of emails with attached PDFs from a fairly tech-savvy friend who never sends me cute/annoying forwards, so I thought they were safe to open but Adobe Reader X threw an error and would not display the files. I tried scanning the files with MS Security Essentials which said nothing was found, but I was paranoid so I used a web based scanner tool, and got these results:

http://virusscan.jotti.org/en/scanresult/794a9585299c2ab58e149d6adbeb8485b0490af6

I am not thrilled with the idea of installing another virus scanner just to make sure my system is clean, so I want to know if there is an alternative.

share|improve this question
    
What do you get if you use virustotal.com ? –  Mr.Wizard Dec 21 '11 at 20:53
    
@Mr.Wizard - virustotal.com/file-scan/… –  Heptite Dec 21 '11 at 22:38
1  
@Heptite Submit the PDF file to Microsoft...microsoft.com/security/portal/Submission/Submit.aspx –  Moab Dec 22 '11 at 4:41
    
@Moab: I did as you suggested, and they emailed me about an hour later to tell me they have updated their definitions. An update of MSSE and it was able to identify the trojan within those PDFs. –  Heptite Dec 22 '11 at 6:52
    
@Heptite You need to let your friend know they sent you an infected email attachment, their system may be compromised. –  Moab Dec 22 '11 at 13:46
show 1 more comment

2 Answers

up vote 3 down vote accepted

For this issue, so long as you have a version of Adobe Reader more recent than 8.1.2, you won't have issues.

Interesting thing about that report from Jotti is that many very highly recommended AV suites did not notice the virus, and that it was primarily the slower, less highly recommended tools that detected it. This seems to indicate to me that some of the AV tools may check dependencies and only inform you of the virus if your app versions are actually susceptible. For instance, I'd be interested in seeing what these various AV scanners report if you're running a very version of Adobe Reader on your computer that would actually be vulnerable to this exploit.

UPDATE citation for Adobe version 8.1.2:

http://www.f-secure.com/v-descs/exploit_js_pdfka_ti.shtml

share|improve this answer
    
Some of my Googling suggested it might be only an Adobe Reader 8 issue, so I'm glad to have this confirmed. –  Heptite Dec 21 '11 at 22:39
    
Citation regarding version 8.1.2 etc.? –  Mr.Wizard Dec 21 '11 at 22:40
add comment

According to FSecure, the exploit is question on your scan log is actually a feature of your application, which has now been identified as a vulnerability. The file just happens to depend on that "feature" which is now a vulnerability. Warnings don't go further about whether the file actually uses such vulnerability to launch something like Super Malware 2000.

Once you understand how virus scanners work, you'll realize that not everything is as black and white as you imagine. All they can tell you is that a file may look like a virus.

In a sense like your local police detectives, virus scanners may either ID a virus through a fingerprint or through profiling. A group of men wearing white T shirts and baggy pants may be walking straight for you. Whether they are going to do anything to you is a question neither the best and brightest minds of our generation would be able to answer.

share|improve this answer
    
I'm aware that AV software can't catch EVERYTHING, and that—like you said—not everything is "black and white." I just wasn't sure whether to be concerned here, or what to do if I did have a problem. –  Heptite Dec 21 '11 at 22:41
    
No problem. I know my writing tends to come off as condescending. It's that I didn't take the time to clean it up. –  surfasb Dec 22 '11 at 0:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.