Can a PDF file contain a virus?

gregpatterson · External Since: Jul 11, 2007 Posts: 1

I have had several unknown persons send PDF attachments with email
lately. I have a policy, if I dont recognise the name of the sender,
the email is deleted. however on occasion I will email a business and
will get a reply from an address not containing the business name but
from someone that works there. In that case, if I am expecting some
reply from a business, I will read the text portion of emails that
might be from such a source, and on several occasions what looked to
be spam was actually such a reply. However, unless I know the person,
no attachments are ever opened. Anyhow, I keep getting these PDF
files lately. My guess is that they are just advertising, but I wont
open them, and just delete them. My question is whether a PDF can
contain a virus or spyware? I know that .exe files, screen savers,
..zip and other compressed files can, and I have heard of a few
occasions where pictures can contain at least some sort of bad code.
I never heard anything about PDF's one way or the other.

Thanks for replies

Greg

Duh_OZ · External Since: Jun 09, 2007 Posts: 5

My Yahoo account has received hundreds of those attachments. Just
delete them - they are most likely advertising for stocks, medicines
and such. The PDF's are probably obfuscated so SPAM OCR engines
can't filter them out.

Charlie · External Since: Jul 11, 2007 Posts: 1

What's to keep you from doing an on-demand virus scan with your resident AV
product. It is more thorough than trying to establish unilaterally if "pdf's
contain viruses"

Charlie

wrote in message

>I have had several unknown persons send PDF attachments with email
> lately. I have a policy, if I dont recognise the name of the sender,
> the email is deleted. however on occasion I will email a business and
> will get a reply from an address not containing the business name but
> from someone that works there. In that case, if I am expecting some
> reply from a business, I will read the text portion of emails that
> might be from such a source, and on several occasions what looked to
> be spam was actually such a reply. However, unless I know the person,
> no attachments are ever opened. Anyhow, I keep getting these PDF
> files lately. My guess is that they are just advertising, but I wont
> open them, and just delete them. My question is whether a PDF can
> contain a virus or spyware? I know that .exe files, screen savers,
> .zip and other compressed files can, and I have heard of a few
> occasions where pictures can contain at least some sort of bad code.
> I never heard anything about PDF's one way or the other.
>
> Thanks for replies
>
> Greg

foghollow · External Since: May 09, 2007 Posts: 33

In article ,
gregpatterson.TakeThisOut@-invalid-.com says...
> I have had several unknown persons send PDF attachments with email
> lately. I have a policy, if I dont recognise the name of the sender,
> the email is deleted. however on occasion I will email a business and
> will get a reply from an address not containing the business name but
> from someone that works there. In that case, if I am expecting some
> reply from a business, I will read the text portion of emails that
> might be from such a source, and on several occasions what looked to
> be spam was actually such a reply. However, unless I know the person,
> no attachments are ever opened. Anyhow, I keep getting these PDF
> files lately. My guess is that they are just advertising, but I wont
> open them, and just delete them. My question is whether a PDF can
> contain a virus or spyware? I know that .exe files, screen savers,
> .zip and other compressed files can, and I have heard of a few
> occasions where pictures can contain at least some sort of bad code.
> I never heard anything about PDF's one way or the other.
>
> Thanks for replies
>
> Greg
>
Type "pdf virus" into Google and check the first hit.
--
Snob? Were I a snob, I wouldn't be talking to you.

Virus Guy · External Since: Aug 05, 2005 Posts: 452

gregpatterson.DeleteThis@-invalid-.com wrote:

> I have had several unknown persons send PDF attachments with
> email lately.

As I don't use Outlook or OE, I'll ask this question:

Does Outlook or OE render PDF attachments in the message preview pane?

Are you sure the attachments are really PDF? A file can have a .PDF
extension but internally the file is a .jpg or .gif (or .exe), etc.

Jeanette · External Since: May 29, 2007 Posts: 5

Virus Guy wrote:
> gregpatterson.DeleteThis@-invalid-.com wrote:
>
>> I have had several unknown persons send PDF attachments with
>> email lately.
>
> As I don't use Outlook or OE, I'll ask this question:
>
> Does Outlook or OE render PDF attachments in the message preview pane?
>
> Are you sure the attachments are really PDF? A file can have a .PDF
> extension but internally the file is a .jpg or .gif (or .exe), etc.

Jeanette wrote:

http://isc.sans.org/diary.html?storyid=1718

Vanguard · External Since: Feb 02, 2007 Posts: 22

wrote in message

>I have had several unknown persons send PDF attachments with email
> lately. I have a policy, if I dont recognise the name of the sender,
> the email is deleted. however on occasion I will email a business and
> will get a reply from an address not containing the business name but
> from someone that works there. In that case, if I am expecting some
> reply from a business, I will read the text portion of emails that
> might be from such a source, and on several occasions what looked to
> be spam was actually such a reply. However, unless I know the person,
> no attachments are ever opened. Anyhow, I keep getting these PDF
> files lately. My guess is that they are just advertising, but I wont
> open them, and just delete them. My question is whether a PDF can
> contain a virus or spyware? I know that .exe files, screen savers,
> .zip and other compressed files can, and I have heard of a few
> occasions where pictures can contain at least some sort of bad code.
> I never heard anything about PDF's one way or the other.

What makes you think a .pdf attachment to an e-mail must be a PDF
document? Files can be named anything.

