Markus

Hello all.

Ok, this is going to sound like a really stupid question, but myself, my tech directory, another co-worker, and my MD were sitting down having a few beers, we were mentioning the shared music drive we had on our (protected behind a firewall) server. The MD went a bit loopy when he found out, going on about viruses, etc.

Most of the music had come from CD's that I, or other staff members had owned, ok, so not legal, but, no virus infected. However, one ex co-worker had used kazza to download music, and, being honest here, I've downloaded all of, ooh, 10 songs using limewire (on a mac I hasten to add)

I said that the server is scanned daily for viruses, and since the firewall has gone up, no viruses. no-one is using kazza, it's only me using limewire, and as said, it's used maybe once in a blue moon.

He still went on and on, claiming all the downloaded mp3's would be infected, and even the tech director said it was quite possible. I rolled my eyes at this point and asked the both of them (my MD does know a fair bit about computing, he used to have his own consultancy firm) how exactly a data file could act as a virus. I've played every tune I've downloaded, and they all play fine.

My understanding is that a virus is usually an executable file, and unless I'm really thick, mp3's are not executable files, just data files, you use a player to play them.

So, what's the point of the post? Well, can some of you people out there tell me if I'm correct, that there is basically no possibility for a mp3 data file to contain a virus as it's a data file not an executable. Or am I really thick? I've worked with macs and pc's for over 12 years now (am tech support, plus I do manage the network here, and have done the odd bit of consulting as well) and think I'm pretty savvy when it comes to things like this.

Bottom line is that I want to be able to tell the tech director and the manager that they are wrong. The TD is a programmer, so I was kinda shocked about his comments on this.

so, comments please.

Fatman

Sorry to be the bearer of bad news, but IIRC it is possible for MP3s to be used maliciously. I don't remember the exact details, but I kind of recall an exploit using a malforded ID3 tag to manipulate vulnerabilities in media programs. Try googling for "malicious ID3 tag" or "malformed ID3 tag".

sti555

suppose it's poss to inflate a virus to mp3 size, self exe too, regardless of file type, abilty to change itself from anything to .bat .exe etc... I'm pretty sure you can bind virus/trojans to almost any type of file too, image, txt, so .mp3 data file should be no different.

Have a look on here for more info, as long as your all upto date on your ms patchs/av & carry out regular daily scans it's unlikley you will have any problems..

Tell your MD to worry more about incoming emails & attachments, file sharing is less risk in comparison, see if this diversion works! lol!

Markus

well, as said, we are daily scanned, as are the servers, the only person who has downloaded any files is me, and they won't infect my machine as it's a mac, plus they get scanned anyway.

I've just run NAV and Solo over the shared folder and guess what, out of 1400 files, not one single file is infected.