hello !

i recently dl some midi rar archives. after extracting i ran an antivirus check in their folders and it sometimes happened that a virus alert occured.
are those false reports ?
can a midi file actually get infected and would this makes any sence ?

regards

 

Hi!

No. A midi file cannot run/ execute, and as far as I'm aware, no midi capable program will use midi for scripting. So no program should try to execute a script if it is written in a midi file.

 

rar or any type of compressed arquives can contain virus. If you have an rar extractor software that can show you the content of the rar before it unrars the archive, it's better. It's possible that the rar contains other file types. As above writen mid files are not executable.

 

Something to read, not sure if this will shed any light to your question.

http://forum.cakewalk.com/Can-MIDI-mid-files-have-a-virus-m3803766.aspx

http://websites.umich.edu/~archive/atari/Music/midivirs.doc

 

Theoretically, a MIDI file could contain invalid data that certain programs may be vulnerable to. A crashing or misbehaving program always has the potential to be exploited by an attack.

 

thanks so far. so it has to be false reports avg av.
i wonder why their algorhythm gets triggered.

@the robot funny thing your 2nd link, firefox denies to download that doc. virus are everywhere

 

Its just a 1990 txt file.

 

It's not just a 1990's text file that is incorrect. And yes it can contain arbitrary code that could lead to system calls if the player or daw misinterprets that information

Standard MIDI files are in binary so yes a binary code execution could be used however since the end information is instruments settings, banks, notes data etc. no virus could ever be made with midi files. This would have to be an unknown Daw bug that reads the midi files like an execute command which I have never seen in decades.

 

https://www.virustotal.com/gui/

you will find that Kaspersky and ESET are usually the best AV when it comes to not poiting false positives

 

@Dan Fuerth The midivirs.doc is a text file

 

every virus scanning software is very prone to false positives, which is why virustotal, which will show you the results of 20+ scanners, is useful. unless you're still running DOS as your main OS, I wouldn't worry about any viruses that'd accompany a midi file

if you've somehow gotten midi archies that contain exe files in them, you should probably be wary of those

 

Also, check the "weight" of the files, if some seems to be unusually heavy, it may contain obfuscated code.

 

A bit unrelated but .doc file is a formatted text that can contain macro codes, therefore can be harmful if it's opened in Word that has macro function enabled.

 

in midi files? not worth it.

in a setup is debatable, but in midi files I would pass

 

No a virus can NOT run in a .mid file, however I have received a file from a guy who was jealous that his client was leaving his studio for mine. The client went to him to obtain his .mid files of his music and the guy included a virus amongst the .mid files. When my antivirus alert went off I couldn't believe it. I went over each and every .mid file individually and found that one was not an actual .mid file but a .wrd file for Microsoft Office word document. See the virus can execute from a word document. What he did was change the extension.
So double check the size of the .mid files individually. Most .mid files were around 32K 104K but this Microsoft document was about400K - 750K or more.

 

Now that is the interesting part. A file with the wrong extension. BUT if I'm not mistaken, in Windows you can't inadvertently open a .mid file as a word document when you double click on it because the system associates the file based on its written extension. On MacOS you can decide, when you change the extension suffix at the end of the filename, if you want the system to keep on treating it as the original extension or the new one. However, in this case you can see the associated file type in its column in Finder. It doesn't mean that it's the real type. Many times has happened that migrating files from Windows it had lost its file type and appeared on mac as an undefined document and you had to manually change its extension or sometimes could just try to open it in the respective program without defining the extension in the name (I don't remember if it worked, though).

So, basically, a .mid file can be caught by antivirus software as infected but won't do any harm if you use it as a .mid file in a respective audio software

 

True.... But, I never double clicked on it. I simply looked at the file size & recognized it was much larger than all the other .mid files.
One can change the extension at the end of a file.
However trying to use that file with the wrong extension does not always work. NO!