View Single Post
  #5 (permalink)  
Old 8th Mar 2009, 1:15 pm
fliperover fliperover is offline
New Member
 
Join Date: Mar 2009
Posts: 7
Default Re: Need conversion help please, new to PMP's

While searching for older versions of vidrop i found this article about it possibly having malicious software with these behaviors.

http://spywarefiles.prevx.com/RRGDIC...IDROP.EXE.html

File Behavior

VIDROP.EXE has been seen to perform the following behavior:

* The Process is packed and/or encrypted using a software packing process
* Creates system tray popups, messages, errors and security warnings
* Visits web sites on your PC without you knowing
* Can communicate with other computer systems using HTTP protocols
* Executes a Process

VIDROP.EXE has been the subject of the following behavior:

* Executed as a Process
* Created as a process on disk


File Name Aliases

VIDROP.EXE can also use the following file names:

* 52328478.EXE
* 65990016.EXE

Filesizes

The following file size has been seen:

* 257,711 bytes
* 439,337 bytes
* 433,653 bytes

Vendor, Product and Version Information

Files with the name VIDROP.EXE have been seen to have the following Vendor, Product and Version Information in the file header:

* ; XVID convertor for RockChip players; 0.5.1.0
* ; viDrop video convertor; 0.5.7.2
* ; viDrop video convertor;
* ; viDrop video convertor; 0.5.5.0

File Type

The filename VIDROP.EXE refers to many versions of an executable program.
File Activity

One or more files with the name VIDROP.EXE creates, deletes, copies or moves the following files and folders:

* Opens/modifes c:\autoexec.bat

Website Activity

One or more files with the name VIDROP.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

* learnfree .eu / download / vidrop / update .php
* Port 80 IP:89.252.241.16
* Port 80 IP:82.165.119.75
Reply With Quote