Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Worm
- Malware Dropper
- Cloaked Malware
File Behavior
WMCODEC_UPDATE.EXE has been seen to perform the following behavior:
- Enables an In Process Object/Server - Common with DLL Injections
- Creation and Registration of a Browser Helper Object in Internet Explorer
- Adds products to the system registry
- This process creates other processes on disk
- Can communicate with other computer systems using HTTP protocols
- Executes a Process
- This Process Deletes Other Processes From Disk
- Creates system tray popups, messages, errors and security warnings
- Writes to another Process's Virtual Memory (Process Hijacking)
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Modifies the Windows Built in Screen Saver
- Executes Processes stored in Temporary Folders
WMCODEC_UPDATE.EXE has been the subject of the following behavior:
- Created as a process on disk
- Deleted as a process from disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry auto start to load Program on Boot up
- Terminated as a Process
Country Of Origin
The filename WMCODEC_UPDATE.EXE was first seen on Aug 18 2008 in the following geographical regions of the Prevx community:
- SPAIN on Aug 18 2008
- The EUROPEAN UNION on Aug 18 2008
- AUSTRALIA on Sep 9 2008
- SOUTH AFRICA on Sep 16 2008
File Name Aliases
WMCODEC_UPDATE.EXE can also use the following file names:
- UESIUQCR.EXE
- 55781382.EXE
- NETGATE INTERNET SECURITY CRACK.EXE
- ADOBE_FLASH_PLAYER_INSTALLER.EXE
- L0OHR4TQ.EXE
- Y6EAME43.EXE
- 51283595.EXE
- 15155425.DAT
- Z83089Y0.EXE
- CE26KFB9.EXE
- KEYGEN.EXE
- LPHCGE5J0EG89.EXE
- ULBLYG87.EXE
- CFZKNEIE.EXE
- J5DQNEE1.EXE
- ZC95DYXN.EXE
- LPHC3MCJ0E76P.EXE
- Ÿ¶ÐÞ
- KEYGEN (n).EXE
- 46061916.EXE
Filesizes
The following file size has been seen:
- 89,614 bytes
- 330,636 bytes
- 274,902 bytes
- 40,972 bytes
- 436,303 bytes
- 239,143 bytes
File Type
The filename WMCODEC_UPDATE.EXE refers to many versions of an executable program.
File Activity
One or more files with the name WMCODEC_UPDATE.EXE creates, deletes, copies or moves the following files and folders:
- create folder C:\Program Files\RichVideoCodec
- Deletes c:\docume~1\user\locals~1\temp\nsfC.tmp
- Creates c:\windows\system32\CodecBHO.dll
- Creates c:\program files\richvideocodec\5378.exe
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.