Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm downloading an AVI file via a torrent, but my anti-virus detects something. Is it possible that the AVI file contains a virus?

It is quite weird since the torrent has many positive reviews.

share|improve this question
2  
@user3183 VideoLAN uses it's own codecs internally. There is nothing stopping one of its own codecs from having an error that a malicious virus writer could exploit. –  GAThrawn Jan 5 '11 at 12:08
7  
When in doubt, stop the download. –  francisswest Jul 5 '12 at 16:57
26  
@soandos, that's not necessarily true. The file may be designed to exploit the torrent-client when it hashes it to check that it's good; it can also be designed to exploit the operating-system when it reads the file to produce a thumbnail or extract metadata. –  Synetech Jul 5 '12 at 17:41
2  
@IMB, which file is the antivirus flagging? Are the positive reviews from real people or are they obviously generated/copy-pasted? –  Synetech Jul 5 '12 at 17:41
4  
show 12 more comments

15 Answers

up vote 165 down vote accepted

TL;DR

An AVI file is a video, and therefore not executable, so the operating system can/will not run the file. As such, it cannot be a virus in its own right, but it can indeed contain a virus.

History

In the past, only executable (i.e., "runnable") file would be viruses. Later, Internet worms started using social-engineering to trick people into running viruses. Specifically, they would rename an executable to include other extensions like .avi, .jpg, to trick the user into thinking it is a media file and run it. For example, an email client may only display the first dozen or so characters of the attachment, so by naming the file something like "FunnyAnimals.avi              .exe", the user sees what looks like a video and runs it and gets infected.

This was not only social-engineering (tricking the user), but also an early exploit. It exploited the limited display of filenames of email clients to pull of its trick.

Technical

Later, more advanced exploits came on. Malware writers would examine a disassembled listing of a program and look for certain exploitable instructions. These instructions often take the form of some sort of user input. For example, a login dialog box on an OS or web-site may not perform error-checking and except the user to enter only appropriate data. If you then enter data that it does not expect (or in most cases, too much data), then you can end up putting the data in part of the memory that it should not be. Normally, the user-data should be contained only in a variable, but by exploiting poor error-checking and memory-management, it is possible to put it in a part of memory that can be executed. A common, and well-known method is the buffer-overflow which puts more data in the variable than it can handle, thus overwriting other parts of memory.

Media files are the same. They can be made so that they contain a bit of machine code and exploit the viewer program so that the machine code ends up running. What's worse with media files is that unlike a login which is obviously bad (e.g., username: johndoe234AUI%#639u36906-q1236^<>3;'k7y637y63^L:l,763p,l7p,37po[33p[o7@#^@^089*(^#)360as][.;][.][.>{"{"#:6326^), a media file can be made so that it actually contains proper, legitimate media that is not even corrupt and so looks completely legitimate and goes utterly undetected until the infection's effects take place.

Yes, media files (and for that matter, any file) can contain a virus by exploiting vulnerabilities in the program that opens/views the file. The problem is that exploits are fragile. They usually only affect one media player or another as opposed to all players, and even then, they are not guaranteed to work for different versions of the same program (that's why operating systems issue updates to patch vulnerabilities). Because of this, malware writers usually only bother to spend their time cracking systems/programs in wide use or of high value (e.g., Windows, bank systems, etc.) This is particularly true since hacking has gained in popularity as a business with criminals trying to get money and is no longer just the domain of nerds trying to get glory.

Application

If your video file is infected, then it will likely only infect you if you happen to use the media player(s) that it is specifically crafted to exploit. If not, then it may crash, fail to open, play with corruption, or even play just fine (which is the worst because then gets flagged as okay and gets spread to others who may get infected).

Anti-malware programs usually use signatures and/or heuristics to detect malware. Signatures look for patterns of bytes in the files that usually correspond to instructions in well-known viruses. The problem is that because of polymorphic viruses that can change each time they reproduce, signatures become less effective. Heuristics observe behavior patterns like editing specific files or reading specific data. These usually only apply once the malware is already running (but can be more effective than signatures).

In both cases, anti-malware programs can, and do, report false-positives.

