2

I ran a full system scan this morning with all of my virus/malware programs and Avast detected 1 virus in an .avi file (which thankfully I have not yet watched):

Severity: Medium
Threat: WMA: Wimad [Susp]

I don't know what this threat specifically is but Microsoft has a page describing Wimad virus' which it says are all trojan horses which once run will download a bigger, more potent virus. http://www.microsoft.com/security/portal/threat/encyclopedia/search.aspx?query=Wimad

My question
If I were to re-encode the .avi file to .mkv through handbrake would I be left with an .mkv file containing no trojan horse?

My logic being that whiles re-encoding the file it would leave the unnecessary malicious content behind as it is not needed for the video or sound? However, I don't know whether accessing the file through handbrake will result in the trojan still being executed?

3

The "Wimad" family of trojan-horse attacks operate by using a normal feature of the "ASF" container format in an unexpected but not invalid way. Consequently, any Windows software capable of operating on these files may be vulnerable, if it uses standard Windows libraries for manipulating them. This may include Handbrake -- I don't know the details of how it operates.

The good news is that the attack is ASF-specific. If you convert the media file to use a different container format, it removes the attack.

2

I would submit that the only true way to be confident that you have removed the malicious part of the file (assuming there is a legitimate part), would be to forensically examine and disassemble the hex values of the file.

It is nearly impossible to know what type of 'virus' (or if it is indeed a virus) without a lot more details from you so the best thing for you to do would be to examine the file forensically and then extract what you want (or remove the malware). Note: you should do all of this work within an isolated Virtual Machine.

It may be possible to get the exact malware signature from your antivirus and narrow your forensic search to find and remove just that.

Alternatively, if you know the signature of the real file, you could attempt to simply remove all the extra. Knowledge of file systems will be needed here.

I would however caution against doing anything with it for yourself (unless you do actually possess the required skills). If you are just curious, then do all your work in the 'lab' (VM) and leave it there -never take it out. I'd recommend simply getting yourself a non-infected copy of the file (if possible) or if not, open it up in an isolated VM (or go to a second hand store and buy a cheap old computer and just run it there (then throw away the old pc).

Some other considerations:

  • A true examination may take a lot of time!
  • I say may because a lot of kids call themselves 'hackers' by just appending crap to the end of a file (AKA the slack space). This is very easy to detect and remove.
  • Do all work in a proper VM.

In regards to your question about if re-encoding it nullifies the virus, that simply depends on the virus. First, it is very unlikely that a virus can run from the movie file anyway but it could be stored and triggered by something else, thus the virus may actually be activated by you re-encoding the otherwise inactive file! (another reason to do this in a VM). Moreover, simply re-encoding may not remove the malicious code in any case, you just cannot know without determining the details of the virus...

  • "then throw away the old pc" o_O Isn't that a little paranoid? – endolith Nov 2 '15 at 14:35
  • It may be paranoid but its a sure fire way to be 100% sure that the analysis cannot infect your network... I admit 99% of the time it's not necessary but it's easy to do. – Matthew Peters Nov 2 '15 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.