Search
Keyword: ms07047 windows media player 936782
%System%\cmd.ivr %Program Files%\Windows Media Player\wmplayer.ivr %System%\notepad.ivr %System%\mobsync.ivr %System%\tourstart.ivr %Program Files%\Internet Explorer\IEXPLORE.ivr %Program Files%\Outlook
\Media Player\taskkill.exe" Other System Modifications This backdoor adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\ Zones\3 2500 = "3
%System%\cmd.ivr %Program Files%\Windows Media Player\wmplayer.ivr %System%\notepad.ivr %System%\mobsync.ivr %System%\tourstart.ivr %Program Files%\Internet Explorer\IEXPLORE.ivr %Program Files%\Outlook
%System%\cmd.ivr %Program Files%\Windows Media Player\wmplayer.ivr %System%\notepad.ivr %System%\mobsync.ivr %System%\tourstart.ivr %Program Files%\Internet Explorer\IEXPLORE.ivr %Program Files%\Outlook
\Microsoft\Framework\v3.5\RedistList\_desktop.ini %Program Files%\Uninstall Information\_desktop.ini %Program Files%\Windows Media Player\_desktop.ini %Program Files%\Windows Media Player\Icons\_desktop.ini
\Microsoft\Framework\v3.5\RedistList\_desktop.ini %Program Files%\Uninstall Information\_desktop.ini %Program Files%\Windows Media Player\_desktop.ini %Program Files%\Windows Media Player\Icons\_desktop.ini
itself into the affected system and executes them: %Program Files%\Windows Media Player\{random character}\{random character}\{random character}\{random character}\{random character}\{random character}\
\new.exe %Program Files%\Outlook Express\new.exe %Program Files%\Windows Media Player\new.exe %Windows%\new.exe %Program Files%\Internet Explorer\new.exe %Program Files%\Common Files\Microsoft Shared\MSInfo
Modifications This worm modifies the following files: %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD (Note: %Application Data% is the current
= "0" HKEY_CURRENT_USER\Software\Microsoft\ MediaPlayer\Player\Tasks\ NowPlaying InitFlags = "1" It modifies the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows Media\WMSDK
\Microsoft\Windows Media\9.0\WMSDKNS.XML %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and
\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it
%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is
\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows
\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows
\Microsoft\ MediaPlayer\Player\Tasks\ NowPlaying InitFlags = 1 It modifies the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows Media\WMSDK\Namespace LocalBase = "%Application Data%
%System%\sppsvc.exe %System%\lsass.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows
security update addresses a vulnerability in DirectShow and a vulnerability in Windows Media Player and Windows Media Center . An attacker could execute arbitrary code if a user opens a specially crafted
%\Application Data\TeamViewer %User Profile%\TeamViewer\{4D9EFC96-479C-468D-B090-DC182CE5E5DF} %User Profile%\Application Data\Media Player Classic %User Profile%\Media Player Classic\
Dropping Routine This Trojan drops the following files: %System%\HelpMe.exe %User Temp%\?wpl version=1.0?smil head meta name=Generator content=Microsoft Windows Media Player -- 9.0.0.2773/ titleFavorites --