Search
Keyword: ms07047 windows media player 936782
Files%\Outlook Express\setup50.exe %Program Files%\Outlook Express\wab.exe %Program Files%\Outlook Express\wabmig.exe %Program Files%\Windows Media Player\migrate.exe %Program Files%\Windows Media Player
LocalServiceAndNoImpersonation %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System Root% is the Windows root folder, where
\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" taskhost.exe $(Arg0) (Note: %System% is the Windows system folder, where it usually is C:
{88D0133A-EDE5-4D6C-B001-4D8A4464F9E7} S-1-5-18:NT AUTHORITY\System:Service: %All Users Profile%\Mozilla\zpjyuwl.exe %All Users Profile%\Mozilla\zpjyuwl.exe -ntinrvi "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
\mscorsvw.exe %System%\sppsvc.exe %System%\svchost.exe -k WerSvcGroup "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k NetworkService %Windows%\SysWOW64\groupfill.exe
ProxyBypass = "0" HKEY_CURRENT_USER\Software\Microsoft\ MediaPlayer\Player\Tasks\ NowPlaying InitFlags = "1" It modifies the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows Media\WMSDK
\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k WerSvcGroup %System%\svchost.exe -k netsvcs %System%\WerFault.exe -u -p 700 -s 1544 %System%\WerFault.exe -u
LocalServiceAndNoImpersonation %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\svchost.exe -k NetworkService %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %System
\v4.0.30319\mscorsvw.exe %System%\svchost.exe -k LocalServiceAndNoImpersonation %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player
\USNizoLckoTtei" /XML "%User Temp%\tmp1563.tmp" {malware file path and name} "{path}" "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k LocalServiceAndNoImpersonation %System%
%Application Data%\~SD12A.tmp %Application Data%\Microsoft\~SD12D.tmp %Application Data%\Microsoft\Media Player\~SD130.tmp %Application Data%\Microsoft\Windows Media\~SD133.tmp %Application Data%\Microsoft
LocalServiceAndNoImpersonation %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\sc.exe start w32time task_started %System%
Files%\Outlook Express\setup50.exe %Program Files%\Outlook Express\wab.exe %Program Files%\Outlook Express\wabmig.exe %Program Files%\Windows Media Player\migrate.exe %Program Files%\Windows Media Player
Files%\Outlook Express\setup50.exe %Program Files%\Outlook Express\wab.exe %Program Files%\Outlook Express\wabmig.exe %Program Files%\Windows Media Player\migrate.exe %Program Files%\Windows Media Player
\SOFTWARE\Clients\ Media\vincristinedepth\Capabilities ApplicationName = "vincristinedepth media player" This report is generated via an automated analysis system. HEUR:Trojan.Win32.Makoob.a (Kaspersky)
= "0" HKEY_CURRENT_USER\Software\Microsoft\ MediaPlayer\Player\Tasks\ NowPlaying InitFlags = "1" HKEY_CURRENT_USER\Software\Microsoft\ Windows Media\WMSDK\General ActiveLatchSet = "b" It modifies the
%User Temp%\_+_83.tmp %Program Files%\Windows Media Player\migrate.exe:Flinched %User Temp%\_+_86.tmp %Program Files%\Windows Media Player\mplayer2.exe:Flinched %User Temp%\_+_89.tmp %Program Files%
\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k WerSvcGroup %System%\svchost.exe -k NetworkService (Note: %System% is the Windows system folder, where it
/mo 1 /tn "Windows Service" /tr "%AppDataLocal%\svran.exe" /f "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k LocalServiceAndNoImpersonation %System%\svchost.exe
files: %Program Files%\Windows Media Player\npdrmv2.zip %Program Files%\Windows Media Player\npds.zip %System%\chcp.com %System%\command.com %System%\diskcomp.com %System%\diskcopy.com %System%\edit.com