ADW_PLAYNEW
Windows
Threat Type: Adware
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet
This adware may be manually installed by a user.
It does not have any propagation routine.
It does not have any backdoor routine.
It comes with an uninstall package that completely removes the files it dropped and the registries it created.
TECHNICAL DETAILS
Varies
EXE
Yes
09 Oct 2014
Connects to URLs/IPs, Displays ads
Arrival Details
This adware may be manually installed by a user.
Installation
This adware drops the following component file(s):
- %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\Uninstall.lnk (Windows Vista and higher versions)
- %All Users Profile%\Start Menu\Programs\NewPlayer\Uninstall.lnk (Versions lower than Windows Vista)
- %AppDataLocal%\newplayer\config\config.ini
- %AppDataLocal%\newplayer\log.txt
- %Desktop%\NewPlayer.lnk
- %Program Files%\NewPlayer\AddOn\ChromeAddon\contentscript.js
- %Program Files%\NewPlayer\AddOn\ChromeAddon\manifest.json
- %Program Files%\NewPlayer\AddOn\ChromeAddon\script.js
- %Program Files%\NewPlayer\AddOn\Thumbs.db
- %Program Files%\NewPlayer\AddonNP.exe
- %Program Files%\NewPlayer\FrameworkControl.exe
- %Program Files%\NewPlayer\LTV2.exe
- %Program Files%\NewPlayer\Languages\Arabic.ini
- %Program Files%\NewPlayer\Languages\Bulgarian.ini
- %Program Files%\NewPlayer\Languages\Catalan.ini
- %Program Files%\NewPlayer\Languages\ChineseS.ini
- %Program Files%\NewPlayer\Languages\ChineseT.ini
- %Program Files%\NewPlayer\Languages\Czech.ini
- %Program Files%\NewPlayer\Languages\Danish.ini
- %Program Files%\NewPlayer\Languages\Dutch.ini
- %Program Files%\NewPlayer\Languages\English.ini
- %Program Files%\NewPlayer\Languages\Estonian.ini
- %Program Files%\NewPlayer\Languages\Finnish.ini
- %Program Files%\NewPlayer\Languages\French.ini
- %Program Files%\NewPlayer\Languages\German.ini
- %Program Files%\NewPlayer\Languages\Greek.ini
- %Program Files%\NewPlayer\Languages\HaitianCreole.ini
- %Program Files%\NewPlayer\Languages\Hebrew.ini
- %Program Files%\NewPlayer\Languages\Hindi.ini
- %Program Files%\NewPlayer\Languages\Hungarian.ini
- %Program Files%\NewPlayer\Languages\Indonesian.ini
- %Program Files%\NewPlayer\Languages\Italian.ini
- %Program Files%\NewPlayer\Languages\Japanese.ini
- %Program Files%\NewPlayer\Languages\Korean.ini
- %Program Files%\NewPlayer\Languages\Latvian.ini
- %Program Files%\NewPlayer\Languages\Lithuanian.ini
- %Program Files%\NewPlayer\Languages\Norwegian.ini
- %Program Files%\NewPlayer\Languages\Polish.ini
- %Program Files%\NewPlayer\Languages\Portuguese.ini
- %Program Files%\NewPlayer\Languages\Romanian.ini
- %Program Files%\NewPlayer\Languages\Russian.ini
- %Program Files%\NewPlayer\Languages\Slovak.ini
- %Program Files%\NewPlayer\Languages\Slovenian.ini
- %Program Files%\NewPlayer\Languages\Spanish.ini
- %Program Files%\NewPlayer\Languages\Swedish.ini
- %Program Files%\NewPlayer\Languages\Thai.ini
- %Program Files%\NewPlayer\Languages\Turkish.ini
- %Program Files%\NewPlayer\Languages\Ukrainian.ini
- %Program Files%\NewPlayer\Languages\Vietnamese.ini
- %Program Files%\NewPlayer\NewPlayerUpdate.xml
- %Program Files%\NewPlayer\NewVideoPlayer.exe - also detected as ADW_PLAYNEW
- %Program Files%\NewPlayer\NewVideoPlayerUpdater.exe
- %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallLog
- %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallState
- %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe
- %Program Files%\NewPlayer\Newtonsoft.Json.dll
- %Program Files%\NewPlayer\PhotoLoader.dll
- %Program Files%\NewPlayer\UninstallAddons.exe
- %Program Files%\NewPlayer\Windows\Thumbs.db
- %Program Files%\NewPlayer\Windows\icon-play.ico
- %Program Files%\NewPlayer\Windows\ifishplayer-icon.ico
- %Program Files%\NewPlayer\dotNetFx40_Full_setup.exe
- %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\contentscript.js
- %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\manifest.json
- %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\script.js
- %Program Files%\NewPlayer\icon.ico
- %Program Files%\NewPlayer\jid1-tce47bzfSrBDXQ@jetpack.xpi
- %Program Files%\NewPlayer\policy.2.0.taglib-sharp.config
- %Program Files%\NewPlayer\policy.2.0.taglib-sharp.dll
- %Program Files%\NewPlayer\references\Interop.SHDocVw.dll
- %Program Files%\NewPlayer\references\NDde.dll
- %Program Files%\NewPlayer\references\NewPlayerChecker.exe
- %Program Files%\NewPlayer\references\Newtonsoft.Json.dll
- %Program Files%\NewPlayer\references\PhotoLoader.dll
- %Program Files%\NewPlayer\references\Thumbs.db
- %Program Files%\NewPlayer\references\extaudio.png
- %Program Files%\NewPlayer\references\extvideo.png
- %Program Files%\NewPlayer\references\ffmpeg.exe
- %Program Files%\NewPlayer\references\folder.png
- %Program Files%\NewPlayer\references\libreria.png
- %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.config
- %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.dll
- %Program Files%\NewPlayer\references\taglib-sharp.dll
- %Program Files%\NewPlayer\taglib-sharp.dll
- %Program Files%\NewPlayer\uninstall.exe
- %System Root%\Users\Administrator\Desktop\NewPlayer.lnk (Windows Vista and higher versions)
(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)
It creates the following folders:
- %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer (Windows Vista and higher versions)
- %All Users Profile%\Start Menu\Programs\NewPlayer (Versions lower than Windows Vista)
- %AppDataLocal%\newplayer
- %AppDataLocal%\newplayer\Playlists
- %AppDataLocal%\newplayer\Snap
- %AppDataLocal%\newplayer\config
- %Program Files%\NewPlayer
- %Program Files%\NewPlayer\AddOn
- %Program Files%\NewPlayer\AddOn\ChromeAddon
- %Program Files%\NewPlayer\Languages
- %Program Files%\NewPlayer\Windows
- %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph
- %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0
- %Program Files%\NewPlayer\references
(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)
Autostart Technique
This adware drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:
- %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Windows Vista and higher versions)
- %All Users Profile%\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Versions lower than Windows Vista)
(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\NewVideoPlayerUpdaterService
DelayedAutostart = "0"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Description = "NewVideoPlayer Updater Service"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
DisplayName = "NewVideoPlayer Updater Service"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ErrorControl = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ImagePath = "%Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Start = "2"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Type = "16"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security
Security = "{hex value"}
It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security
Other System Modifications
This adware adds the following registry entries as part of its installation routine:
HKEY_CLASSES_ROOT\.3gp
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.aac
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.aif
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.avi
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.divx
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.flv
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mkv
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mov
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mp3
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mp4
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mpeg
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.mpg
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.wav
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.wma
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\.wmv
newp.backup = "{depends on user's media player}"
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.3gp = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aac = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aif = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.avi = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.divx = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.flv = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mkv = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mov = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp3 = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp4 = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpeg = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpg = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wav = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wma = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wmv = ""
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aac
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
newp.backup = "{depends on user's media player}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.3gp = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aac = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aif = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.avi = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.divx = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.flv = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mkv = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mov = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp3 = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp4 = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpeg = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpg = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wav = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wma = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wmv = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"
HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
(Default) = "%Program Files%\NewPlayer\NewPlayer.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
InstallDir = "%Program Files%\NewPlayer"
It adds the following registry keys as part of its installation routine:
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command
HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
HKEY_CLASSES_ROOT\newp.3gp
HKEY_CLASSES_ROOT\newp.aac
HKEY_CLASSES_ROOT\newp.aif
HKEY_CLASSES_ROOT\newp.avi
HKEY_CLASSES_ROOT\newp.divx
HKEY_CLASSES_ROOT\newp.flv
HKEY_CLASSES_ROOT\newp.mkv
HKEY_CLASSES_ROOT\newp.mov
HKEY_CLASSES_ROOT\newp.mp3
HKEY_CLASSES_ROOT\newp.mp4
HKEY_CLASSES_ROOT\newp.mpeg
HKEY_CLASSES_ROOT\newp.mpg
HKEY_CLASSES_ROOT\newp.wav
HKEY_CLASSES_ROOT\newp.wma
HKEY_CLASSES_ROOT\newp.wmv
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.3gp
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aac
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aif
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.avi
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.divx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.flv
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mkv
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mov
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp3
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp4
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpeg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wav
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wma
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wmv
HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer
HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
It modifies the following registry entries:
HKEY_CLASSES_ROOT\.3gp
(Default) = "newp.3gp"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.AAC
(Default) = "newp.aac"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.aif
(Default) = "newp.aif"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.divx
(Default) = "newp.divx"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.avi
(Default) = "newp.avi"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.flv
(Default) = "newp.flv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mkv
(Default) = "newp.mkv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mov
(Default) = "newp.mov"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mp3
(Default) = "newp.mp3"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mp4
(Default) = "newp.mp4"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mpeg
(Default) = "newp.mpeg"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.mpg
(Default) = "newp.mpg"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.wav
(Default) = "newp.wav"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.wma
(Default) = "newp.wma"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_CLASSES_ROOT\.wmv
(Default) = "newp.wmv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
(Default) = "newp.3gp"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.AAC
(Default) = "newp.aac"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
(Default) = "newp.aif"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
(Default) = "newp.avi"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
(Default) = "newp.divx"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
(Default) = "newp.flv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
(Default) = "newp.mkv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
(Default) = "newp.mov"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
(Default) = "newp.mp3"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
(Default) = "newp.mp4"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
(Default) = "newp.mpeg"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
(Default) = "newp.mpg"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
(Default) = "newp.wav"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
(Default) = "newp.wma"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
(Default) = "newp.wmv"
(Note: The default value data of the said registry entry is "{depends on user's media player}".)
Propagation
This adware does not have any propagation routine.
Backdoor Routine
This adware does not have any backdoor routine.
Other Details
This adware adds the following registry entries to add an uninstall option to the Control Panel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayIcon = "%Program Files%\NewPlayer\NewVideoPlayer.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayName = "NewPlayer"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayVersion = "v2.1.2.6"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
EstimatedSize = "31391"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
Publisher = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
UninstallString = "%Program Files%\NewPlayer\uninstall.exe"
It comes with an uninstall package that completely removes the files it dropped and the registries it added.
NOTES:
It connects to the following URL to check for program updates:
- http://{BLOCKED}rr.{BLOCKED}eoplayer.com/sdb/be/NewPlayerUpdate.xml?{hash}
It connects to the following URLs for software statistics and advertisements purposes:
- http://{BLOCKED}e.{BLOCKED}t.com/ltv/activity/?idapp={application ID}&action={action}&mac={mac}
- http://ltv-pre.tguhost.com/ltv/install/?idapp={application ID}&action={action}&mac={mac}&country={language}
- http://www.{BLOCKED}eoplayer.com/analytics.html?UID={UID}&MAC={mac}&installationid={installation ID}&action={action}&aversion={version}
It connects to the following URLs to get the host's IP and location:
- http://checkip.amazonaws.com
- http://www.iptolatlng.com/?ip={IP address retrieved from http://checkip.amazonaws.com}
It contains advertisements in its GUI. Sample advertisement link is the following URL:
- http://{BLOCKED}.{BLOCKED}ter.com/offer?prod={product number}&ref={reference ID}&pid={spid}
It connects to the following URL after uninstallation:
- http://www.{BLOCKED}eoplayer.com/farewellpage
It does not have rootkit capabilities.
It does not exploit any vulnerability.
SOLUTION
9.700
1.557.00
16 Oct 2014
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Remove ADW_PLAYNEW by using its own Uninstall option
Step 4
Restart in normal mode and scan your computer with your Trend Micro product for files detected as ADW_PLAYNEW. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.