I'm downloading an AVI file via a torrent, but my anti-virus detects something. Is it possible that the AVI file contains a virus?

It is quite weird since the torrent has many positive reviews.

  • 2
    @user3183 VideoLAN uses it's own codecs internally. There is nothing stopping one of its own codecs from having an error that a malicious virus writer could exploit.
    – GAThrawn
    Jan 5, 2011 at 12:08
  • 7
    When in doubt, stop the download.
    – user76211
    Jul 5, 2012 at 16:57
  • 28
    @soandos, that's not necessarily true. The file may be designed to exploit the torrent-client when it hashes it to check that it's good; it can also be designed to exploit the operating-system when it reads the file to produce a thumbnail or extract metadata.
    – Synetech
    Jul 5, 2012 at 17:41
  • 2
    @IMB, which file is the antivirus flagging? Are the positive reviews from real people or are they obviously generated/copy-pasted?
    – Synetech
    Jul 5, 2012 at 17:41
  • 4

16 Answers 16



An .avi file is a video, and therefore is not executable, so the operating system can/will not run the file. As such, it cannot be a virus in its own right, but it can indeed contain a virus.


In the past, only executable (i.e., “runnable”) files would be viruses. Later, Internet worms started using social-engineering to trick people into running viruses. A popular trick would be to rename an executable to include other extensions like .avi or .jpg in order to trick the user into thinking it is a media file and run it. For example, an email client may only display the first dozen or so characters of attachments, so by giving a file a false extension, then padding it with spaces as in "FunnyAnimals.avi              .exe", the user sees what looks like a video and runs it and gets infected.

This was not only social-engineering (tricking the user), but also an early exploit. It exploited the limited display of filenames of email clients to pull off its trick.


Later, more advanced exploits came along. Malware writers would disassemble a program to examine its source-code and look for certain parts that had poor data- and error-handling which they could exploit. These instructions often take the form of some sort of user input. For example, a login dialog box on an OS or web-site may not perform error-checking or data-validation, and thus assume/expect the user to enter only appropriate data. If you then enter data that it does not expect (or in the case of most exploits, too much data), then the input will end up outside of the memory that was assigned to hold the data. Normally, the user-data should be contained only in a variable, but by exploiting poor error-checking and memory-management, it is possible to put it in a part of memory that can be executed. A common, and well-known method is the buffer-overflow which puts more data in the variable than it can hold, thus overwriting other parts of memory. By cleverly crafting the input, it is possible to cause code (instructions) to be overrun and then transfer control to that code. At that point, the sky is usually the limit as to what can be done once the malware has control.

Media files are the same. They can be made so that they contain a bit of machine code and exploit the media-player so that the machine code ends up running. For example, it might be possible to put too much data in the media file’s meta-data so that when the player tries to open the file and read it, it overflows the variables and causes some code to run. Even the actual data could theoretically be crafted to exploit the program.

What’s worse with media files is that unlike a login which is clearly bad, even to lay-persons (e.g., username: johndoe234AUI%#639u36906-q1236^<>3;'k7y637y63^L:l,763p,l7p,37po[33p[o7@#^@^089*(^#)360as][.;][.][.>{"{"#:6326^), a media file can be made so that it actually contains proper, legitimate media that is not even corrupt and so looks completely legitimate and goes utterly undetected until the infection’s effects take place. Steganography (literally “covered writing”) is usually used to conceal data in other data, but this is essentially the same thing since the malware would be hidden in what looks like legitimate media.

So yes, media files (and for that matter, any file) can contain a virus by exploiting vulnerabilities in the program that opens/views the file. The problem is that you often do not even need to open or view the file to be infected. Most file types can be previewed or have their meta-data read without purposely opening them. For example, simply selecting a media file in Windows Explorer will automatically read the meta-data (dimensions, length, etc.) from the file. This could potentially be a vector of attack if a malware writer happened to find a vulnerability in Explorer’s preview/meta-data function and crafts a media file that exploits it.

