Can MPG or AVI files contain malware?

If I download MPG and AVI files and play them with VLC, can I get infected with malware?

 

well idk if the file itself can infect u, but i have had instances wer its required me to download a "codec" which seems to be a malicious one.

 

I am pretty sure that those files can contain malware but they cannot execute it. They could however be embedded with a link to a malicious website.

 

Not only those but even image files. They can contain embedded code or exploit that will download and execute malwares. If you are using a vulnerable software, not updated or having zero day vulnerabilities with POC published, then there's a possiblity.

As for the frequency of such attacks, that's another question.
As always, the security advice to update your softwares like your media players is a good one.

You need not be paranoid if you have a default deny policy in place. I myself is still using oldversion media players with lots of exploits published in the wild. Never have an instance where a dropper was installed or anything as I observed any activity in a sandbox environment with logging by HIPS in place. BTW, I am not using any anti-virus or any scanner. And I go into pron sites and download stuff here and there.

If you are using sandboxie, you may need to look at this... https://www.wilderssecurity.com/showthread.php?t=251947

 

Yes you could.

Here are some scenarios:
a) buffer overflow exploit - for example see http://securityvulns.com/Fnews711.html
b) malicious script if the file format can contain scripts - for example see http://support.microsoft.com/kb/828026
c) malicious code if the file format can execute code - for example see http://secunia.com/advisories/18255/