Author: Jaime Benigno Reyes   
 PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Adware

  • Destructiveness:
    No

  • Encrypted:
    Yes

  • In the wild::
    Yes

  OVERVIEW

INFECTION CHANNEL: Descargado de Internet

Puede haberlo instalado manualmente un usuario.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Incluye un paquete de desinstalación que elimina completamente los archivos y registros infiltrados.

  TECHNICAL DETAILS

File size: różni się
File type: EXE
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 09 października 2014
PAYLOAD: Connects to URLs/IPs, Displays ads

Detalles de entrada

Puede haberlo instalado manualmente un usuario.

Instalación

Este malware infiltra el/los siguiente(s) archivo(s):

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\Uninstall.lnk (Windows Vista and higher versions)
  • %All Users Profile%\Start Menu\Programs\NewPlayer\Uninstall.lnk (Versions lower than Windows Vista)
  • %AppDataLocal%\newplayer\config\config.ini
  • %AppDataLocal%\newplayer\log.txt
  • %Desktop%\NewPlayer.lnk
  • %Program Files%\NewPlayer\AddOn\ChromeAddon\contentscript.js
  • %Program Files%\NewPlayer\AddOn\ChromeAddon\manifest.json
  • %Program Files%\NewPlayer\AddOn\ChromeAddon\script.js
  • %Program Files%\NewPlayer\AddOn\Thumbs.db
  • %Program Files%\NewPlayer\AddonNP.exe
  • %Program Files%\NewPlayer\FrameworkControl.exe
  • %Program Files%\NewPlayer\LTV2.exe
  • %Program Files%\NewPlayer\Languages\Arabic.ini
  • %Program Files%\NewPlayer\Languages\Bulgarian.ini
  • %Program Files%\NewPlayer\Languages\Catalan.ini
  • %Program Files%\NewPlayer\Languages\ChineseS.ini
  • %Program Files%\NewPlayer\Languages\ChineseT.ini
  • %Program Files%\NewPlayer\Languages\Czech.ini
  • %Program Files%\NewPlayer\Languages\Danish.ini
  • %Program Files%\NewPlayer\Languages\Dutch.ini
  • %Program Files%\NewPlayer\Languages\English.ini
  • %Program Files%\NewPlayer\Languages\Estonian.ini
  • %Program Files%\NewPlayer\Languages\Finnish.ini
  • %Program Files%\NewPlayer\Languages\French.ini
  • %Program Files%\NewPlayer\Languages\German.ini
  • %Program Files%\NewPlayer\Languages\Greek.ini
  • %Program Files%\NewPlayer\Languages\HaitianCreole.ini
  • %Program Files%\NewPlayer\Languages\Hebrew.ini
  • %Program Files%\NewPlayer\Languages\Hindi.ini
  • %Program Files%\NewPlayer\Languages\Hungarian.ini
  • %Program Files%\NewPlayer\Languages\Indonesian.ini
  • %Program Files%\NewPlayer\Languages\Italian.ini
  • %Program Files%\NewPlayer\Languages\Japanese.ini
  • %Program Files%\NewPlayer\Languages\Korean.ini
  • %Program Files%\NewPlayer\Languages\Latvian.ini
  • %Program Files%\NewPlayer\Languages\Lithuanian.ini
  • %Program Files%\NewPlayer\Languages\Norwegian.ini
  • %Program Files%\NewPlayer\Languages\Polish.ini
  • %Program Files%\NewPlayer\Languages\Portuguese.ini
  • %Program Files%\NewPlayer\Languages\Romanian.ini
  • %Program Files%\NewPlayer\Languages\Russian.ini
  • %Program Files%\NewPlayer\Languages\Slovak.ini
  • %Program Files%\NewPlayer\Languages\Slovenian.ini
  • %Program Files%\NewPlayer\Languages\Spanish.ini
  • %Program Files%\NewPlayer\Languages\Swedish.ini
  • %Program Files%\NewPlayer\Languages\Thai.ini
  • %Program Files%\NewPlayer\Languages\Turkish.ini
  • %Program Files%\NewPlayer\Languages\Ukrainian.ini
  • %Program Files%\NewPlayer\Languages\Vietnamese.ini
  • %Program Files%\NewPlayer\NewPlayerUpdate.xml
  • %Program Files%\NewPlayer\NewVideoPlayer.exe - also detected as ADW_PLAYNEW
  • %Program Files%\NewPlayer\NewVideoPlayerUpdater.exe
  • %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallLog
  • %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallState
  • %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe
  • %Program Files%\NewPlayer\Newtonsoft.Json.dll
  • %Program Files%\NewPlayer\PhotoLoader.dll
  • %Program Files%\NewPlayer\UninstallAddons.exe
  • %Program Files%\NewPlayer\Windows\Thumbs.db
  • %Program Files%\NewPlayer\Windows\icon-play.ico
  • %Program Files%\NewPlayer\Windows\ifishplayer-icon.ico
  • %Program Files%\NewPlayer\dotNetFx40_Full_setup.exe
  • %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\contentscript.js
  • %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\manifest.json
  • %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\script.js
  • %Program Files%\NewPlayer\icon.ico
  • %Program Files%\NewPlayer\jid1-tce47bzfSrBDXQ@jetpack.xpi
  • %Program Files%\NewPlayer\policy.2.0.taglib-sharp.config
  • %Program Files%\NewPlayer\policy.2.0.taglib-sharp.dll
  • %Program Files%\NewPlayer\references\Interop.SHDocVw.dll
  • %Program Files%\NewPlayer\references\NDde.dll
  • %Program Files%\NewPlayer\references\NewPlayerChecker.exe
  • %Program Files%\NewPlayer\references\Newtonsoft.Json.dll
  • %Program Files%\NewPlayer\references\PhotoLoader.dll
  • %Program Files%\NewPlayer\references\Thumbs.db
  • %Program Files%\NewPlayer\references\extaudio.png
  • %Program Files%\NewPlayer\references\extvideo.png
  • %Program Files%\NewPlayer\references\ffmpeg.exe
  • %Program Files%\NewPlayer\references\folder.png
  • %Program Files%\NewPlayer\references\libreria.png
  • %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.config
  • %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.dll
  • %Program Files%\NewPlayer\references\taglib-sharp.dll
  • %Program Files%\NewPlayer\taglib-sharp.dll
  • %Program Files%\NewPlayer\uninstall.exe
  • %System Root%\Users\Administrator\Desktop\NewPlayer.lnk (Windows Vista and higher versions)

