Questions about malware

Question

I have a couple questions about malware and exploits that I hope someone could answer to help me better understand those topics.

First: I know of two dominant ways to spread malware. The malware can be in an executable file and cause an infection when the user runs the file. Or the malware can be embedded in some other file type (image, video, ...) that uses a specific application to open the file. From there, a security vulnerability in that application can be exploited to cause the infection. Both of these methods require the user to use the infected file. My question is (and I can't believe I couldn't find the answer anywhere):

Can your computer become infected from the mere act of downloading an infected file (without running it)? I suppose another way of asking this might be, "Can a file be programmed to start itself upon downloading?"

Second: Can a file in an archived format (zip or rar or whatever) be made to execute as soon as it is extracted? Or is it safe to extract files from an archive before running a virus scan on them? And for that matter, do virus scanners work correctly on archived files?

And finally: If you convert an infected video file to a different container format before playing it, is it possible for the malicious code to survive the conversion?

This wound up being pretty long winded but thanks for reading. Any help at all is appreciated! Thanks!

Answer 1

1. The act of downloading itself can't infect your computer but several steps along the way can. First just being connected to the internet could infect your computer (see worms and Code Red Worm) through an OS service. This risk has been greatly reduced since the beginning of the Internet (with OS lockdowns and firewalls) but still exists. Going to the website to get the download link could also lead to several exploits (see Cross-site scripting XSS). Once you get the link and are just transferring the bytes down I don't know of any current attack vectors.

2. This would depend on an exploit on the archive viewer and your use. The viewer itself is just reading the zip file, extracting contents and writing them to disk. Some viewers have an Install option that extracts the files and then starts execution so that would obviously be a risk. There could be something like a buffer overflow exploit on the zip viewer but I have not heard of one.

3. The converting software could be the target of the exploit. It's really hard to say. Generally viewing or viewing converted videos are safe activities but anytime code is executing or manipulating data there is the risk for an exploit.

Answer 2

In regard to files inside archives assuming the archive itself is not malicious there is nothing in the extraction process that would cause a file to run. The extraction process does not try to interrupt the contents of the file being extracted it just writes out the decompressed form of the data.

In regard to video conversion the malicious code may actually be triggered by the conversion process itself. As this requires interrupting data within the video file. Just as playback would. Even if not triggered the code may very well survive conversion. Although the exploit may or may not work for the new format.