Hackers Tune In to Windows Media Player

thumbnail Hackers Tune In to Windows Media Player

Hackers are using the newest DRM technology in Microsoft’s Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users. Security researchers have detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, in video files circulating on P2P (peer-to-peer) networks. According to Panda Software, both Trojans take advantage of the […]

Written By: Ryan Naraine
Jan 10, 2005
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Hackers are using the newest DRM technology in Microsoft’s Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users.

Security researchers have detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, in video files circulating on P2P (peer-to-peer) networks.

According to Panda Software, both Trojans take advantage of the new Windows anti-piracy technology to trick users into downloading spyware and adware applications.

“When a user tries to play a protected Windows media file, this technology demands a valid license. If the license is not stored on the computer, the application will look for it on the Internet, so that the user can acquire it directly or buy it,” Panda Software explained.

An unsuspecting user attempting to download the DRM (digital rights management) license will instead be redirected to a Web site that loads a large quantity of adware, spyware, modem dialers and other viruses, the company said in an advisory.

A new anti-spyware tool zaps Weatherbug. Click here to read more.

“It’s pretty ingenious,” said Patrick Hinojasa, chief technical officer at Panda Software. “To take an anti-piracy feature and use it to feed spyware is extremely ironic.”

Hinojasa told eWEEK.com that the use of Windows Media files as a spyware vehicle is another sign that virus writers and companies supporting spyware are looking for new entry points to infect computers.

“In this case, they’re using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys,” he said.

Even though these Trojans have been detected in video files on P2P networks such as Kazaa or eMule, Hinojasa warned that these files can be distributed via e-mail, FTP or other Internet download avenues.

Ben Edelman, a Harvard University student who tracks and comments on the spyware scourge, also spotted the spyware-laden media files. In a research note, Edelman posted a demonstration of the exploits and warned that users with older versions of Windows will receive “confusing and misleading messages” regarding the DRM licenses.

After attempting to download the DRM, Edelman said: “On a fresh test computer, I pressed Yes once to allow the installation. My computer quickly became contaminated with the most spyware programs I have ever received in a single sitting.”

“All told, the infection added 58 folders, 786 files and an incredible 11,915 registry entries to my test computer. Not one of these programs had showed me any license agreement, nor had I consented to their installation on my computer,” he added.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

Recommended for you...

Leadership Roundup: July Adjustments to Executive Benches

July saw major leadership shakeups across the channel, with key C-suite hires at Pipefy, Coro, Snowflake, Chainguard, and more.

Jordan Smith
Aug 1, 2025
July Roundup: AI, Cyber Key to Several M&A Developments

July’s M&A wave spotlighted AI security, with major players like Palo Alto Networks, Darktrace, and TD SYNNEX leading transformative deals.

Jordan Smith
Aug 1, 2025
Lemongrass Debuts Tool to Streamline SAP Clean Core Work

Lemongrass debuts Clean Core AI Accelerator to help SAP users cut complexity, reduce technical debt, and prepare ERP systems for cloud and AI upgrades.

Franklin Okeke
Jul 31, 2025
Trend Micro and Google Cloud Double Down on AI Security

The expanded alliance emphasizes AI-driven defenses, sovereign cloud capabilities, and new anti-scam protections for businesses worldwide.

Allison Francis
Jul 30, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.