If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? Show I'm not asking about attacks that could be made while downloading, or on browsing to a site - imagine the file has somehow been stored onto the disk with no attack taking place. What risk do I then face from malware?
 Rory Alsop♦ 61.4k12 gold badges116 silver badges321 bronze badges asked Jul 19, 2015 at 7:20
4 There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples, but other cases are sure to exist:
6 Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer. One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer. Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text search Windows will scan the files in the background and use the file parser to extract the content. A bug in the file parser can thus lead to code execution. Also, if the path is known to an attacker (i.e. inside the default download folder) opening could be enforced by embedding the file as image, flash file, PDF etc using a answered Jul 19, 2015 at 9:05
Steffen UllrichSteffen Ullrich 187k29 gold badges365 silver badges427 bronze badges 2 Autorun applies mostly to external drives connected to the machine, less to downloaded files. If you do not execute the downloaded file, in theory you should be safe. However, practically, your computer may open it itself for your convenience and without asking your approval, whether it is to generate some kind of thumbnail or preview of the document, to index it for file search application, etc. For instance, you will find here an example of exploit affecting older Windows Media Player software: no need to open the file, simply browsing to the directory containing the file is sufficient to execute the malware... answered Jul 19, 2015 at 8:12
WhiteWinterWolfWhiteWinterWolf 19.1k4 gold badges59 silver badges105 bronze badges It depends on the type of virus you may have downloaded.
answered Jul 19, 2015 at 7:43 5 The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data. Image a piece of malware that targeted a known vulnerability in your antivirus software, or your spam filtering software. answered Jul 23, 2015 at 20:11
ddyerddyer 1,9741 gold badge12 silver badges20 bronze badges Can you get a virus by downloading a file?Malware can get onto your device when you open or download attachments or files, or visit a scammy website. Your device might get infected with malware through: downloading free stuff like illegal downloads of popular movies, TV shows, or games.
Can you get a virus from downloading a file but not running it?The straight-up, scary truth is yes, in some cases simple downloading a malicious file to your computer may be enough to become infected. In fact, it is theoretically possible to become infected simply by receiving an email with a malicious attachment, even if you don't open or read the email!
|