Obviously the most important step in computing safety is to get your files from trusted sources. If the torrent you are using is from somewhere you trust, then presumably it should be okay. If not, then you may want to think twice about it, especially since there are groups who purposely release torrents containing fakes or even malware.

share|improve this answer
1  
Good overview. There were some well-known exploits in the past where the payload was delivered as a GIF image file. The keywords for more information are: "buffer overflow exploit arbitrary code execution" –  horatio Jul 5 '12 at 20:27
2  
@horatio, I hadn't heard about a GIF exploit (unless you are referring to the GDI vulnerability), but I know the WMF exploit was huge news. –  Synetech Jul 5 '12 at 20:48
    
+1 Great answer! –  Garrett Fogerlie Jul 6 '12 at 5:10
1  
+1 Bravo for a very thorough, succinct, and easy to understand overview of malware. –  Phil Jul 6 '12 at 13:26
1  
Also, to protect against vulnerabilities like these always run the latest version of software because some people do try to fix these bugs. –  sjbotha Jul 6 '12 at 21:15
show 6 more comments

I won't say it's impossible, but it would be difficult. The virus writer would have to craft the AVI to trigger a bug in your media player, and then somehow exploit that to run code on your operating system -- without knowing what media player or OS you are running. If you keep your software up to date, and/or if you run something other than Windows Media Player or iTunes (as the biggest platforms, they will be the best targets), you should be pretty safe.

However, there is a related risk that is very real. Movies on the internet these days use a variety of codecs, and the general public doesn't understand what a codec is -- all they know is "it's something I sometimes have to download so the movie will play". This is a genuine attack vector. If you download something and are told "to view this, you need the codec from [some website]", then we very sure you know what you're doing because you could infect yourself.

share|improve this answer
add comment

An avi file extension is not a guarantee that the file is a video file. You could get any .exe virus and rename it to .avi(this makes you download the virus, what is half of the path to infect your computer). If there are any exploit open on your machine that allow the virus to run, then you would be affected.

If you think it is a malware, just stop download and delete it, never execute it before an antivirus scan.

share|improve this answer
13  
-1 This is not how an .avi would likely infect you - even if it were an .exe renamed to .avi, it would not execute as an executable when you opened it, unless you were stupid enough to rename it to .exe beforehand. –  BlueRaja Jul 5 '12 at 20:20
1  
@BlueRaja No one. However, it is a possible avenue of attack. Many people have machines that have been exploited by backdoors or trojans or the like and don't know it. The sole reason that those even exist is to facilitate infection of the machine. It opens the doors for actual viruses or worms to get in. Therefore, it can't be ruled out. –  Ben Richards Jul 6 '12 at 2:52
2  
Tranferring viruses to a user's machine is not the hardest part, it's a completely trivial part. You can just rename the .exe to .jpg and include it in a web page and it will be tranferred when the user visits your page. The hardest part of infection is doing the first code execution. –  MatsT Jul 6 '12 at 9:57
2  
@BlueRaja: I actually saw an infection happen to a colleague's computer with a .avi file, and reproduced it myself on a VM. She had downloaded a zip that contained a couple of files, one with an AVI extension, and the other a batch script. Opening the AVI didn't work, so she tried opening the script. The script had code to run the "AVI" from the command line as an executable, and you can guess what happened next (the virus encrypted all data in her user directory after changing the password, and then demanded $25 as a penalty for acting stupid). –  Hippo Jul 6 '12 at 13:05
2  
@Hippo that is rather a poor example, because the actual virus -- the scripts in this case -- came with an AVI is irrelevant to the fact that AVI can not on it's own infect your computer, considering that most computers and preferred targets are connected to the internet the script could simply download the virus from the web and again, if you can get someone to run a 'script' then why not put virus there in the first place ? – –  omeid Jul 7 '12 at 9:06
show 10 more comments

Yes, it is possible. AVI files, like every file, can be specially crafted to take advantage of known bugs in the software that manage those files.

Antivirus software detect know patterns in the files, like executable code in binary files, or specific JavaScript constructions in HTML pages, that are possibly virus.

share|improve this answer
add comment

It's possible, yes, but very unlikely. You are more likely to try and view a WMV and have it auto-load a URL or ask you to download a license, which in turn pops up a browser window which could exploit your machine if it's not fully patched.

share|improve this answer
add comment

Quick answer: YES.

Slightly longer answer:

  • A file is a container for different types of data.
  • An AVI (Audio Video Interleave) file is meant to contain interleaved audio and video data. Normally, it shouldn't contain any executable code.
  • Unless the attacker is unusually determined, it is quite unlikely that an AVI file with audio-video data would actually contain a virus

HOWEVER ...