Fortunately, exploits are fragile. They usually only affect one media player or another as opposed to all players, and even then, they are not guaranteed to work for different versions of the same program (that's why operating systems issue updates to patch vulnerabilities). Because of this, malware writers usually only bother to spend their time cracking systems/programs in wide use or of high value (e.g., Windows, bank systems, etc.) This is particularly true since hacking has gained in popularity as a business with criminals trying to get money and is no longer just the domain of nerds trying to get glory.


If your video file is infected, then it will likely only infect you if you happen to use the media player(s) that it is specifically designed to exploit. If not, then it may crash, fail to open, play with corruption, or even play just fine (which is the worst-case scenario because then gets flagged as okay and gets spread to others who may get infected).

Anti-malware programs usually use signatures and/or heuristics to detect malware. Signatures look for patterns of bytes in the files that usually correspond to instructions in well-known viruses. The problem is that because of polymorphic viruses that can change each time they reproduce, signatures become less effective. Heuristics observe behavior patterns like editing specific files or reading specific data. These usually only apply once the malware is already running because static analysis (examining the code without running it) can be extremely complex thanks to malware obfuscation and evasion techniques.

In both cases, anti-malware programs can, and do, report false-positives.


Obviously the most important step in computing safety is to get your files from trusted sources. If the torrent you are using is from somewhere you trust, then presumably it should be okay. If not, then you may want to think twice about it, (especially since there are anti-piracy groups who purposely release torrents containing fakes or even malware).

  • 3
    Good overview. There were some well-known exploits in the past where the payload was delivered as a GIF image file. The keywords for more information are: "buffer overflow exploit arbitrary code execution"
    – horatio
    Jul 5, 2012 at 20:27
  • 3
    @horatio, I hadn't heard about a GIF exploit (unless you are referring to the GDI vulnerability), but I know the WMF exploit was huge news.
    – Synetech
    Jul 5, 2012 at 20:48
  • 3
    +1 Bravo for a very thorough, succinct, and easy to understand overview of malware.
    – Phil
    Jul 6, 2012 at 13:26
  • 4
    Also, to protect against vulnerabilities like these always run the latest version of software because some people do try to fix these bugs.
    – sjbotha
    Jul 6, 2012 at 21:15
  • 1
    @avakar, those are fake videos that use social-engineering to trick people into downloading and running a trojan. The video itself is rarely corrupted to exploit player vulnerabilities.
    – Synetech
    Jul 7, 2012 at 15:30

I won't say it's impossible, but it would be difficult. The virus writer would have to craft the AVI to trigger a bug in your media player, and then somehow exploit that to run code on your operating system -- without knowing what media player or OS you are running. If you keep your software up to date, and/or if you run something other than Windows Media Player or iTunes (as the biggest platforms, they will be the best targets), you should be pretty safe.

However, there is a related risk that is very real. Movies on the internet these days use a variety of codecs, and the general public doesn't understand what a codec is -- all they know is "it's something I sometimes have to download so the movie will play". This is a genuine attack vector. If you download something and are told "to view this, you need the codec from [some website]", then we very sure you know what you're doing because you could infect yourself.


Yes, it is possible. AVI files, like every file, can be specially crafted to take advantage of known bugs in the software that manage those files.

Antivirus software detect know patterns in the files, like executable code in binary files, or specific JavaScript constructions in HTML pages, that are possibly virus.


An avi file extension is not a guarantee that the file is a video file. You could get any .exe virus and rename it to .avi(this makes you download the virus, what is half of the path to infect your computer). If there are any exploit open on your machine that allow the virus to run, then you would be affected.

If you think it is a malware, just stop download and delete it, never execute it before an antivirus scan.

