Worm uses Real Media files to infect

Once the page is open, the worm can spread over network drives and shared files to "download whatever the (malware) author wants to download," Craig Schmugar, threat researcher with McAfee Avert Labs, told SCMagazine.com on Wednesday.

The worm initially infects a user's PC when he or she is duped into downloading an executable that scans the system for RMVB (Real Media Variable Bitrate) files to target, he said.

While McAfee has seen only localised outbreaks of the worm, particularly in the Far East of the US, users should exercise caution when playing seemingly safe video files, Schmugar said. The problem is further exacerbated by the rise of peer-to-peer file sharing.

"The notion is that most computer users might think twice in certain situations, (but) they probably don't think twice when they're playing a video," Schmugar said. "Best computing practices still hold true. Run a desktop firewall program. Run updated anti-virus software. Be careful who you share files with or where you get your files from."

A Real Networks spokesperson told SCMagazine.com today that the company was investigating the reports and was not immediately commenting.


 Click here to email Dan Kaplan.

filesinfectmediasecuritytousesworm