Can a virus be stored in a ....

dfs4 · 02 Jul 2010

an mp3 file? I downloaded an mp3 file (30mb big) from rapidshare. And just when I opened the download folder and I don't remember if the downloading had finished it or not and I saw a .dat file appear and then disappear(thought it must be related to when download is finished). I also don't remember whether I had clicked it or not that might have triggered the .dat file to appear and then disappear, it all happened quickly. I thought it must have been a virus or a rootkit or something. Ran a housecall trend micro online scan, and it detected a 'gecko~crash' rootkit. Fixed it. Checked google and 'gecko~crash' is some flash-firefox related thing. No idea what it is.

So, is it possible to store a rootkit/virus in an mp3 file?
was the .dat file there indication of a virus or what?
also is 'gecko~crash' some firefox related thing or was it really a rootkit? thanks in advance.

AlexRD · 02 Jul 2010

dfs said:

an mp3 file? I downloaded an mp3 file (30mb big) from rapidshare. And just when I opened the download folder and I don't remember whether it was before, at or after clicking it that I saw a .dat file appear and then disappear. I thought it must have been a virus or a rootkit or something. Ran a housecall trend micro online scan, and it detected a 'gecko~crash' rootkit. Fixed it. Checked google and 'gecko~crash' is some flash-firefox related thing. No idea what it is.

So, is it possible to store a rootkit/virus in an mp3 file?
was the .dat file there indication of a virus or what?
also is 'gecko~crash' some firefox related thing or was it really a rootkit? thanks in advance.

If i remember it correctly, there is.
Some file merging process. I remember there was a way to store it in a JPG Image.

Dwarf · 02 Jul 2010

Hi dfs,

It is perfectly possible for files of any type to be infected with malware. The most common are files using the .dll, .exe, and .scr extensions, but that certainly does not preclude the infection of files of other filetypes with malware.

fishnbanjo · 02 Jul 2010

There have been MP3 virus' found on iPod's but nothing on PC's, MAC's or within Linux, however, if you download MP3's from you iPod which were downloaded and infected it may be possible.

AlexRD · 02 Jul 2010

They can be stored in the codec section

madtownidiot · 02 Jul 2010

MP3s from legitimate sources aren't going to have viruses in them. nuff said

Product FRED · 02 Jul 2010

Yes, they pretend to be other files, when really they're not. Scan with Malwarebytes' Anti-malware. You're probably infected.

fseal · 02 Jul 2010

When downloading files they are ususaly downloaded to a temp file first. Then only copied to the final name/location when it's finished. This prevents users or other programs from trying to acess the file until it has completely finished downloading. So it's entirely possible that what you saw was the very last bit of the copy from the .dat temp file to the .mp3 file, then the .dat was deleted.

As for the virus, have you tried scanning the mp3 itself?

You may have had the virus for some time but only found it becuase you got a little paniced at the .dat file thing which I'm betting was actually harmless.

gregrocker · 02 Jul 2010

Always rightclick all downloads to scan with your AV. Save them to your desktop to remind you to do this before you put them in the Downloads folder in case you need to reinstall.

A Guy · 02 Jul 2010

It is possible, but unlikely. If it had a double extension, and you don't have your PC set to display all extensions, and you clicked on the file...but then, it wouldn't actually BE an mp3 file. If someone had knowledge of how a media player works, down to the bare code, presumably they could wrap a virus with the mp3, and it would play for a while, then crash the player. This is within the realm of possibility, but very unlikely, as the things they would be able to do from that point would no doubt be severely limited.

A Guy