(Nota: %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Escritorio).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

)

Crea las carpetas siguientes:

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer (Windows Vista and higher versions)
  • %All Users Profile%\Start Menu\Programs\NewPlayer (Versions lower than Windows Vista)
  • %AppDataLocal%\newplayer
  • %AppDataLocal%\newplayer\Playlists
  • %AppDataLocal%\newplayer\Snap
  • %AppDataLocal%\newplayer\config
  • %Program Files%\NewPlayer
  • %Program Files%\NewPlayer\AddOn
  • %Program Files%\NewPlayer\AddOn\ChromeAddon
  • %Program Files%\NewPlayer\Languages
  • %Program Files%\NewPlayer\Windows
  • %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph
  • %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0
  • %Program Files%\NewPlayer\references

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Técnica de inicio automático

Infiltra el siguiente acceso directo dirigido a su copia en la carpeta de inicio del usuario para que se ejecute automáticamente cada vez que arranque el sistema:

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Windows Vista and higher versions)
  • %All Users Profile%\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Versions lower than Windows Vista)

Registra el componente infiltrado como servicio del sistema para garantizar su ejecución automática cada vez que arranque el sistema. Para ello, crea las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\NewVideoPlayerUpdaterService
DelayedAutostart = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Description = "NewVideoPlayer Updater Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
DisplayName = "NewVideoPlayer Updater Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ImagePath = "%Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security
Security = "{hex value"}

