Now attackers are using media files like mp3, mpg and other format of media files to inject Trojan and other malicious software’s into the victim computers. Some days back infected mp3 files are spread over the Internet by some peer to peer networks. After downloading the media file, which can be of either MP3 or MPG form, when users try to play it, they will be prompted to download a file dubbed “PLAY_MP3.exe”. Victims should realize that the downloaded “music” or “video” file is actually fake and that no media file would be rendered. McAfee users will be fully protected of this Trojan horse after a virus definitions update. If you come in contact with any of these files, the McAfee Antivirus will recognize it as a Trojan horse dubbed Downloader-UA.h.

McAfee has published a list of sample files that are infected with the respective Trojan. The list can be found on McAfee’s website along with the general way the Trojan horse works. The fake file names can be recognized by this form: preview-t-3545425-adult.mpg, t-3545425-bentley bizzle.mp3, t-3545425-stare at sun thrice.mp3.

McAfee researcher Craig Schmugar Said

particularly interested in the complexity of this scheme. Running the “PLAY_MP3.exe” will bring up a 4800-words EULA which would require users to agree to it in order to proceed to the next step. After the OK button is pressed, the Trojan horse will install two applications, Mirar and NetNucleus, on the users’ PCs. The Mirar program is displayed in a normal window, while NetNucleus comes in the form of a popup.

Share