"Virus" on MP3 sent through MSN

[GeoNeil]

I'm having a bit of trouble sending an MP3 to a friend...

the file is http:// freespace.virgin.net/geo.neil/gunther-ding_dong_song.mp3

Firstly, I downloaded the tune through Shareaza and contacted them through MSN using Gaim, they weren't around so I uploaded it to my webspace on virgin.net with no problems (I'm aware that virgin.net have AV on their e-mail, unsure about their webspace FTP server)

When I posted the link to my friend on MSN, her PC apparently crashed.

When I sent her the file using the offical client, her PC apparently said the file was harmful. (this warning apparently came from Windows itself and her AV program)

She's using McAfee Anti-Virus.  She didn't note a name of the virus or trojan stored on the file, she apparently normally has no problems playing or downloading MP3s in this way, just with the file I sent her.

I haven't tried sending the link or the file to anyone else and am currently running a full scan on my PC using Avast (virgin.net customer services has suggested that viruses can sneak their way into JPG files, I didn't ask if their webspace FTP server filters viruses like their e-mail servers apparently do but the file did upload OK)

I'd also like to point out that the file plays fine in the following programs...

Firefox 1.0 through the Quicktime plugin
Media Player Classic (unsure of the version)

Haven't tried it in Winamp yet and as for IE and Windows Nedia Player (what I'm guessing she's using> ...I'll get back to you about that.

[GeoNeil]

OK, I've tried it in IE
IE plays the file through the Quicktime plugin, like Firefox

in Windows Media PLayer
The file plays OK

NO virus warnings at my end...

So I don't know what's going on...

[DavidR]

1. Never post an active link to a suspect file, this protects the qurious and innocent and prevents accidental clicking. Those who are curious have to do a cut and paste which can't happen by accident and can't complain if they did get infected.

Edit/Modify your post, remove the http:// or put a space after http : // this will break the link but make it obvious what the link is.

[polonus]

Hi Geo Neil,

You and your friend are to try this when MSN is slow.
Go to: http://www.directfiletransfer.tk/. tell me how your 
files go then, when you both have downloaded this file transfer program,

cheers,

polonus

[GeoNeil]

Link changed at the suggestion of a respondant

[DavidR]

OK, I tried the link using firefox (running as non-admin permissions), it took a little time to get started (dial-up) but the song started (quicktime plug-in) I didn't listen to it all, but no virus warnings.

I believe there are proof of concept about mp3s being tampered with (or designed) to open other links (something about play lists, etc. but not totally sure).
Although the concept is there I can't recall if there is anything in the wild, so I believe this may be a false positive by McAfee. Either that or it wasn't the .mp3 file that was detected but something else.

I'm not sure what you mean by official client?

When I sent her the file using the offical client, her PC apparently said the file was harmful. (this warning apparently came from Windows itself and her AV program)

Outlook Express has something in the security settings, Tools > Options > Security that may interfere. Perhaps there is something similar in the official client you talk about.

[GeoNeil]

By official client I'm guessing MSN 7.0...

the only option I can see is in Tools --> Options --> File Transfers you can state the path of a program to automatically run and scan the file (don't believe it's needed with Avast if you have the Instant Messenging scanner running, which I do, both that and the P2P scanner, these check Gaim and Shareaza but I'm not sure about MSN 7 though)

[DavidR]

I have downloaded the file using Star Downloader and no virus warnings from avast. On my HDD it opens (again no warnings) and plays ok with Windows Media Player 10.

[Staind]

Chances are the MP3 does not contain a virus: http://www.f-secure.com/hoaxes/mp3vir.shtml  as it states, there are no viruses to currently infect mp3s.  It could be a false positive from McAfee though, due to advanced heuristics - possibly?  What I would try, is suggest your friend disable mcafee, download the file, and reenable it.  It should then be able to work.  If it does not, try redownloading the song from Shareaza.

[GeoNeil]

I don't think she's going to do that, she won't even click on the link to this thread.  Would have been nice if she stated a little more about the Virus Warning, what file caused it, what virus she found.

I've posted the link to one other person who's not on this forum (roundabout the same time as I originally posted the link to my other friend) and I don't know if she clicked it or what happened, (she certainly hasn't said anything to me about it), If I see her, I'll ask her.

[GeoNeil]

Firstly, the link's dead, due to 'issues' with my current ISP, a MAC code and the new ISP not taking me on yet (and arrears with the old ISP which might be the actual reason but nevermind)

The customer services at my old ISP seem to say the same thing (possible over-sensitivity with McAfee)

The other mate who I passed the link to tried it, is running Norton AV and had no problems. 

Thanks everyone for the help and not a bad AV product, nice sound effects too!