Nowdays social engineering does not work as well as it used to work before, so the worm's spreading is quite limited as many users do not run unknown files that they receive in emails. The worm does not use Iframe exploit to run its file automatically on recipients' systems. The message body can also contain a random text file that the worm found on an infected hard drive. There can be several copies of the worm attached to the same email. The worm is attached to the infected message as ILLEGAL.EXE or ILLEGALSEX.ZIP file. Is mplayer.
Yahoo! Finance - Get real-time stock quotesįorwarded Message [ Save to my Yahoo! Briefcase
#MPLAYER VIRUS DOWNLOAD#
The infected message usually looks like that:įrom: [user's email or Fw: Crazy illegal sex ! I tried to download something and accidentally acquired a BHO virus. You can play videos in app or on cast device. Then the worm gets user's email address and SMTP server name, logs into the server and sends itself out to all found email addresses. MPlayer is best video player with amazing features. I just found mplayers -nocache might be required when using a fifo file for USB Audio devices leading to buffer under-runs. The worm searches HTM and HTML files on an infected hard drive for email addresses and stores them in MMAILS.DLL file. Hidden Power's gonna b there wherever u r No Peace Without war,i hate war but im forced to love it, SMPlayer is a front-end for the mighty open source MPlayer. When the counter value reaches 5, the worm deletes all files on drives D:, E:, F: and G. This counter is incremented every time the worm runs.
The worm also creates a counter in the following Registry key: The autostart Registry key is created for this MPLAYER.EXE file: The main worm's file MPLAYER.EXE is written in Visual Basic and compressed with UPX, it makes itself hidden when run. SMTP.OCX - standard Microsoft's SMTP control for Visual Basic
Then the worm installs itself into Windows System folder as:
0 kommentar(er)
