A new type of Trojan horse malware application is hiding inside fake MP3 media files, infecting approximately 500,000 consumer PCs, McAfee Avert Labs reported. The nefarious files have been delivered primarily on peer-to-peer networks during the last several days. The trojan, known as "Downloader-UA.h," was added to McAfee's DAT files about a week ago. Since then, McAfee VirusScan Online users have reported the half-million detections. The trojan hides in fake music and video files and is associated with fastmp3player.com. "When a user attempts to load one of these MP3 and MPG files, they don't get the music/video they were hoping for; instead, they're directed to download a file named 'PLAY_MP3.exe,'" reports Craig Schmugar, a researcher for McAfee Avert Labs, on the Avert Labs blog. "In fact, the MP3/MPG file they downloaded was completely fake, playing no media clip whatsoever." Infected users receive an offer that purportedly will let them listen to free MP3s. They must agree to an End User License Agreement (EULA), which installs an ad-supported application. "In the end you're left with a fake MP3 file taking up space, a worthless MP3 player, adware that claims not only to not display popups, but also to block them, and more adware that successfully displays popup and popunder ads," Schmugar reports. Thus far, operators of just 10 percent of the 500,000-plus systems with the trojan on their PCs have gone so far as to agree to the EULA and download the adware installer.

There are no comments to this entry.