Malicious Trojan infects Windows Media Player

vnunet ^ | 11 Jan 2005 | Robert Jaques

[holymoly]

Downloads malicious application when video files are run

Security experts have intercepted two malicious Trojans hidden in video files that download and install spyware, diallers and computer viruses when played in Microsoft Windows Media player.

PandaLabs warned that Trj/WmvDownloader.A and Trj/WmvDownloader.B, are spreading through P2P networks hidden in video files. These Trojans take advantage of technology incorporated in Microsoft Windows Media player called Windows Media Digital Rights Management (DRM), designed to protect the intellectual property rights of multimedia content.

When a user tries to play a protected Windows media file, this technology demands a valid licence. If the license is not stored on the computer, the application will look for it on the internet, so that the user can acquire it directly or buy it. This technology is incorporated through the Windows XP Service Pack 2 + Windows Media Player 10 update.

The video files infected by these Trojans have a .wmv extension and are protected by licences, supposedly issued by the companies overpeer (for Trj/WmvDownloader.A), or protectedmedia (for Trj/WmvDownloader.B).

If the user runs a video file that is infected by one of these Trojans, the files pretend to download the corresponding licence. However, what they actually do is redirect the user to other internet addresses from which they download adware, spyware, diallers (applications that dial-up high rate toll numbers) and viruses, security experts at PandaLabs said.

Below are some examples of the malicious programs and viruses these Trojans download:

Adware/Funweb
Adware/MydailyHoroscope
Adware/MyWay
Adware/MyWebSearch
Adware/Nsupdate
Adware/PowerScan
Adware/Twain-Tech
Dialler Generic
Dialer.NO
Spyware.AdClicker
Spyware/BetterInet
Spyware/ISTbar
Trj/Downloader.GK

"Even though these Trojans have been detected in video files with extremely variable names which can be downloaded through P2P networks like KaZaA or eMule, bear in mind that they can also be distributed through other means, such as files attached to email messages, FTP or Internet downloads, floppy disks, CD-ROM, etc," PandaLabs warned.

For further information about Trj/WmvDownloader.A, Trj/WmvDownloader.B or the malicious programs and viruses these Trojans try to download, click here

[Capt. Tom]

A better solution is to turn off the "acquire licences automatically" option (under the Privacy tab in Tools -> Options).

When I get there (privacy)I have a sliding bar which is set at Medium high and the only choice there is whether to put on, or off, the pop-up blocker.

I have windows XP - Tom

[TomGuy]

Also, dial-up users need to change their 'dialing' control to prohibit automatic dialing.

[I don't remember whether that is under Internet Options or Dial Up Adapter.]

[cooldog]

It's "Tools->Options" in Windows Media Player, not in IE.

[BJungNan]

He could run, though!

[Malsua]

When I get there (privacy)I have a sliding bar which is set at Medium high and the only choice there is whether to put on, or off, the pop-up blocker.

That's the privacy tab in Internet Exploder, open windows media player and go into that TOOLS/OPTIONS/Privacy.

[Ernest_at_the_Beach]

I thought Trojans PREVENTED the spread of viruses.

Only if used correctly! LOL!

[Capt. Tom]

It's "Tools->Options" in Windows Media Player, not in IE.

Thanks. Got it.

I brought up window media player. There was no mention of tools or options. I looked the whole page over, and on the upper far right was a very small arrow. I clicked the arrow and a drop down menu came down and it is where I was able to find it.

Thanks again. - Tom

[NotJustAnotherPrettyFace]

A better solution is to turn off the "acquire licences automatically" option (under the Privacy tab in Tools -> Options).

For the PC-challenged, this "Tools" menu would be found... where? In the Windows Media Player.... or elsewhere?

[NonValueAdded]

Yes, in the Windows Media Player. Some configurations have the menu bar hidden but you should be able to access it via ctrl-m if you don't see a the usual "file  view  play  tools  help" menu bar.

[N3WBI3]

Use WinAMP

[NotJustAnotherPrettyFace]

Thank you for the help! I hate spyware.

[Ernest_at_the_Beach]

That doesn't catch everthing!

[Ernest_at_the_Beach]

New warnings.

[Ernest_at_the_Beach]

This technology is incorporated through the Windows XP Service Pack 2 + Windows Media Player 10 update.

Crap!!!!!!!!

[kellynla]

Yep, been getting some of those myself lately...
McAfee on the job, intercepted and deleted.

[tutstar]

poing

[TechJunkYard]

http://www.eweek.com/article2/0,1759,1749993,00.asp

"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys," [Patrick Hinojasa, chief technical officer at Panda Software] said.

Will MS never learn?

[ChefKeith]

FYI

[jdm]

Enabling the "Tea Timer" feature of Spybot has helped me incredibly.

[chilepepper]

rule number one for me: even though i have several legacy win98 and winXP systems...

NEVER download anything from Microsoft... all Microsoft software is MALWARE

just recently i tried to uninstall an older version of Windows Media Player -- it refused to go! it took about four or five tries, and broke several other apps in the process... i cannot describe the relief in actually finally succeeding in getting rid of most of it.

WinAMP is much safer...