W32/Mediasups is a virus. The virus will infect Windows systems and spreads by infecting executable files.

Upon execution, the virus creates wowexec.tmp, MediaSups.exe and (RANDOM 8 CHARACTERS).sys in the %User Profile%\Local Settings\Temp folder.

The virus modifies registry at the following locations;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MediaDrver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEDIADRVER
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEDIADRVER\0000

It also attempts to spread by infecting executable files on the compromised computer.

The virus creates a service with the following characteristics to execute the (RANDOM 8 CHARACTERS).sys file.

Service Name: MediaDrver
Display Name: MicroSoft Media Services

It aslo attempts to execute the file wowexec.tmp. This file triggers Microsoft's Dr.Watson program and crashes.

It may open up a connection to a remote server and download additional files.

The virus may also spread through network shares.

This virus first appeared on December 28, 2006.

 Other names of W32/Mediasups Virus:

This Virus is also known as W32.Mediasups.