  • 18
    -1 This is not how an .avi would likely infect you - even if it were an .exe renamed to .avi, it would not execute as an executable when you opened it, unless you were stupid enough to rename it to .exe beforehand. Jul 5, 2012 at 20:20
  • 3
    Tranferring viruses to a user's machine is not the hardest part, it's a completely trivial part. You can just rename the .exe to .jpg and include it in a web page and it will be tranferred when the user visits your page. The hardest part of infection is doing the first code execution.
    – MatsT
    Jul 6, 2012 at 9:57
  • 3
    @BlueRaja: I actually saw an infection happen to a colleague's computer with a .avi file, and reproduced it myself on a VM. She had downloaded a zip that contained a couple of files, one with an AVI extension, and the other a batch script. Opening the AVI didn't work, so she tried opening the script. The script had code to run the "AVI" from the command line as an executable, and you can guess what happened next (the virus encrypted all data in her user directory after changing the password, and then demanded $25 as a penalty for acting stupid).
    – Hippo
    Jul 6, 2012 at 13:05
  • 3
    @Hippo that is rather a poor example, because the actual virus -- the scripts in this case -- came with an AVI is irrelevant to the fact that AVI can not on it's own infect your computer, considering that most computers and preferred targets are connected to the internet the script could simply download the virus from the web and again, if you can get someone to run a 'script' then why not put virus there in the first place ? –
    – omeid
    Jul 7, 2012 at 9:06
  • 2
    but any other file or extension would have the same impact if any.
    – omeid
    Jul 8, 2012 at 2:55

Quick answer: YES.

Slightly longer answer:

  • A file is a container for different types of data.
  • An AVI (Audio Video Interleave) file is meant to contain interleaved audio and video data. Normally, it shouldn't contain any executable code.
  • Unless the attacker is unusually determined, it is quite unlikely that an AVI file with audio-video data would actually contain a virus


  • An AVI file needs a decoder to do anything useful. For example, you already might be using Windows Media Player to play AVI files to see their content
  • If the decoder or the file-parser have bugs that the attacker can exploit, they will cleverly produce an AVI file such that:
    • on your attempt to open those files (for example if you double-click to start playing the video) with your buggy AVI-parser or decoder, those hidden bugs will trigger
    • As a result, it may allow the attacker to execute code of his choice on your computer, potentially leaving your computer infected.
    • Here's a vulnerability report that answers exactly what you are asking.
  • The only real answer to the question is "Here's a vulnerability report" in this answer. All others just speculating.
    – Alex
    Jul 8, 2012 at 5:52
  • Hi @Alex, I guess you are right. My intention was to give the OP some background. I agree that the vulnerability report answers the question for itself.
    – gsbabil
    Jul 8, 2012 at 10:38
  • Perhaps I wasn't clear enough - just meant to say that because of the report, your answer is the one which really answers the original question. +1.
    – Alex
    Jul 8, 2012 at 12:25

It's possible, yes, but very unlikely. You are more likely to try and view a WMV and have it auto-load a URL or ask you to download a license, which in turn pops up a browser window which could exploit your machine if it's not fully patched.


Most popular from of 'AVI' viruses I have heard have been,
something.avi.exe files downloaded on a windows machine
that is configured to hide the file extensions in explorer.

The user typically forgets that later fact and assumes the file is AVI.
Coupled to their expectation of an associated player, a double-click actually launches the EXE.

After that, its been oddly transcoded AVI files that require you to download a new codec to see them.
The so-called codec is usually the real 'virus' here.

I have also heard of AVI buffer-overflow exploits, but a few good references would be useful.

My bottom line: culprit is usually one of the following rather than the AVI file itself

  • The codec installed on your system to handle the AVI
  • The player being used
  • The file-sharing tool used to get the AVI file

A short malware prevention reading: P2P or File Sharing


.avi (or .mkv for that matter) are containers and support inclusion of a variaty of media - multiple audio/video streams, subtitles, dvd-like menu navigation etc. There is nothing preventing malicious executable content being included either but it will not be run unless in scenarios Synetech described in his answer

Still, there is one commonly exploted angle left out. Given a variety of codecs available and no restrictions on including them in container files, there are common protocols to prompt a user for installing the necessary codec and it doesn't help that media players may be configured to automatically attempt codec lookup and installation. Ultimately codecs are executable (minus a small array of ones that are plugin-based) and could contain malicious code.

