Trojans Hits Media Files...

July 2008
Trojan attacks multimedia files stored on hard drives. A particularly aggressive Trojan is on the loose that infects multimedia files stored on a user’s hard drive. “We’ve not seen such a sophisticated Trojan infecting multimedia files before,” said the lead for the anti-malware team at Secure Computing, which has been studying the Trojan. “We’ve been seeing infected multimedia files for about a month now and [had been] wondering where they came from.” Like many malware infections, it starts with a visit to a suspicious website, where the user downloads what he thinks is a serial key for a copy-protected software package, for example, but instead gets the Trojan that automatically infests all of his multimedia files. When he shares one of those music or video files with another user via a peer-to-peer network, the recipient in turn gets infected by a fake codec. The Trojan basically relies on legitimate multimedia functions, meaning there are no vulnerabilities you can patch. It preys on the Advanced Systems Format (ASF) file feature in MP3 and Windows Media Audio (WMA) music files, as well as Windows Media Video (WMV) files, for instance. ASF lets you embed script commands in these file.