Unzip - Viruses?

[Fruit2O]

I have a file given to me by a friend - but I am leary of opening it
for fear of getting a virus. Am I justified? What if I open it and
run it through my anti-virus program? If it passes, would that assure
safety? If not, is there another way to check the contents of the zip
file for possible malware?

 

[David H. Lipman]

From: "Fruit2O" <[email protected]>

| I have a file given to me by a friend - but I am leary of opening it
| for fear of getting a virus. Am I justified? What if I open it and
| run it through my anti-virus program? If it passes, would that assure
| safety? If not, is there another way to check the contents of the zip
| file for possible malware?

Submit a sample to Virus Total -- http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it if it is malicious.

 

[Rube Bumpkin]

I have a file given to me by a friend - but I am leary of opening it
for fear of getting a virus. Am I justified? What if I open it and
run it through my anti-virus program? If it passes, would that assure
safety? If not, is there another way to check the contents of the zip
file for possible malware?

Let's see...

- You could scan it with your Antivirus software. Most have a
right-click option of 'Scan this file...' or something similar. When I
right-click, I can scan with Antivir.

- You could scan it with your anti-malware software. Most have the same
sort of option. When I right-click, I can scan with SuperAntiSpyware or
Malwarebytes

- You could submit it to VirusTotal (www.virustotal.com) and test it
against multiple scanners at once.

RB

 

[FromTheRafters]

I have a file given to me by a friend - but I am leary of opening it
for fear of getting a virus. Am I justified?

Yes, very much so. Contrary to the popular refrain "...and I don't open
files from strangers" - much malware comes (or appears to come) from
those you *do* know and trust.

What if I open it and run it through my anti-virus program?

From a general security standpoint, if you didn't request it - delete
it. If you really *do* want it, then you should have it scanned for
malware some days after you receive it (cooling off - trying to avoid
day zero malware) by several scanners.

If it passes, would that assure safety?

No, only the first option assures safety.

If not, is there another way to check the contents of the zip
file for possible malware?

Old school - unzip and scan the resulting files. Now, most scanners are
capable of extracting the files for you when you scan the archive
itself.

....and as an aside, some malware has attacked vulnerabilities in the
implementation of that very feature.

 

[FromTheRafters]

Get yourself Sandboxie and run all your operations there to start
with.

Not a bad idea, I used to use a registry change tracker like InControl
on an isolated machine - not perfect, but better than running unknowns
on my online machine.

 

[ASCII]

Not a bad idea, I used to use a registry change tracker like InControl
on an isolated machine - not perfect, but better than running unknowns
on my online machine.

The registry change monitor is OK as long as you have enough functionality to
run it, whereas Sandboxie prevents a loss of this functionality.

 

[russg]

I have a file given to me by a friend - but I am leary of opening it
for fear of getting a virus.  Am I justified?  What if I open it and
run it through my anti-virus program?  If it passes, would that assure
safety?  If not, is there another way to check the contents of the zip
file for possible malware?

If it is a .zip file, you could use powerarchiver (free) to see the
names of the files inside the zip.
Virustotal may be able to identify virus in a zip. If it is a self-
extracting .exe file, don't open it
until you submit it to Virustotal (there are other multi-checking
sites.) You should be
wary of anything you aren't sure of, such as the friend's file. If
the file is a .zip and
powerarchiver shows a folder or only one file, then you could unzip it
and submit
the resulting file to Virustotal. Using Virustotal on a single file
is easier and probably
more up-to-date than your AV software.