Search
Keyword: ms07047 windows media player 936782
This backdoor connects to a website to send and receive information. Installation This backdoor drops the following files: %Program Files%\Windows Media Player\wupdmgr32.dll %Windows%\ThankU.txt
CVE-2012-5470 libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file. nvd: Per
\SOFTWARE\Microsoft\ ALG Version = "1" Dropping Routine This Trojan drops the following files: %Program Files%\Common Files\Windows Media Player\wmpnetwk.exe %Program Files%\Common Files\Windows Media Player
%programfiles%\Windows Media Player\Network Sharing\Network Media Update.exe ,Media Network Sharing" Dropping Routine This backdoor drops the following files: %Program Files%\Windows Media Player\Network Sharing
\Software\WinRAR SFX It adds the following registry entries: HKEY_CURRENT_USER\Software\WinRAR SFX C%%Program Files%Windows Media Player = "%Program Files%\Windows Media Player" Dropping Routine This Trojan
CVE-2008-5036 Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file,
CVE-2008-3732 Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute
Explorer\NJDywt.exe %Program Files%\Windows Media Player\ovACDt.exe %System%\lpttB.exe %Program Files%\Windows Media Player\HBxtO.exe %Program Files%\Internet Explorer\NtRFuI.exe %System%\HwtaP.exe %System%
\MSNCoreFiles\OOBE\_desktop.ini %Program Files%\Online Services\_desktop.ini %Program Files%\Outlook Express\_desktop.ini %Program Files%\Uninstall Information\_desktop.ini %Program Files%\Windows Media Player
\MSNCoreFiles\OOBE\_desktop.ini %Program Files%\Online Services\_desktop.ini %Program Files%\Outlook Express\_desktop.ini %Program Files%\Uninstall Information\_desktop.ini %Program Files%\Windows Media Player
\MSNCoreFiles\OOBE\_desktop.ini %Program Files%\Online Services\_desktop.ini %Program Files%\Outlook Express\_desktop.ini %Program Files%\Uninstall Information\_desktop.ini %Program Files%\Windows Media Player
Modifications This Trojan deletes the following files: %User Profile%\Media Player\1.tmp %User Profile%\Media Player\1TMP~1.BAT (Note: %User Profile% is the current user's profile folder, which is usually C:
\Microsoft\ Windows\CurrentVersion\Run msime32.exe = "%User Profile%\Application Data\Microsoft\Media Player\DRM251\msime32.exe" Download Routine This Trojan downloads updated copies of itself from the
Files\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder,
\Software\Microsoft\ Windows\Shell\MuiCache\ %Program Files%\Windows Media Player wmplayer.exe = "Windows Media Player" HKEY_CURRENT_USER\Software\Classes\ Local Settings\Software\Microsoft\ Windows\Shell
\v4.0.30319\mscorsvw.exe %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe %System%\svchost.exe -k WerSvcGroup "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
\CurrentVersion\Run systrice = "%Program Files%\Windows Media Player\systrice.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run intdlls = "%Program Files%\Internet Explorer\intdlls.exe
\Wilbert %User Profile%\Microsoft\Media Player %User Profile%\Media Player\DRM251 (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User
Modifications This worm deletes the following files: %Program Files%\windows media player\npdrmv2.zip %Program Files%\windows media player\npds.zip (Note: %Program Files% is the default Program Files folder,
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run B9YRSna3PEM965QDqMkWn9TnUg== = "%User Profile%\Media Player\find.exe" Other System Modifications This