Virus scanning

[aoeu]

What are people's thoughts on the need to and effectiveness of virus scanning video files?

What kind of vulnerabilities exist that a virus could exploit?

Can virus scanners (e.g., clamav) reliably detect viruses in video files?

As a practical matter, would transcoding a source file to a target effectively remove the risk of a virus in the target?

Thanks

[J_Darnley]

1 - There is little need for a virus scanner at all, if you have a brain.
2 - Any bug in a player/decoder/whatever could have security issues. Most bugs are never this severe though. Then a virus would have to be written into a specially crafted video file to take advantage of this bug.
3 - I should hope yes. If you concatenated a virus-laden executable onto a video file a virus scanner should pick up on it.
4 - Yes. First there would be a decoding attempt, if this didn't fail the data of the virus would no longer exist, it would be some garbage in the video. Next, the video would be encoded again, changing that section of data again. Finally the video would be decoded again.

tl;dr: Don't worry too much about it. You should worry more about the internet-facing software you will likely use to get this possibly infected video.

[aoeu]

Thanks for your response. In addition to vulnerabilities during playback, I'm also interested in vulnerabilities that might be exploited during transcoding.

2 - Specifically, is anyone aware of any bugs in ffmpeg that could be exploited?
3 - Hope is good, but does anyone know or have actual experience with this?
4 - Does ffmpeg ever copy any metadata, unmodified, from the source to the target?

Thanks again. I appreciate your help.

[Sharktooth]

most of the vulnerabilities where in WMP and they should be fixed by now.

[Ghitulescu]

1 - There is little need for a virus scanner at all, if you have a brain

......

tl;dr: Don't worry too much about it. You should worry more about the internet-facing software you will likely use to get this possibly infected video.

Exactly, how can a regular video file infect your PC? Yes I know about Rootkits and stuff, but as J_Darnley said, a virus scanner on a PC used for video is useless, potentially dangerous even....

[Holyshit]

As a practical matter, would transcoding a source file to a target effectively remove the risk of a virus in the target?
If your original video file has been infected by virus, the target file trans-coded from that file will still have virus. So, you'd better scan virus before trans-coding.