  • An AVI file needs a decoder to do anything useful. For example, you already might be using Windows Media Player to play AVI files to see their content
  • If the decoder or the file-parser have bugs that the attacker can exploit, they will cleverly produce an AVI file such that:
    • on your attempt to open those files (for example if you double-click to start playing the video) with your buggy AVI-parser or decoder, those hidden bugs will trigger
    • As a result, it may allow the attacker to execute code of his choice on your computer, potentially leaving your computer infected.
    • Here's a vulnerability report that answers exactly what you are asking.
share|improve this answer
    
The only real answer to the question is "Here's a vulnerability report" in this answer. All others just speculating. –  Alex Jul 8 '12 at 5:52
    
Hi @Alex, I guess you are right. My intention was to give the OP some background. I agree that the vulnerability report answers the question for itself. –  Babil Jul 8 '12 at 10:38
    
Perhaps I wasn't clear enough - just meant to say that because of the report, your answer is the one which really answers the original question. +1. –  Alex Jul 8 '12 at 12:25
add comment

Most popular from of 'AVI' viruses I have heard have been,
something.avi.exe files downloaded on a windows machine
that is configured to hide the file extensions in explorer.

The user typically forgets that later fact and assumes the file is AVI.
Coupled to their expectation of an associated player, a double-click actually launches the EXE.


After that, its been oddly transcoded AVI files that require you to download a new codec to see them.
The so-called codec is usually the real 'virus' here.


I have also heard of AVI buffer-overflow exploits, but a few good references would be useful.

My bottom line: culprit is usually one of the following rather than the AVI file itself

  • The codec installed on your system to handle the AVI
  • The player being used
  • The file-sharing tool used to get the AVI file


A short malware prevention reading: P2P or File Sharing

share|improve this answer
add comment

.avi (or .mkv for that matter) are containers and support inclusion of a variaty of media - multiple audio/video streams, subtitles, dvd-like menu navigation etc. There is nothing preventing malicious executable content being included either but it will not be run unless in scenarios Synetech described in his answer

Still, there is one commonly exploted angle left out. Given a variety of codecs available and no restrictions on including them in container files, there are common protocols to prompt a user for installing the necessary codec and it doesn't help that media players may be configured to automatically attempt codec lookup and installation. Ultimately codecs are executable (minus a small array of ones that are plugin-based) and could contain malicious code.

share|improve this answer
    
good point about the codecs! –  marabutt Jul 6 '12 at 22:52
add comment

Technically, not from downloading the file. But once the file is opened, it's fair game depending on the player and the codec implementation.

share|improve this answer
add comment

My Avast Antivirus just informed me that there was a trojan embedded in one of my downloaded movie AVIs. When I tried to quarantine it, it said the file is too big and cannot be moved, so I had to delete it instead.

The virus is called WMA.wimad [susp] and is apparenty a medium threat virus that does some sort of browser hijack stuff. Not exactly system breaking, but it does prove that you can get viruses from AVI files.

share|improve this answer
add comment

If the download isn't complete yet, wait before it completes before you decide what to do. When the download is only partially complete, the missing parts of the file are essentially noise and quite prone to produce false positives when checked for malware.

As @Synetech explained in detail, it's possible to spread malware through video files, possibly before the download even finishes. But that it's possible doesn't mean that it's likely. From my personal experience, the odds of a false positive during an ongoing download are much higher.

share|improve this answer
    
> The odds of a false positive during an ongoing download are much higher. I don't know about "much", but it's certainly possible since the incomplete file may have a lot of nulls which could just happen to be next to a bit of normally innocuous bytes that end up happening to look like bad machine code (at least until the nulls are overwritten with the actual data). –  Synetech Jul 5 '12 at 20:07
2  
On the other hand, preview images in Windows Explorer are generated by your video-player of choice. If this player is the one that the virus exploits, there's the possiblity of catching the virus just by opening the file's folder in explorer! In this case, you want to catch the virus before you finish downloading the file. There have been viruses that spread like this in the past. –  BlueRaja Jul 5 '12 at 20:23
    
