The scam works really simple: first, users download what they believe to be an MP3 or a Mpeg file. After the file is fully donwloaded, the user tries to play it and is greeted with a message tellign him to install an exe file dubbed “play_mp3.exe”.

Surprising as it may sound (/irony), the file in question will not bring music to your ears but adware to your Firefox broswer. According to McAfee’s Craig Schmugar:

“PlayMP3.exe from is installed, which is simply a browser control wrapped in an exe, and doesn’t actually play local MP3 files, but rather loads a webpage running the Wimpy MP3 Flash player. This page lets the user listen to a canned selection of a couple dozen songs.

In the end you’re left with a fake MP3 file taking up space, a worthless MP3 player, adware that claims not only to not display popups, but also to block them, and more adware that successfully displays popup and popunder ads.”

Some of the infected files came under the following names, so be careful about your downloading activities:

– preview-t-3545425-adult.mpg
– preview-t-3545425-changing times earth wind .mp3
– preview-t-3545425-heartbroken fast t2 ft jodie.mp3
– preview-t-3545425-paralyized by you.mp3
– preview-t-3545425-say it right remix.mp3
– preview-t-3545425-st trinnians girls aloud.mp3
– preview-t-3545425-theme godfather.mp3
– t-3545425-lion king portugues.mpg
– t-3545425-los padres de ella.mpg
– t-3545425-para sayo freestyle.mp3
– t-3545425-peanut butter jelly amende.mp3