Discovered virus VLC 1.0.5.

[chimera]

The Regard. Discovered virus in new version VLC 1.0.5
Kaspersky Internet Security
Trojan.Win32.Monder.gen
C:\Program Files\VideoLAN\VLC\plugins\libi422_yuy2_sse2_plugin.dll

[Jean-Baptiste Kempf]

False positive from your AV

[Megas Alexandros]

I have exactly the same problem. Are you absolutely sure it's a false positive?

[Jaxx89]

well but KIS automatically deletes the file....so any way of avoiding that if it is a false positive......till the file gets updated by Kaspersky and the others too

Code: Select all

http://www.virustotal.com/analisis/4d41c98be2e2d82e4b50a51c92030985d452a44b6a3d4ab6def9cac1fc4900a6-1264973853

[walt3k]

I have the same problem. I am using Windows XP 32bit. I have uninstalled VLC and will not reinstall until something concrete is stated about whether this is a real virus or not. A one line statement saying "false positive from AV" is not enough.

[Jean-Baptiste Kempf]

I have the same problem. I am using Windows XP 32bit. I have uninstalled VLC and will not reinstall until something concrete is stated about whether this is a real virus or not. A one line statement saying "false positive from AV" is not enough.

VLC is compiled on a Linux Box, it is very doubtful that a virus would finish there.

Moreover, this file is heavily Assembly code, and Antivirus can find that suspicious with their automatic heuristics.

[Tyf0x]

Same for me. Waiting for a patch or something like that ... or a real confirmation about the origin of the threat

[Poirot]

Hi,

Just FYI, it's a false positive. Kaspersky LAB sent me this reply after submitting the file:

Sorry, it was a false detection. It will be fixed.

Kaspersky LAB incident ticket number available to VideoLAN developers if requested.

Regards,

[Jean-Baptiste Kempf]

Hi,

Just FYI, it's a false positive. Kaspersky LAB sent me this reply after submitting the file:

Sorry, it was a false detection. It will be fixed.

Kaspersky LAB incident ticket number available to VideoLAN developers if requested.

Regards,

Thank you a lot, can you share?

[Tyf0x]

Thx

[sunhat]

I got a virus through VLC yesterday. I was downloading my digital recordings via Windows XP. My digital recordings showed up through Realplayer as some cartoons about Bin Laden, and a photograph of a young man sitting on the sidewalk, against a wall. I discovered that my recordings in the digital recorder had been deleted, and it fact it looks like half the capacity of the digital recorder is fried. I uninstalled VLC right away, and then the VLC recordings became .mp3 recordings. These same recordings did not damage my Linux Ubuntu OS. The Linux system simply could not read them, even though they appeared to be VLC media. However no damage was caused with the Linux system. I managed to recover all my recordings at this point, but my digital recorder is damaged.

[VLC_help]

sunhat: what?

[sunhat]

@VLC help -- do you have a more specific question for me? I see that people were asking about VLC and viruses, and I wrote about the experience I had. What do you want to know?

[VLC_help]

Your post doesn't make sense. It doesn't really explain what happened, and I really doubt that regular virus could destroy any PVR or DVR device.

[sunhat]

My post makes sense, it explains exactly what happened. If you want to clarify something, please ask a question. If you would like me to shape the information differently so that it makes more sense to you, ask a question about what you need to know. Perhaps someone else would understand what I am saying.

[VLC_help]

OK. Lets do this in pieces,

I got a virus through VLC yesterday.

And you know this by how?

I was downloading my digital recordings via Windows XP. My digital recordings showed up through Realplayer as some cartoons about Bin Laden, and a photograph of a young man sitting on the sidewalk, against a wall.

I assume you mean that you downloaded some file from your PVR/DVR. I really doubt any virus would edit video files and replace them with different videos.

I discovered that my recordings in the digital recorder had been deleted, and it fact it looks like half the capacity of the digital recorder is fried.

Again, I doubt that any virus would do that.

I uninstalled VLC right away, and then the VLC recordings became .mp3 recordings.

Uninstall VLC won't do any file conversions. File icons in Windows aren't the same as file types.

These same recordings did not damage my Linux Ubuntu OS.

So now you say that the video files itself caused the damage?

What I am trying to say in here, is that the post doesn't make much sense. And it doesn't really tell what has happened.

[sunhat]

I am describing what happened the best I can. When I had downloaded my recordings, (not videos) VLC was the automatic whatever-it-is-called. The recordings had the VLC symbol beside them. I did not ask it to do that -- it took over and did it. Instead of playing recordings, pictures appeared. Cartoons. Photos. This is how I know that the computer had a virus through VLC.

If this is new information to you then it is new information. Sometimes things happen that you have not heard of before, but that doesn't make it "doubtful".

If you cannot understand what I am saying, please pass my description of events, and possible inquiry, to someone who can.

I have another resource for help with these issues and these events -- which would be my local FreeGeek organization. They will be familiar with VLC and some of these issues. If the have something helpful to say, i will probably share it here, if you are interested.

Perhaps another forum participant will recognize what I am talking about and be supported by what I am saying.

[VLC_help]

The recordings had the VLC symbol beside them.

So you mean the icon windows explorer shows was the cone symbol of VLC?

Instead of playing recordings, pictures appeared. Cartoons. Photos. This is how I know that the computer had a virus through VLC.

So when you opened one recording with VLC, it didn't display what you expected? If so, did you check from Tools -> Messages that correct file was opened?