@Synetech: I have no data about this, but I know at least 20 people who got a false alarm from an incomplete torrent download. While I read that it's possible, I know nobody that got his computer infected by an actual video file. –  Dennis Jul 5 '12 at 20:24
1  
@BlueRaja, yup, that's what I warned soandos about above. However, for most common media files, it is Windows/WMP that generates the preview, not a third-party program (most novices don't have FFDShow installed; at least not if they don't install all those nasty, god-forsaken mega codec packs). –  Synetech Jul 5 '12 at 20:32
1  
@BlueRaja, I cannot find any information on that. Can you please find a source for that. I only use the portable, so I have never seen VLC generating thumbnails. Further, one would think that it would generate thumbnails for every type of video that it can play and is associated with, including FLV, MKV, etc. yet it does not, hence programs like Icaros. In fact, it seems that there are plans to implement a VLC preview handler, but that has been delayed. –  Synetech Jul 5 '12 at 20:42
show 1 more comment

Short answer, yes. A longer answer follows the basic tutorial Tropical PC Solutions: How to hide a virus! and make one for yourself.

share|improve this answer
1  
Note, that page does not actually implement an exploit to infect a system, it only hides some data in an image file using steganography (in this case it’s malware, but it could as well be anything). The code does not actually run, it is simply hidden. It does accomplish the goal of getting the code on the target system, but then it would need some other method of being run. –  Synetech Jul 6 '12 at 5:14
add comment

Having spent time assisting users resolve malware issues, I can testify that usual exploitation mechanism used by scammers is more social than technical.

The file is simply named as *.avi.exe and the default setting in windows does not reveal common file extensions. The executable file is simply assigned a AVI file icon. This is similar to tactics used to distribute *.doc.exe viruses where the file has winword's icon.

I have also observed dodgy tactics such as long file names being used in p2p distribution, so the client displays only partial names in the file list.

Using shoddy files

If you need to use the file, always use a sandbox that is configured to stop outgoing internet connections. Windows firewall is badly configured to allow outgoing connections by default. Exploitation is an action, which like any action always has a motivation. Usually, it's performed to siphon browser passwords or cookies, license and transfer the contents to an external resource(such as FTP) owned by an attacker. Hence, if you use a tool such as sandboxie, disable outgoing internet connections. If you use a virtual machine ensure that that it contains no sensitive information and always block outgoing internet access using a firewall rule.

If you do not know what you're doing, don't use the file. Be safe and do not take risks that are not worth taking.

share|improve this answer
add comment

AVI files won't be infected with virus. When you download movies from a torrent, instead of AVI, if the movie is in a RAR package or it is as an EXE file, then surely there is a chance of virus in it.

Some of them ask you to download an additional codec from some website to view the movie. These are the suspect ones. But if it is AVI, then you can surely give iy a try playing it in your video player. Nothing will happen.

share|improve this answer
    
could merely un-raring the file give you a virus? –  user3183 Aug 19 '09 at 23:03
    
@user3183, possibly. The file may be designed to exploit a vulnerability in WinRAR/7-zip/etc. –  Synetech Jul 6 '12 at 5:15
    
@Synetech: the likelihood of that is just the same as the likelihood of exploiting a vulnerability in your media player, which is to say much less likely than an .avi.exe exploit. –  Lie Ryan Jul 6 '12 at 10:41
1  
@LieRyan, exactly. There are enough different archive programs and versions of the same that the target surface area is (too) large. For glory-hounds, it may be worth the effort, but for business-hackers, it is better to target the OS. –  Synetech Jul 6 '12 at 15:48
add comment

AVI files cannot have a virus if they are video files. While downloading your browser keeps the download in its own format that is why the antivirus detects it as a virus. When downloading the AVI file make sure after downloading the file is run in a video player if it is an invalid file then it will not play and no prices for guessing it will be a virus then.

If you try to double click and run it directly if there is a slight chance of virus then it will come out. Take precautions and you don't need antivirus software.

share|improve this answer
2  
They are not using a browser; it is a torrent client. –  Synetech Jul 6 '12 at 5:11
    
yup same goes with torrent files too specifically torrent files are a target for these antivirus companies –  Sreejit Jul 6 '12 at 5:19
1  
most torrent clients do not keep the downloaded file in a different format during download (though they may use a different filename/extension). –  Synetech Jul 6 '12 at 5:21
    
yes i'm also saying extentions sorry to not include that and the antivirus does see the extentions for checking viruses –  Sreejit Jul 6 '12 at 5:23
    
oh okay. Anti-malware programs can also be set to scan regardless of extension, but that tends to slow the system down. :-( –  Synetech Jul 6 '12 at 5:27
show 2 more comments

protected by Synetech Aug 6 '12 at 2:53

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.