All about infected files

General Topics
1

Hi, if a file (such as a picture, music, video, document, etc.) is infected, and it’s uploaded to a email account or cloud service like Google Drive, OneDrive or the likes, can it infect other files that are already in that account or particular folder?

P.S. I’m wondering how it’s possible for a document or media file to be infected anyway (as t’s not a DLL or Executable), is it possible for such a file to have secret malware/spyware/virus/whatever in it somehow?

Thank you in advance!

2

For a file to infect another first it has to be a virus (not just malware) then it would have to be a file infecter (usually other .exe files), it would have to be run. Given that these locations that you mention they aren’t normal operating system locations, which would essentially be required to run them.

So the risk of infection is low, I would never say no risk.

3
Hi, if a file (such as a picture, music, video, document, etc.) is infected, and it's uploaded to a email account or cloud service like Google Drive, OneDrive or the likes, can it infect other files that are already in that account or particular folder?
No
P.S. I'm wondering how it's possible for a document or media file to be infected anyway (as t's not a DLL or Executable), is it possible for such a file to have secret malware/spyware/virus/whatever in it somehow?
https://www.opswat.com/blog/can-video-file-contain-virus https://nakedsecurity.sophos.com/2014/07/07/remember-macro-viruses-infected-word-and-excel-files-theyre-back/ https://nakedsecurity.sophos.com/2012/07/17/adobe-reader-vulnerability-pdf-malware-video/
4

IMHO, in the cloud no. If you download it to your system, that’s a different story.

5

Thanks to all of you.

So if I understand the video article correctly, playing a media file on a PC (not streaming from the web) could still link to a malicious URL if it’s embedded in the video/audio file?

Also, when I scan a file with Avast and it comes out clean, I assume it has none of the things mentioned in the articles above, correct?

6
Also, when I scan a file with Avast and it comes out clean, I assume it has none of the things mentioned in the articles above, correct?
no security program have 100% detection or zero false positives

suspicious file(s) can be uploaded and tested at multi engine scanners like these www.virustotal.com / www.metascan-online.com

7

The first thing to realize that on the internet as in life, one should never assume anything. :slight_smile:

8

So if I understand the video article correctly, playing a media file on a PC (not streaming from the web) could still link to a malicious URL if it’s embedded in the video/audio file?

9

Yes, that is correct.

10

Aside from scanning a file with AV, is there any way to check for embedded content in the file itself somehow?

Also, what if I scan files with Avast, MBAM and SAS, can I rest assured then?

11
Aside from scanning a file with AV, is there any way to check for embedded content in the file itself somehow?
Yes you can if you have programming knowledge. Decompile the file and look at the source code.
Also, what if I scan files with Avast, MBAM and SAS, can I rest assured then?
No, since there is no tool that can detect every thread. Besides that, it is like with human diseases. First there is the disease and later there will (hopefully) be a cure for it. It is not possible to develop a cure for something that is not known to exist.
12

Thanks.

So even if someone opens a infected file in a email/cloud account, it can’t infect other files on that email/cloud account?

13

as far as i know you have to download it to your computer before you can open/run a file

all the big e-mail vendors have virus scan on there mail servers
Gmail use postini spam virusfilter with two AV engines from McAfee / Authentium
Hotmail (outlook) use TrendMicro
Yahoo use Norton
Many use ClamAV … probably because it is free/open source

you can check suspicious file(s) mail attachments here www.virustotal.com / www.metascan-online.com if tested before, click rescan for a fresh result

14

Now you are changing the terms of the original question that I answered and that you now quote as a reference.

Your media player is on your system, clicking on a media file in a remote location would trigger the media player to run and play it, this should also trigger avast to scan the media file. But again the other files on the remote location would remain at a low risk of infection as the media file isn’t a virus (file infecter) but malware.

15

I didn’t mean to do that, I only wanted to build on your statement for my follow-up question (not challenge).

It doesn’t use the computer’s media player, but rather Google’s (or something else). And I didn’t realize that Avast scans every video/file opened online, good to know.

Than by the same logic, a infected file played on a local computer, also can’t infect anything else since it’s not a virus.
In other words, how is playing a video or opening a file in the cloud safer for it’s neighboring files (and the computer) than the same situation only on a local computer?

16

There is no difference malware is malware played, see also: http://www.techrepublic.com/blog/it-security/dropsmack-using-dropbox-to-steal-files-and-deliver-malware/
The cloud should not be inherently safer for your example.
Anyways a pre-scan is your best bet.

polonus

17

How do you submit a file on Google Drive to virustotal.com? You submit the URL after you click on said file (which will make VR scan just that video but not the general website it’s on)?

18

First you need to make sure that the link to that file is sharable.
If only you have access, then it can’t be scanned by virustotal or any one else.

19

or you download and save the file on your computer (dont run it) then upload to Virustotal or Metascan

20

Or even more secure never even download just download to be pre-scanned by Meta-scan extension in a browser running sandboxie and then choose to do not restore the file. The scan results will give you an indication of what is there.

polonus
P.S. The scan extension resides here: you should give the link to metascan for chrome
https://chrome.google.com/webstore/detail/metascan-online-for-chrom/fjampemfhdfmangifafmianhokmpjbcj

there is also a VT uploader
https://www.virustotal.com/nb/documentation/desktop-applications/virustotal-uploader

Thanks to pondus for reminding me…

Damian