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From:

| I have had several unknown persons send PDF attachments with email
| lately. I have a policy, if I dont recognise the name of the sender,
| the email is deleted. however on occasion I will email a business and
| will get a reply from an address not containing the business name but
| from someone that works there. In that case, if I am expecting some
| reply from a business, I will read the text portion of emails that
| might be from such a source, and on several occasions what looked to
| be spam was actually such a reply. However, unless I know the person,
| no attachments are ever opened. Anyhow, I keep getting these PDF
| files lately. My guess is that they are just advertising, but I wont
| open them, and just delete them. My question is whether a PDF can
| contain a virus or spyware? I know that .exe files, screen savers,
| .zip and other compressed files can, and I have heard of a few
| occasions where pictures can contain at least some sort of bad code.
| I never heard anything about PDF's one way or the other.
|
| Thanks for replies
|
| Greg

Can an Adobe PDF contain a virus ? No !

Can an Adobe PDF be used in an Exploitation attempt of an Adobe Reader/Acrobat vulnerability
? Yes. ( Example; Cross-Site Scripting Vulnerability )

You problem is pure spam, not a virus/malware issue.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Virus Guy · External Since: Aug 05, 2005 Posts: 452

"David H. Lipman" wrote:

> Can an Adobe PDF contain a virus ? No !

Can a PDF file (that is REALLY a PDF file) contain exploit code?

Apparently yes.

I still have no answer as to how a typical XP/Vista system handles a
PDF file other than to require a user to perform some action such as
to open it. For example, does XP/Vista generate thumbnails of PDF
files? Does Outlook or OE render PDF files automatically in preview
panes? Does XP/Vista open/examine PDF files as part of any
system-wide catalog or search activity?

frischmoutt · External Since: Jul 11, 2007 Posts: 1

"Vanguard" a écrit dans le message
nM6dnVUm-5uDqAjbnZ2dnUVZ_h6vnZ2d.RemoveThis@comcast.com...
> wrote in message
>
> >I have had several unknown persons send PDF attachments with email
> > lately. I have a policy, if I dont recognise the name of the sender,
> > the email is deleted. however on occasion I will email a business and
> > will get a reply from an address not containing the business name but
> > from someone that works there. In that case, if I am expecting some
> > reply from a business, I will read the text portion of emails that
> > might be from such a source, and on several occasions what looked to
> > be spam was actually such a reply. However, unless I know the person,
> > no attachments are ever opened. Anyhow, I keep getting these PDF
> > files lately. My guess is that they are just advertising, but I wont
> > open them, and just delete them. My question is whether a PDF can
> > contain a virus or spyware? I know that .exe files, screen savers,
> > .zip and other compressed files can, and I have heard of a few
> > occasions where pictures can contain at least some sort of bad code.
> > I never heard anything about PDF's one way or the other.
>
>
> What makes you think a .pdf attachment to an e-mail must be a PDF
> document? Files can be named anything.
>

As a personal comment, I also received a lot of these pdf files. Those files
open normally when dregged in a foxit reader window, under a protected
environment. No alarm rings. However I suspect that double clicking on such
a file would lead to different results. Am I right or wrong ?

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From: "Beauregard T. Shagnasty"

< sip >
| there were links posted
| some weeks ago about vulnerabilities in Adobe versions prior to 8. Don't
| remember the details.
|

XSS Vulnerability -->
http://xforce.iss.net/xforce/xfdb/31271
http://www.ciac.org/ciac/bulletins/r-096.shtml

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Man-wai Chang · External Since: May 28, 2006 Posts: 51

> I never heard anything about PDF's one way or the other.

That really depends on the PDF readers, in my opinion.

--
iTech Consulting Services Limited
Expert in ePOS (Point-Of-Sales) solutions
Website: http://www.itech.com.hk (IE only)
Tel: (852)2325 3883 Fax: (852)2325 8288

Virus Guy · External Since: Aug 05, 2005 Posts: 452

Man-wai Chang wrote:
>
> > I never heard anything about PDF's one way or the other.
>
> That really depends on the PDF readers, in my opinion.

Nobody has addressed my questions regarding how XP/Vista interacts
with PDF's other than the case of user-initiated file viewing.

I'm talking about auto-previewing in Outlook, OE, or IE, or thumbnail
generation as part of directory browsing, or content inspection as
part of indexing and content searching.

Does XP/Vista have some sort of native PDF handling/decoding
capability (and built-in file association) "out of the box" ? Does
the installation of a PDF file handler (like Acrobat) give XP/Vista
that capability?

I'm thinking along the lines of the animated icon situation a year or
so ago, or the vector-markup VML issue.

Char Jackson · External Since: Jun 15, 2007 Posts: 21

This message is not archived

Blayes · Joined: May 19, 2009 Posts: 1

The simple answer is no. A PDF can not be a virus. You could re designate a virus with the extension of .pdf but if you did, it would be the same as putting the virus in quarantine. Your computer would do one of two things: first..if you have adobe installed, it would attempt to open the .pdf with adobe. Adobe would not recognize the data within the file and you would get an error message. Second possibility, you do not have adobe installed, you would get a message basically telling you that your operating system does not know what the extension is (.pdf) and would ask you what you would like to do with it...as in what program to use to open it.

In short, if you dont know what a .pdf is then leave it alone. If you do and you have adobe installed then go ahead and try to view it. If you can't, then just delete it.

louis-the-cat · Joined: May 13, 2006 Posts: 307

many people create documents and convert them to pdf ( ie proper pdf format, not just a change to the name/extention), in order that when sent by email receivers will have confidence in the attachment.

If you are in the habit of receiving emails, with attachments from sources that raise your suspicions..........you might want to consider using a sandbox.