And if you used some P2P software do download stuff, it might have allocated disk space from deleted files, which can lead to that you see content that you have already deleted.

[sunhat]

The recordings had the VLC symbol beside them.

So you mean the icon windows explorer shows was the cone symbol of VLC?

sunhat: Do you mean the windows explorer icon? Are you asking whether or not a VLC cone appears beside the windows explorer icon on the desktop? No. That would look very odd indeed, and would alert me that something weird was afoot. No I don't mean the "icon windows explorer". Are you pulling my leg?

Instead of playing recordings, pictures appeared. Cartoons. Photos. This is how I know that the computer had a virus through VLC.

So when you opened one recording with VLC, it didn't display what you expected? If so, did you check from Tools -> Messages that correct file was opened?

Sunhat: Not only did it not display what I expected, VLC could not open the files. Realplayer displayed strange pictures that were obviously not anything of mine. There was nothing possibly correct about these pictures. It was not a case of opening a wrong file. I had used the same procedure as always, which is to click the icon beside the file -- nothing more complex than that. VLC didn't open the files. This time I had to use Realplayer and there were strange pictures. Obviously a virus. I don't know what you mean about checking "Tools -- messages". Why would I do that? Are you serious? That seems like very odd thing to do. As I said, I got rid of the pictures and seemed to restore the recordings as mp3 by deleting VLC from the system. So, that is an interesting clue, isn't it?

And if you used some P2P software do download stuff, it might have allocated disk space from deleted files, which can lead to that you see content that you have already deleted.

Sunhat: What is P2P software? Why would it allocate disc space from deleted files? These pictures were not content I had already deleted -- these pictures were never anything I had downloaded or seen before. Therefore, it follows that having not seen or downloaded them before, I also did not previously delete them. And why would a VLC or any program substitute pictures for audio recordings, for any reason. That seems like an example of dysfunctional software. Not useful.

I tried playing the audio files again with Realplayer and they played normally, with no pictures as a substitute for the audio. I guess this means I have fixed part of the problem at least.

Just a short while ago I did a search for VLC remnants and found some files. I followed a path through the VLC files that led to these pictures I am speaking of. So -- I had uninstalled the VLC software but there it is still on the XP OS computer. I guess I could delete those files as well and then reconnect to the Internet as a test, to see if I am prompted to "update" the VLC again. There are probably other VLC files on the computer that I don't know how to find.

The problem seems to be with VLC, and uses Windows Picture and Fax Viewer, Adobe 3.0, Realplayer and XP OS.

I wonder if anyone else reading this will see something familiar in what I am saying.

[VLC_help]

VLC settings are stored to %appdata%\vlc folder. That includes art subfolder that might contain album art for files. Which might also explain where the pictures you saw came (so if you have download album art option enabled in VLC, the player downloads relevant images from google image search, and they might contain wrong images).

P2P software in this case means something like BitTorrent, emule etc.

[sunhat]

VLC help said -- VLC settings are stored to %appdata%\vlc folder. That includes art subfolder that might contain album art for files. Which might also explain where the pictures you saw came (so if you have download album art option enabled in VLC, the player downloads relevant images from google image search, and they might contain wrong images).

Sunhat says: I don't download albums and I had never seen these pictures before. If they were downloaded without my bidding or knowledge, that is a malware activity, isn't it? Certainly the content of the pictures makes a political message rather than a random few pictures. How would these malware pictures end up being stored in VCL software, and then substituted for audio recordings? I think just about anyone would consider that to be a malware problem, with VLC as the vehicle.


VLC help said -- P2P software in this case means something like BitTorrent, emule etc.

Sunhat says: I see, thanks for clarifying that. I don't use P2P software.

[VLC_help]

You don't have to download albums for album art. VLC will fetch image for any audio file (and maybe for some video files) you playback, if you have Album art download option enabled. It would really help, if you told us some filenames you have played with VLC (and if those files have metadata, share it also).

[sunhat]

Hmmm... thanks for trying to help -- I don't know how to supply the information about files that you are asking for. It is beyond my technical know-how. I had a discussion about this VLC issue at FreeGeek, and the fellow there explained a few things. He didn't think it was VLC that had a virus. I still think there is something weird about the set of pictures, and the fact that they temporarily replaced audio files. I know Windows Media Player is buggy, and interferes with everything, but I am tired of trying to deal with Microsoft products. I have been having trouble with Microsoft software and its endless problems for many years, and I have decided to learn more about Linux and Ubuntu and use that. I have disconnected my XP OS computer from the Internet -- I guess that will have to be the solution to the problem for now. I see that Microsoft stopped supporting its XP product as of Oct 2010, so that was a signal to me that it was time to learn about Linux. I am finding that I can understand Linux instructions -- which is a step in the right direction.

Just FYI, I happened to meet someone who used to write instructions for Microsoft software -- she said that she had to write instructions for software she had never actually seen or used, but only had descriptions of. They do things that way because of their development and marketing streams -- which may not always meet in the flesh, so to speak. That really helped me to understand why I cannot understand the various versions of Microsoft "help" files and instructions. They are probably too abstract, or written for some other version. Just sayin'. It is not likely that I would be able to give you the file information you are asking for by trying to follow Microsoft instructions on how to go about it. I know this from years of experience at failing to ever understand Microsoft instructions. In contrast, having had some success in that realm with Linux instructions -- I am not interested in Microsoft anymore.

Thanks for trying