  • good point about the codecs!
    – marabutt
    Jul 6, 2012 at 22:52

Technically, not from downloading the file. But once the file is opened, it's fair game depending on the player and the codec implementation.


My Avast Antivirus just informed me that there was a trojan embedded in one of my downloaded movie AVIs. When I tried to quarantine it, it said the file is too big and cannot be moved, so I had to delete it instead.

The virus is called WMA.wimad [susp] and is apparenty a medium threat virus that does some sort of browser hijack stuff. Not exactly system breaking, but it does prove that you can get viruses from AVI files.


If the download isn't complete yet, wait before it completes before you decide what to do. When the download is only partially complete, the missing parts of the file are essentially noise and quite prone to produce false positives when checked for malware.

As @Synetech explained in detail, it's possible to spread malware through video files, possibly before the download even finishes. But that it's possible doesn't mean that it's likely. From my personal experience, the odds of a false positive during an ongoing download are much higher.

  • > The odds of a false positive during an ongoing download are much higher. I don't know about "much", but it's certainly possible since the incomplete file may have a lot of nulls which could just happen to be next to a bit of normally innocuous bytes that end up happening to look like bad machine code (at least until the nulls are overwritten with the actual data).
    – Synetech
    Jul 5, 2012 at 20:07
  • 4
    On the other hand, preview images in Windows Explorer are generated by your video-player of choice. If this player is the one that the virus exploits, there's the possiblity of catching the virus just by opening the file's folder in explorer! In this case, you want to catch the virus before you finish downloading the file. There have been viruses that spread like this in the past. Jul 5, 2012 at 20:23
  • @Synetech: I have no data about this, but I know at least 20 people who got a false alarm from an incomplete torrent download. While I read that it's possible, I know nobody that got his computer infected by an actual video file.
    – Dennis
    Jul 5, 2012 at 20:24
  • 1
    @BlueRaja, yup, that's what I warned soandos about above. However, for most common media files, it is Windows/WMP that generates the preview, not a third-party program (most novices don't have FFDShow installed; at least not if they don't install all those nasty, god-forsaken mega codec packs).
    – Synetech
    Jul 5, 2012 at 20:32
  • 1
    @BlueRaja, I cannot find any information on that. Can you please find a source for that. I only use the portable, so I have never seen VLC generating thumbnails. Further, one would think that it would generate thumbnails for every type of video that it can play and is associated with, including FLV, MKV, etc. yet it does not, hence programs like Icaros. In fact, it seems that there are plans to implement a VLC preview handler, but that has been delayed.
    – Synetech
    Jul 5, 2012 at 20:42

Having spent time assisting users resolve malware issues, I can testify that usual exploitation mechanism used by scammers is more social than technical.

The file is simply named as *.avi.exe and the default setting in windows does not reveal common file extensions. The executable file is simply assigned a AVI file icon. This is similar to tactics used to distribute *.doc.exe viruses where the file has winword's icon.

I have also observed dodgy tactics such as long file names being used in p2p distribution, so the client displays only partial names in the file list.

Using shoddy files

If you need to use the file, always use a sandbox that is configured to stop outgoing internet connections. Windows firewall is badly configured to allow outgoing connections by default. Exploitation is an action, which like any action always has a motivation. Usually, it's performed to siphon browser passwords or cookies, license and transfer the contents to an external resource(such as FTP) owned by an attacker. Hence, if you use a tool such as sandboxie, disable outgoing internet connections. If you use a virtual machine ensure that that it contains no sensitive information and always block outgoing internet access using a firewall rule.

If you do not know what you're doing, don't use the file. Be safe and do not take risks that are not worth taking.


Short answer, yes. A longer answer follows the basic tutorial Tropical PC Solutions: How to hide a virus! and make one for yourself.

  • 2
    Note, that page does not actually implement an exploit to infect a system, it only hides some data in an image file using steganography (in this case it’s malware, but it could as well be anything). The code does not actually run, it is simply hidden. It does accomplish the goal of getting the code on the target system, but then it would need some other method of being run.
    – Synetech
    Jul 6, 2012 at 5:14

Technical answer -- with citations

Most movie players use libavcodec. It's the library behind ffmpeg. This includes VLC, Google Chrome, and many other applications. An "arbitrary code execution" is a class of vulnerability that allows you to execute code when it's not intended. A "virus" is another name for a payload that when executed replicates. Replication is trivial with an arbitrary code execution vulnerability: these bugs are pretty serious, only under privilege escalation and remote execution.

  • If a vulnerability in libavcodec was found that allowed arbitrary code execution.
  • And, if your media player uses libavcodec
  • Then a video can deliver a virus.

Has a vulnerability of this sort been discovered? Yes. Enter CVE-2020-35964 which was fixed in Ffmpeg 4.3.1. If you're using a media player that is linked against libavcodec 4.3.0 or lower, you're potentially vulnerable. This isn't the only time this happened either... The ffmpeg project discloses the vulnerabilities found on their website. Note some are worse than the one randomly picked above, and some are minor.

tldr; the player is an executable that can link to a library or have a library statically linked in. If a vulnerability is found in that library more than one player will be vulnerable. In the case of libavcodec which has a massive amount of use in the video player ecosystem, you'll have a viable method to execute your payload (without having to craft it to a specific media player, or even operating system).


AVI files won't be infected with virus. When you download movies from a torrent, instead of AVI, if the movie is in a RAR package or it is as an EXE file, then surely there is a chance of virus in it.

Some of them ask you to download an additional codec from some website to view the movie. These are the suspect ones. But if it is AVI, then you can surely give iy a try playing it in your video player. Nothing will happen.

  • could merely un-raring the file give you a virus?
    – user3183
    Aug 19, 2009 at 23:03
  • @user3183, possibly. The file may be designed to exploit a vulnerability in WinRAR/7-zip/etc.
    – Synetech
    Jul 6, 2012 at 5:15
  • @Synetech: the likelihood of that is just the same as the likelihood of exploiting a vulnerability in your media player, which is to say much less likely than an .avi.exe exploit.
    – Lie Ryan
    Jul 6, 2012 at 10:41
  • 1
    @LieRyan, exactly. There are enough different archive programs and versions of the same that the target surface area is (too) large. For glory-hounds, it may be worth the effort, but for business-hackers, it is better to target the OS.
    – Synetech
    Jul 6, 2012 at 15:48

AVI files cannot have a virus if they are video files. While downloading your browser keeps the download in its own format that is why the antivirus detects it as a virus. When downloading the AVI file make sure after downloading the file is run in a video player if it is an invalid file then it will not play and no prices for guessing it will be a virus then.

If you try to double click and run it directly if there is a slight chance of virus then it will come out. Take precautions and you don't need antivirus software.

  • 2
    They are not using a browser; it is a torrent client.
    – Synetech
    Jul 6, 2012 at 5:11
  • yup same goes with torrent files too specifically torrent files are a target for these antivirus companies
    – Sreejit
    Jul 6, 2012 at 5:19
  • 1
    most torrent clients do not keep the downloaded file in a different format during download (though they may use a different filename/extension).
    – Synetech
    Jul 6, 2012 at 5:21
  • yes i'm also saying extentions sorry to not include that and the antivirus does see the extentions for checking viruses
    – Sreejit
    Jul 6, 2012 at 5:23
  • oh okay. Anti-malware programs can also be set to scan regardless of extension, but that tends to slow the system down. :-(
    – Synetech
    Jul 6, 2012 at 5:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .