Can Viruses infect .AVI files???

Discussion in 'Computer Support' started by Smiley, Jun 26, 2003.

  1. Smiley

    Smiley Guest

    What I've learned about viruses from college and other reading material led
    me to believe that viruses could not infect .avi files. I looked it up and
    found a page the further confirmed that:
    http://www.custom-code-factory.com/viruses.htm

    The thing is, I was downloading a .avi file over a file sharing network when
    my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    up:
    http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )

    Could this virus infect a .avi file? And if not, why did my antivirus
    detect it?
    Smiley, Jun 26, 2003
    #1
    1. Advertising

  2. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Smiley said:

    > What I've learned about viruses from college and other reading material led
    > me to believe that viruses could not infect .avi files. I looked it up and
    > found a page the further confirmed that:
    > http://www.custom-code-factory.com/viruses.htm
    >
    > The thing is, I was downloading a .avi file over a file sharing network when
    > my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    > up:
    > http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )
    >
    > Could this virus infect a .avi file? And if not, why did my antivirus
    > detect it?


    I think you will find that about the only thing that can't contain a virus is a
    plain text file.
    Brian H¹©, Jun 26, 2003
    #2
    1. Advertising

  3. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Smiley said:

    >> I think you will find that about the only thing that can't contain a virus
    >> is a plain text file.

    >
    > That can't be true, how could a virus possibly infect an image file? Or a
    > .wav or .mp3 file? Do you have examples of where any audio/video type file
    > extension has been infected by a virus?


    And how do you think infected files get transmitted via Kazaa etc?
    Brian H¹©, Jun 26, 2003
    #3
  4. Smiley

    °Mike° Guest

    ANY file can be infected - ie. have the virus added to it,
    but only executable files can actually activate the virus;
    this includes HTML, .vbs, .js etc.

    The file you downloaded probably had a fake (double) extension.
    This is a common way to trick people into running an infected
    file. For instance, an infected file could be called:
    somemovie.avi.exe , somemovie.avi.scr , somemovie.avi.vbs .
    Most systems will NOT see the actual executable extension,
    which is the last part of the file name. That is why it
    is important that you scan ALL files - even from people you
    know, and otherwise trust - BEFORE opening them.


    On Thu, 26 Jun 2003 15:33:32 -0400, in
    <>
    Smiley scrawled:

    >What I've learned about viruses from college and other reading material led
    >me to believe that viruses could not infect .avi files. I looked it up and
    >found a page the further confirmed that:
    >http://www.custom-code-factory.com/viruses.htm
    >
    >The thing is, I was downloading a .avi file over a file sharing network when
    >my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >up:
    >http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )
    >
    >Could this virus infect a .avi file? And if not, why did my antivirus
    >detect it?
    >


    --
    STGP, OGPE24HSHD
    °Mike°, Jun 26, 2003
    #4
  5. Smiley

    °Mike° Guest

    On Thu, 26 Jun 2003 20:36:00 +0100, in
    <xWHKa.1388$>
    Brian H¹© scrawled:

    >X-No-Archive: Yes
    > Errrrr...erm... Smiley said:
    >
    >> What I've learned about viruses from college and other reading material led
    >> me to believe that viruses could not infect .avi files. I looked it up and
    >> found a page the further confirmed that:
    >> http://www.custom-code-factory.com/viruses.htm
    >>
    >> The thing is, I was downloading a .avi file over a file sharing network when
    >> my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >> up:
    >> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )
    >>
    >> Could this virus infect a .avi file? And if not, why did my antivirus
    >> detect it?

    >
    >I think you will find that about the only thing that can't contain a virus is a
    >plain text file.


    Wrong:

    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    Also, javascript and HTML are (effectively) text files.

    --
    STGP, OGPE24HSHD
    °Mike°, Jun 26, 2003
    #5
  6. Smiley

    Smiley Guest

    > The file you downloaded probably had a fake (double) extension.
    > This is a common way to trick people into running an infected
    > file. For instance, an infected file could be called:
    > somemovie.avi.exe , somemovie.avi.scr , somemovie.avi.vbs .
    > Most systems will NOT see the actual executable extension,
    > which is the last part of the file name. That is why it
    > is important that you scan ALL files - even from people you
    > know, and otherwise trust - BEFORE opening them.


    It didn't have a double extension, I'm not stupid enough to fall for that -
    I'm a computer programmer so I know about extensions. It was a plain .avi
    file, that's it. I need to know if a plain.avi file can be infected.
    Smiley, Jun 26, 2003
    #6
  7. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... °Mike° said:

    > On Thu, 26 Jun 2003 20:36:00 +0100, in
    > <xWHKa.1388$>
    > Brian H¹© scrawled:
    >
    >> X-No-Archive: Yes
    >> Errrrr...erm... Smiley said:
    >>
    >>> What I've learned about viruses from college and other reading material led
    >>> me to believe that viruses could not infect .avi files. I looked it up and
    >>> found a page the further confirmed that:
    >>> http://www.custom-code-factory.com/viruses.htm
    >>>
    >>> The thing is, I was downloading a .avi file over a file sharing network when
    >>> my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >>> up:
    >>> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html
    >>> )
    >>>
    >>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>> detect it?

    >>
    >> I think you will find that about the only thing that can't contain a virus
    >> is a plain text file.

    >
    > Wrong:
    >
    > X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >
    > Also, javascript and HTML are (effectively) text files.


    That's why I said "plain text"
    Brian H¹©, Jun 26, 2003
    #7
  8. Smiley

    Smiley Guest

    > And how do you think infected files get transmitted via Kazaa etc?

    People who are trading executables like games and such, or word documents
    and the like.
    Smiley, Jun 26, 2003
    #8
  9. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Smiley said:

    >> The file you downloaded probably had a fake (double) extension.
    >> This is a common way to trick people into running an infected
    >> file. For instance, an infected file could be called:
    >> somemovie.avi.exe , somemovie.avi.scr , somemovie.avi.vbs .
    >> Most systems will NOT see the actual executable extension,
    >> which is the last part of the file name. That is why it
    >> is important that you scan ALL files - even from people you
    >> know, and otherwise trust - BEFORE opening them.

    >
    > It didn't have a double extension, I'm not stupid enough to fall for that -
    > I'm a computer programmer so I know about extensions. It was a plain .avi
    > file, that's it. I need to know if a plain.avi file can be infected.


    Well if you *are* a programmer, you should know what a binary is, and what code
    is, and how easy it is to insert code.
    Brian H¹©, Jun 26, 2003
    #9
  10. Smiley

    °Mike° Guest

    On Thu, 26 Jun 2003 20:58:08 +0100, in
    <gfIKa.1407$>
    Brian H¹© scrawled:

    >X-No-Archive: Yes
    > Errrrr...erm... °Mike° said:
    >
    >> On Thu, 26 Jun 2003 20:36:00 +0100, in
    >> <xWHKa.1388$>
    >> Brian H¹© scrawled:
    >>
    >>> X-No-Archive: Yes
    >>> Errrrr...erm... Smiley said:
    >>>
    >>>> What I've learned about viruses from college and other reading material led
    >>>> me to believe that viruses could not infect .avi files. I looked it up and
    >>>> found a page the further confirmed that:
    >>>> http://www.custom-code-factory.com/viruses.htm
    >>>>
    >>>> The thing is, I was downloading a .avi file over a file sharing network when
    >>>> my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >>>> up:
    >>>> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html
    >>>> )
    >>>>
    >>>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>>> detect it?
    >>>
    >>> I think you will find that about the only thing that can't contain a virus
    >>> is a plain text file.

    >>
    >> Wrong:
    >>
    >> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >>
    >> Also, javascript and HTML are (effectively) text files.

    >
    >That's why I said "plain text"


    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    THAT'S "plain text".

    Save it as a text file an scan it. Rename it to xxxx.com
    and run it.

    --
    STGP, OGPE24HSHD
    °Mike°, Jun 26, 2003
    #10
  11. Smiley

    °Mike° Guest

    On Thu, 26 Jun 2003 15:57:23 -0400, in
    <>
    Smiley scrawled:

    >> The file you downloaded probably had a fake (double) extension.
    >> This is a common way to trick people into running an infected
    >> file. For instance, an infected file could be called:
    >> somemovie.avi.exe , somemovie.avi.scr , somemovie.avi.vbs .
    >> Most systems will NOT see the actual executable extension,
    >> which is the last part of the file name. That is why it
    >> is important that you scan ALL files - even from people you
    >> know, and otherwise trust - BEFORE opening them.

    >
    >It didn't have a double extension, I'm not stupid enough to fall for that -
    >I'm a computer programmer so I know about extensions. It was a plain .avi
    >file, that's it. I need to know if a plain.avi file can be infected.


    If you're not that stupid, then you shouldn't have any trouble
    understanding my reply to you.

    --
    "Please Tell Me if you Don't Get This Message."
    °Mike°, Jun 26, 2003
    #11
  12. Smiley

    Shep© Guest

    On Thu, 26 Jun 2003 21:02:59 +0100, Whilst playing Smegball with the
    scutters "Slumpy" <> wrote :

    >"So, Mr Slumpy you *really* are the perpetual comedian, aren't you ?" I
    >threw back my head and roared with laughter as Smiley continued:
    >
    >>> And how do you think infected files get transmitted via Kazaa etc?

    >>
    >> People who are trading executables like games and such, or word
    >> documents and the like.

    >
    >Or people who expect to download an avi file, so think there's nothing
    >wroing with downloading, say, 'this_video.avi' even though Kazaa doesn't
    >show the actual file extension, thereby hiding the fact it really is
    >'this_video.avi.exe'....and by the time you've run it, too late.


    "Nail on the head" Slumpy.Right on the mark :D





    --
    Free Windows/PC help,
    http://www.geocities.com/sheppola/trouble.html
    Free songs download,
    http://artists.mp3s.com/artists/17/sheppard.html
    Shep©, Jun 26, 2003
    #12
  13. Smiley

    Smiley Guest

    > Or people who expect to download an avi file, so think there's nothing
    > wroing with downloading, say, 'this_video.avi' even though Kazaa doesn't
    > show the actual file extension, thereby hiding the fact it really is
    > 'this_video.avi.exe'....and by the time you've run it, too late.


    Kazaa actually hides the file extension? Good thing I don't use Kazaa.
    Sorry, my file was actually a .avi file, I use WinMX and it doesn't hide
    file extensions.
    Smiley, Jun 26, 2003
    #13
  14. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... °Mike° said:

    > On Thu, 26 Jun 2003 20:58:08 +0100, in
    > <gfIKa.1407$>
    > Brian H¹© scrawled:
    >
    >> X-No-Archive: Yes
    >> Errrrr...erm... °Mike° said:
    >>
    >>> On Thu, 26 Jun 2003 20:36:00 +0100, in
    >>> <xWHKa.1388$>
    >>> Brian H¹© scrawled:
    >>>
    >>>> X-No-Archive: Yes
    >>>> Errrrr...erm... Smiley said:
    >>>>
    >>>>> What I've learned about viruses from college and other reading material
    >>>>> led me to believe that viruses could not infect .avi files. I looked it
    >>>>> up and found a page the further confirmed that:
    >>>>> http://www.custom-code-factory.com/viruses.htm
    >>>>>
    >>>>> The thing is, I was downloading a .avi file over a file sharing network
    >>>>> when my Norton Antivirus detected in it a virus called W32.HLLW.Purol
    >>>>> (looked it up:
    >>>>>

    http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html
    >>>>> )
    >>>>>
    >>>>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>>>> detect it?
    >>>>
    >>>> I think you will find that about the only thing that can't contain a virus
    >>>> is a plain text file.
    >>>
    >>> Wrong:
    >>>
    >>> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >>>
    >>> Also, javascript and HTML are (effectively) text files.

    >>
    >> That's why I said "plain text"

    >
    > X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >
    > THAT'S "plain text".
    >
    > Save it as a text file an scan it. Rename it to xxxx.com
    > and run it.


    OK, if I have to dot t's and cross i's, a file in plain text written with
    notepad or wordpad (ie, a letter or "text document"), without code, and saved
    with *.txt and that will only be opened with notepad or wordpad.
    Brian H¹©, Jun 26, 2003
    #14
  15. Smiley

    Smiley Guest

    > > It didn't have a double extension, I'm not stupid enough to fall for
    that -
    > > I'm a computer programmer so I know about extensions. It was a plain

    ..avi
    > > file, that's it. I need to know if a plain.avi file can be infected.

    >
    > Well if you *are* a programmer, you should know what a binary is, and what

    code
    > is, and how easy it is to insert code.


    I know exactly what code is - and programming code needs to be run as, guess
    what, a PROGRAM. Know what else? Image and video files are NOT programs,
    and they do not contain programming code. If somebody's found some way
    around that I'd be really interested in knowing how.
    Smiley, Jun 26, 2003
    #15
  16. Smiley

    Unk Guest

    On Thu, 26 Jun 2003 20:52:15 +0100, °Mike° <>
    wrote:
    >On Thu, 26 Jun 2003 20:36:00 +0100, in
    > <xWHKa.1388$>
    > Brian H¹© scrawled:
    >
    >>X-No-Archive: Yes
    >> Errrrr...erm... Smiley said:
    >>
    >>> What I've learned about viruses from college and other reading material led
    >>> me to believe that viruses could not infect .avi files. I looked it up and
    >>> found a page the further confirmed that:
    >>> http://www.custom-code-factory.com/viruses.htm
    >>>
    >>> The thing is, I was downloading a .avi file over a file sharing network when
    >>> my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >>> up:
    >>> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )
    >>>
    >>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>> detect it?

    >>
    >>I think you will find that about the only thing that can't contain a virus is a
    >>plain text file.

    >
    >Wrong:
    >


    Not quite true: See the EICAR Test String.
    http://securityresponse.symantec.com/avcenter/venc/dyn/11101.html

    True, you can't execute it, but a text file can contain the code.
    Copy and paste the below to a new text file and scan it with your antivirus
    program.

    ***** <-- omit this line
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    ***** <-- omit this line

    Unk
    Unk, Jun 26, 2003
    #16
  17. Smiley

    Slumpy Guest

    "So, Mr Slumpy you *really* are the perpetual comedian, aren't you ?" I
    threw back my head and roared with laughter as Shep© continued:

    >> Or people who expect to download an avi file, so think there's
    >> nothing wroing with downloading, say, 'this_video.avi' even though
    >> Kazaa doesn't show the actual file extension, thereby hiding the
    >> fact it really is 'this_video.avi.exe'....and by the time you've run
    >> it, too late.

    >
    > "Nail on the head" Slumpy.Right on the mark :D


    Thanks, precious :)
    --
    slumpy
    no more
    no less
    just slumpy
    Slumpy, Jun 26, 2003
    #17
  18. Smiley

    °Mike° Guest

    On Thu, 26 Jun 2003 21:08:41 +0100, in
    <apIKa.1413$>
    Brian H¹© scrawled:

    >X-No-Archive: Yes
    > Errrrr...erm... °Mike° said:
    >
    >> On Thu, 26 Jun 2003 20:58:08 +0100, in
    >> <gfIKa.1407$>
    >> Brian H¹© scrawled:
    >>
    >>> X-No-Archive: Yes
    >>> Errrrr...erm... °Mike° said:
    >>>
    >>>> On Thu, 26 Jun 2003 20:36:00 +0100, in
    >>>> <xWHKa.1388$>
    >>>> Brian H¹© scrawled:
    >>>>
    >>>>> X-No-Archive: Yes
    >>>>> Errrrr...erm... Smiley said:
    >>>>>
    >>>>>> What I've learned about viruses from college and other reading material
    >>>>>> led me to believe that viruses could not infect .avi files. I looked it
    >>>>>> up and found a page the further confirmed that:
    >>>>>> http://www.custom-code-factory.com/viruses.htm
    >>>>>>
    >>>>>> The thing is, I was downloading a .avi file over a file sharing network
    >>>>>> when my Norton Antivirus detected in it a virus called W32.HLLW.Purol
    >>>>>> (looked it up:
    >>>>>>

    >http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html
    >>>>>> )
    >>>>>>
    >>>>>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>>>>> detect it?
    >>>>>
    >>>>> I think you will find that about the only thing that can't contain a virus
    >>>>> is a plain text file.
    >>>>
    >>>> Wrong:
    >>>>
    >>>> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >>>>
    >>>> Also, javascript and HTML are (effectively) text files.
    >>>
    >>> That's why I said "plain text"

    >>
    >> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    >>
    >> THAT'S "plain text".
    >>
    >> Save it as a text file an scan it. Rename it to xxxx.com
    >> and run it.

    >
    >OK, if I have to dot t's and cross i's, a file in plain text written with
    >notepad or wordpad (ie, a letter or "text document"), without code, and saved
    >with *.txt and that will only be opened with notepad or wordpad.


    You're missing the point. The Eicar test virus is pure
    ASCII, but contains executable code - it CAN be done.

    --
    STGP, OGPE24HSHD
    °Mike°, Jun 26, 2003
    #18
  19. Smiley

    fkasner Guest

    Brian H¹© wrote:
    > X-No-Archive: Yes
    > Errrrr...erm... Smiley said:
    >
    >
    >>What I've learned about viruses from college and other reading materialled
    >>me to believe that viruses could not infect .avi files. I looked it upand
    >>found a page the further confirmed that:
    >>http://www.custom-code-factory.com/viruses.htm
    >>
    >>The thing is, I was downloading a .avi file over a file sharing networkwhen
    >>my Norton Antivirus detected in it a virus called W32.HLLW.Purol (looked it
    >>up:
    >>http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html )
    >>
    >>Could this virus infect a .avi file? And if not, why did my antivirus
    >>detect it?

    >
    >
    > I think you will find that about the only thing that can't contain a virus is a
    > plain text file.
    >
    >


    Have you taken a look at EICAR.COM ? It is not readable in any language
    that humans speak but it has a distinct virus signature and will set off
    a good virus detector. You can create a virus using ASCII characters
    from zero to 127 .
    FK
    fkasner, Jun 26, 2003
    #19
  20. Smiley

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Unk said:

    > On Thu, 26 Jun 2003 20:52:15 +0100, °Mike° <>
    > wrote:
    >> On Thu, 26 Jun 2003 20:36:00 +0100, in
    >> <xWHKa.1388$>
    >> Brian H¹© scrawled:
    >>
    >>> X-No-Archive: Yes
    >>> Errrrr...erm... Smiley said:
    >>>
    >>>> What I've learned about viruses from college and other reading material led
    >>>> me to believe that viruses could not infect .avi files. I looked it up and
    >>>> found a page the further confirmed that:
    >>>> http://www.custom-code-factory.com/viruses.htm
    >>>>
    >>>> The thing is, I was downloading a .avi file over a file sharing network
    >>>> when my Norton Antivirus detected in it a virus called W32.HLLW.Purol
    >>>> (looked it up:
    >>>> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.purol.html
    >>>> )
    >>>>
    >>>> Could this virus infect a .avi file? And if not, why did my antivirus
    >>>> detect it?
    >>>
    >>> I think you will find that about the only thing that can't contain a virus
    >>> is a plain text file.

    >>
    >> Wrong:
    >>

    >
    > Not quite true: See the EICAR Test String.
    > http://securityresponse.symantec.com/avcenter/venc/dyn/11101.html
    >
    > True, you can't execute it, but a text file can contain the code.
    > Copy and paste the below to a new text file and scan it with your antivirus
    > program.
    >
    > ***** <-- omit this line
    > X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    > ***** <-- omit this line
    >
    > Unk


    But that is *not* plain text, it is code. Plain text is what you find in
    dictionaries.
    Brian H¹©, Jun 26, 2003
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Trent

    Sobig, can it infect WITHOUT opening

    Trent, Aug 21, 2003, in forum: Computer Support
    Replies:
    0
    Views:
    486
    Trent
    Aug 21, 2003
  2. Hugh Sutherland

    LARGE AVI to smal AVI files

    Hugh Sutherland, Oct 16, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    1,817
  3. Bill R
    Replies:
    11
    Views:
    2,505
    °Mike°
    Apr 17, 2004
  4. Replies:
    0
    Views:
    2,170
  5. James
    Replies:
    0
    Views:
    489
    James
    Dec 6, 2008
Loading...

Share This Page