How about reading it via PHP with file_get_contents() and then send the header of (octet-stream/video) avi files (not 100% sure what it is). And then, the user would be downloading from a PHP file, and the path to the avi would never be seen.
I think it even might work with embedding it in webpages too...
~Brett
video/x-msvideo <== That is the Mime-Type
~Brett