If you have RealPlayer installed and use Internet Explorer to browse the web, beware: an exploit in circulation can allow an attacker to take complete control of your machine, Symantec is warning.

Attacks targeting the most recent version of RealNetworks' music and video player were first observed Thursday night. They exploit a vulnerability in the way RealPlayer interacts with IE, providing a stealthy means for miscreants to shoehorn their way into a user's PC.

"If you have RealPlayer installed, simply visiting a malicious Web page can put your computer at risk," a Symantec blog post (http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html) explains. "The player does not need to be running."

The ActiveX object being exploited resides in the the RealPlayer component ierpplug.dll. Attack code reviewed by Symantec causes RealPlayer to download and execute a copy of Trojan.Zonebac.

Until RealNetworks issues a patch, workarounds include:

• Set a kill bit in the Windows registry at FDC7A535-4070-4B92-A0EA-D9994BCC0DC5
• Configure IE to prompt before executing ActiveX scripts
• Configure Outlook and Outlook Express to display email in plain text or to open HTML messages in the restricted sites security zone.

Another option is to use Firefox as your primary browser, preferably along with the NoScript (http://noscript.net/) add-on. ®

Related stories

Dump IE 6 campaign runs afoul of dump IE 6 campaign (26 March 2008)
http://www.theregister.co.uk/2008/03/26/internet_explorer_six_save_developers/
Unpatched RealPlayer bug paves way for drive-by downloads (12 March 2008)
http://www.theregister.co.uk/2008/03/12/realplayer_bug/
Adobe Reader Trojan predates mystery update by two weeks (11 February 2008)
http://www.theregister.co.uk/2008/02/11/adobe_reader_exploit/
Exploit for 'extremely critical' Yahoo Jukebox vuln goes wild (5 February 2008)
http://www.theregister.co.uk/2008/02/05/yahoo_jukebox_vuln/
RealPlayer users warned over unpatched vuln (3 January 2008)
http://www.theregister.co.uk/2008/01/03/realplayer_vuln/
Gates' spontaneity highlights IE data gap (10 December 2007)
http://www.theregister.co.uk/2007/12/10/gates_ie8_fire_drill/
Microsoft to search browsers for JavaScript compatibility (1 November 2007)
http://www.theregister.co.uk/2007/11/01/internet_explorer_javascript_microsoft/
Rogue ActiveX controls menace users (24 October 2007)
http://www.theregister.co.uk/2007/10/24/activex_vulns/
Apple patches critical iTunes bug (7 September 2007)
http://www.theregister.co.uk/2007/09/07/itunes_bug_patched/
Serious security hole plugged in RealPlayer and HelixPlayer (28 June 2007)
http://www.theregister.co.uk/2007/06/28/realplayer_security_hole_plugged/
Poisoned MP4 files threaten Winamp users (2 May 2007)
http://www.theregister.co.uk/2007/05/02/winamp_0-day/
Apple patches security hole in QuickTime (2 May 2007)
http://www.theregister.co.uk/2007/05/02/apple_quicktime_patch/
Winamp exploit poses hacker risk (31 January 2006)
http://www.theregister.co.uk/2006/01/31/winamp_security_flap/
Hackers look outside Windows for flaws (28 July 2005)
http://www.theregister.co.uk/2005/07/28/sans_top_20/