3

I have retrieved some old pictures/videos (mp4, many types of avi) of some old events that I want to keep, the problem is that these files have been sitting in confirmed infected machine for a very long time, and noone ever bothered to check what type of malware it was they just backed up and nuked it. My question now is what should be done with these files?

To clarify the files had been on both windows machines and linux server which have been confirmed to be rooted. My desktop is running linux so if you suggest any software please make sure its compatible.

Improve this question

6 Answers 6

Reset to default
7

Media files should be relatively safe, because they usually don't contain any executable code.

There have been a few exploits in the past which caused specific media players/viewers to do unwanted stuff when opening an especially crafted file. But...

  1. these exploits usually target very obscure formats which often aren't properly tested and
  2. when you keep your software (including video and audio codecs) up to date, they are unlikely to be vulnerable to an exploit used by a malware several months ago.

So when you only copy media files with well-known formats, it is very unlikely to get infected.

Improve this answer
4

What you could do is use a anti-virus LiveCD, boot from that and scan the drive with the suspect files.

Alternatively, you could upload files to VirusTotal, but that is a one-by-one scenario.

Improve this answer
1
  • You should know that VirusTotal is hosted by Google, and checks the file against 40 antivirus scanners. If none of them finds a problem, you can be pretty sure that it's clear.
    – SPRBRN
    Jul 4, 2014 at 8:01
0

Be careful. Check out this answer. Please note that there is malware which will not be detected by anti-virus programs, malware that will infect BIOS and firmware rather than OS.

Improve this answer
0

@OP I may have TL;DR too much, sorry but hope it helps anyway:

This is what your antivirus software's quarantine was designed for. If you can't trust that you can always 7z the files under high compression with a password(password to keep the idiots from extracting it)

I use the 7zip method all the time, usually, I change the file extensions before zipping like so:

virus.exe

virus.exe.disabled

I specifically use 7zip because it is open source and I have faith that it has no buffer overflow exploits.

Improve this answer
0

The best solution is a mix of what everyone has already mentioned.

  1. Encrypt all suspect files to prevent any accidental infection
  2. Create a disposable vm
  3. Move suspect files into vm, decrypt, upload to virus total to scan, then convert video with a command line converter, one at a time.
  4. Repeat the whole process on another disposable vm, just to be safe and perhaps use a different video converter this time
Improve this answer
-1

Additionally to what @shroeder and @Philipp have said you could run them through a Video-Converter. As converters write completely new files that that comply exactly to the format that should eliminate eny off-spec data from the files.

Improve this answer
3
  • That assumes that the video converter itself isn't vulnerable.
    – Philipp
    Jul 4, 2014 at 11:21
  • Correct. But i highly doubt that a virus aimed at (a specific) video-player(s) would also fool a converter.
    – marstato
    Jul 4, 2014 at 19:00
  • 1
    @marsato But it wouldn't be unlikely that an exploit targets a specific video decoder. On windows, both media players and media converters usually use the same video decoders, so they would be equally vulnerable.
    – Philipp
    Jul 4, 2014 at 22:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .