Seems they have gone with our suggestion and fixed it. Versions of Audiogalaxy Satelite software pre .601W for windows held the username and password for a users account in a plain text file within the audiogalaxy directory on their system. Gain the username and password for a users acct. The mp3 is actually something else. If the user ran the mp3 directly then of course the infection would start.
Evil intruder steals password and username.
Edits download que. User runs fake mp3 which is back orifice. User gets keylogged. Goverment system not secure anymore. Web site gets defaced.