Registra el componente infiltrado como servicio del sistema para garantizar su ejecución automática cada vez que arranque el sistema. Para ello, crea las siguientes claves de registro:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CLASSES_ROOT\.3gp
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.aac
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.aif
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.avi
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.divx
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.flv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mkv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mov
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mp3
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mp4
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mpeg
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mpg
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wav
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wma
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wmv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.3gp = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aac = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aif = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.avi = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.divx = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.flv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mkv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mov = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp3 = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp4 = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpeg = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpg = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wav = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wma = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wmv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aac
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.3gp = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aac = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aif = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.avi = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.divx = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.flv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mkv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mov = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp3 = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp4 = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpeg = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpg = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wav = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wma = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wmv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
(Default) = "%Program Files%\NewPlayer\NewPlayer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
InstallDir = "%Program Files%\NewPlayer"

Agrega las siguientes claves de registro como parte de la rutina de instalación:

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes

HKEY_CLASSES_ROOT\newp.3gp

HKEY_CLASSES_ROOT\newp.aac

HKEY_CLASSES_ROOT\newp.aif

HKEY_CLASSES_ROOT\newp.avi

HKEY_CLASSES_ROOT\newp.divx

HKEY_CLASSES_ROOT\newp.flv

HKEY_CLASSES_ROOT\newp.mkv

HKEY_CLASSES_ROOT\newp.mov

HKEY_CLASSES_ROOT\newp.mp3

HKEY_CLASSES_ROOT\newp.mp4

HKEY_CLASSES_ROOT\newp.mpeg

HKEY_CLASSES_ROOT\newp.mpg

HKEY_CLASSES_ROOT\newp.wav

HKEY_CLASSES_ROOT\newp.wma

HKEY_CLASSES_ROOT\newp.wmv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.3gp

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aac

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aif

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.avi

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.divx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.flv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mkv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mov

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp3

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp4

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpeg

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpg

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wav

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wma

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wmv

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer

Modifica las siguientes entradas de registro:

HKEY_CLASSES_ROOT\.3gp
(Default) = "newp.3gp"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.AAC
(Default) = "newp.aac"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.aif
(Default) = "newp.aif"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.divx
(Default) = "newp.divx"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.avi
(Default) = "newp.avi"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.flv
(Default) = "newp.flv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mkv
(Default) = "newp.mkv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mov
(Default) = "newp.mov"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mp3
(Default) = "newp.mp3"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mp4
(Default) = "newp.mp4"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mpeg
(Default) = "newp.mpeg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mpg
(Default) = "newp.mpg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wav
(Default) = "newp.wav"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wma
(Default) = "newp.wma"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wmv
(Default) = "newp.wmv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
(Default) = "newp.3gp"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.AAC
(Default) = "newp.aac"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
(Default) = "newp.aif"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
(Default) = "newp.avi"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
(Default) = "newp.divx"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
(Default) = "newp.flv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
(Default) = "newp.mkv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
(Default) = "newp.mov"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
(Default) = "newp.mp3"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
(Default) = "newp.mp4"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
(Default) = "newp.mpeg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
(Default) = "newp.mpg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
(Default) = "newp.wav"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
(Default) = "newp.wma"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
(Default) = "newp.wmv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Otros detalles

Agrega las siguientes entradas de registro para añadir una opción de desinstalación al Panel de control:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayIcon = "%Program Files%\NewPlayer\NewVideoPlayer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayVersion = "v2.1.2.6"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
EstimatedSize = "31391"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
Publisher = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
UninstallString = "%Program Files%\NewPlayer\uninstall.exe"

Incluye un paquete de desinstalación que elimina completamente los archivos infiltrados y registros agregados.

  SOLUTION

Minimum scan engine: 9.700
SSAPI Pattern-Datei: 1.557.00
SSAPI Pattern veröffentlicht am: 16 de października de 2014

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 3

Quitar ADW_PLAYNEW por medio de su propia opción de desinstalación

[ learnMore ]
Para desinstalar el proceso de grayware

Step 4

Reinicie en modo normal y explore el equipo con su producto de Trend Micro para buscar los archivos identificados como ADW_PLAYNEW En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.