IBM Computer, Laptops and Servers

View all news from: 2008 | 2007 | 2006 | 2005 | 2004 | 2003 | 2002 Browse News Archive Events Schedule BitDefender Event Calendar. Browse it to find out when you'll have the opportunity to meet the BitDefender team. All the events listed have been confirmed, but others may be added at any time so check back often for promotions and fairs in your area. Image Gallery Media Materials Press Center Membership Media Representatives Who to ask This is where you can find a list of all of our media representatives, who are ready to answer any question you might have. Test Our Products Put us to the test! We welcome the journalists or reviewers interested in testing any of the BitDefender products. Trojan.Downloader.WMA.Wimad While accessing the .wma which is a media file extension the following behavior is noticed A browser page opens to a certain webpage ie missing-codecs.com or fastmp3player.com It tries to download and execute when the user hits run on IE a malware from the mentioned site.The prompted file to download is named Codec.exe which has the Windows Media Playernbsp icon the name could vary PLAYMP3.exe or another.Take notice that the file could have any other extension that Windows Media Player can handle such as .asf, .wmw, .aiff, .midi or others.Here is how the malware looks like in action. Spreading: medium Damage: high Size: aprox 3 Mb Discovered: 2008 Jun 17 SYMPTOMS: While accessing the ".wma" which is a media file extension the following behavior is noticed :

1. A browser page opens to a certain webpage ( ie missing-codecs.com or fastmp3player.com )
2. It tries to download and execute (when the user hits run on IE ) a malware from the mentioned site.
3. The prompted file to download is named "Codec.exe" which has the Windows Media Player icon (the name could vary ("PLAY_MP3.exe" or another).

Take notice that the file could have any other extension that Windows Media Player can handle such as ".asf", ".wmw", ".aiff", ".midi" or others. Here is how the malware looks like in action. TECHNICAL DESCRIPTION: This is an disguised application under a common media file extension meant to trick the user to download and execute a malware. Usually it states the false incapacity of your software configuration to view this kind of media. Due to the common misconception that malware or viruses are only in executables, the user could be lead to trust this strategy and install without his knowledge the downloaded threat. Basically the user runs the file in Windows Media Player and gets a browser window that prompts him to download a file named "Codec.exe" . This is actually an exploit of the media files because its an available feature in stead of an attack to the format. Because it doesn't have a infection spreading ( doesn't infect files or copy itself into different locations into a network or local mirrors of the file ) so the method of spreading of this kind of malware is user based or web based ( the file appears in different locations on the internet as a download): through sharing or media downloads. So the file could be saved with different names of various celebrities, usually events or generally appealing things to users. You can see a description of a malware that this kind of trojan downloads here : http://www.bitdefender.ro/VIRUS-1000279-ro--Adware.PlayMp3z.A.html Removal instructions: Please let BitDefender disinfect your files. ANALYZED BY: Daniel Chi monebaggasse