ADW_PLAYNEW

This adware may be manually installed by a user.

It does not have any propagation routine.

It does not have any backdoor routine.

It comes with an uninstall package that completely removes the files it dropped and the registries it created.

Arrival Details

This adware may be manually installed by a user.

Installation

This adware drops the following component file(s):

• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\Uninstall.lnk (Windows Vista and higher versions)
• %All Users Profile%\Start Menu\Programs\NewPlayer\Uninstall.lnk (Versions lower than Windows Vista)
• %AppDataLocal%\newplayer\config\config.ini
• %AppDataLocal%\newplayer\log.txt
• %Desktop%\NewPlayer.lnk
• %Program Files%\NewPlayer\AddOn\ChromeAddon\contentscript.js
• %Program Files%\NewPlayer\AddOn\ChromeAddon\manifest.json
• %Program Files%\NewPlayer\AddOn\ChromeAddon\script.js
• %Program Files%\NewPlayer\AddOn\Thumbs.db
• %Program Files%\NewPlayer\AddonNP.exe
• %Program Files%\NewPlayer\FrameworkControl.exe
• %Program Files%\NewPlayer\LTV2.exe
• %Program Files%\NewPlayer\Languages\Arabic.ini
• %Program Files%\NewPlayer\Languages\Bulgarian.ini
• %Program Files%\NewPlayer\Languages\Catalan.ini
• %Program Files%\NewPlayer\Languages\ChineseS.ini
• %Program Files%\NewPlayer\Languages\ChineseT.ini
• %Program Files%\NewPlayer\Languages\Czech.ini
• %Program Files%\NewPlayer\Languages\Danish.ini
• %Program Files%\NewPlayer\Languages\Dutch.ini
• %Program Files%\NewPlayer\Languages\English.ini
• %Program Files%\NewPlayer\Languages\Estonian.ini
• %Program Files%\NewPlayer\Languages\Finnish.ini
• %Program Files%\NewPlayer\Languages\French.ini
• %Program Files%\NewPlayer\Languages\German.ini
• %Program Files%\NewPlayer\Languages\Greek.ini
• %Program Files%\NewPlayer\Languages\HaitianCreole.ini
• %Program Files%\NewPlayer\Languages\Hebrew.ini
• %Program Files%\NewPlayer\Languages\Hindi.ini
• %Program Files%\NewPlayer\Languages\Hungarian.ini
• %Program Files%\NewPlayer\Languages\Indonesian.ini
• %Program Files%\NewPlayer\Languages\Italian.ini
• %Program Files%\NewPlayer\Languages\Japanese.ini
• %Program Files%\NewPlayer\Languages\Korean.ini
• %Program Files%\NewPlayer\Languages\Latvian.ini
• %Program Files%\NewPlayer\Languages\Lithuanian.ini
• %Program Files%\NewPlayer\Languages\Norwegian.ini
• %Program Files%\NewPlayer\Languages\Polish.ini
• %Program Files%\NewPlayer\Languages\Portuguese.ini
• %Program Files%\NewPlayer\Languages\Romanian.ini
• %Program Files%\NewPlayer\Languages\Russian.ini
• %Program Files%\NewPlayer\Languages\Slovak.ini
• %Program Files%\NewPlayer\Languages\Slovenian.ini
• %Program Files%\NewPlayer\Languages\Spanish.ini
• %Program Files%\NewPlayer\Languages\Swedish.ini
• %Program Files%\NewPlayer\Languages\Thai.ini
• %Program Files%\NewPlayer\Languages\Turkish.ini
• %Program Files%\NewPlayer\Languages\Ukrainian.ini
• %Program Files%\NewPlayer\Languages\Vietnamese.ini
• %Program Files%\NewPlayer\NewPlayerUpdate.xml
• %Program Files%\NewPlayer\NewVideoPlayer.exe - also detected as ADW_PLAYNEW
• %Program Files%\NewPlayer\NewVideoPlayerUpdater.exe
• %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallLog
• %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.InstallState
• %Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe
• %Program Files%\NewPlayer\Newtonsoft.Json.dll
• %Program Files%\NewPlayer\PhotoLoader.dll
• %Program Files%\NewPlayer\UninstallAddons.exe
• %Program Files%\NewPlayer\Windows\Thumbs.db
• %Program Files%\NewPlayer\Windows\icon-play.ico
• %Program Files%\NewPlayer\Windows\ifishplayer-icon.ico
• %Program Files%\NewPlayer\dotNetFx40_Full_setup.exe
• %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\contentscript.js
• %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\manifest.json
• %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0\script.js
• %Program Files%\NewPlayer\icon.ico
• %Program Files%\NewPlayer\jid1-tce47bzfSrBDXQ@jetpack.xpi
• %Program Files%\NewPlayer\policy.2.0.taglib-sharp.config
• %Program Files%\NewPlayer\policy.2.0.taglib-sharp.dll
• %Program Files%\NewPlayer\references\Interop.SHDocVw.dll
• %Program Files%\NewPlayer\references\NDde.dll
• %Program Files%\NewPlayer\references\NewPlayerChecker.exe
• %Program Files%\NewPlayer\references\Newtonsoft.Json.dll
• %Program Files%\NewPlayer\references\PhotoLoader.dll
• %Program Files%\NewPlayer\references\Thumbs.db
• %Program Files%\NewPlayer\references\extaudio.png
• %Program Files%\NewPlayer\references\extvideo.png
• %Program Files%\NewPlayer\references\ffmpeg.exe
• %Program Files%\NewPlayer\references\folder.png
• %Program Files%\NewPlayer\references\libreria.png
• %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.config
• %Program Files%\NewPlayer\references\policy.2.0.taglib-sharp.dll
• %Program Files%\NewPlayer\references\taglib-sharp.dll
• %Program Files%\NewPlayer\taglib-sharp.dll
• %Program Files%\NewPlayer\uninstall.exe
• %System Root%\Users\Administrator\Desktop\NewPlayer.lnk (Windows Vista and higher versions)

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It creates the following folders:

• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer (Windows Vista and higher versions)
• %All Users Profile%\Start Menu\Programs\NewPlayer (Versions lower than Windows Vista)
• %AppDataLocal%\newplayer
• %AppDataLocal%\newplayer\Playlists
• %AppDataLocal%\newplayer\Snap
• %AppDataLocal%\newplayer\config
• %Program Files%\NewPlayer
• %Program Files%\NewPlayer\AddOn
• %Program Files%\NewPlayer\AddOn\ChromeAddon
• %Program Files%\NewPlayer\Languages
• %Program Files%\NewPlayer\Windows
• %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph
• %Program Files%\NewPlayer\flaelojgnhjgiilnmignlkamlcncclph\1.0_0
• %Program Files%\NewPlayer\references

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Autostart Technique

This adware drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Windows Vista and higher versions)
• %All Users Profile%\Start Menu\Programs\NewPlayer\NewPlayer.lnk (Versions lower than Windows Vista)

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\NewVideoPlayerUpdaterService
DelayedAutostart = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Description = "NewVideoPlayer Updater Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
DisplayName = "NewVideoPlayer Updater Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ImagePath = "%Program Files%\NewPlayer\NewVideoPlayerUpdaterService.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security
Security = "{hex value"}

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NewVideoPlayerUpdaterService\Security

Other System Modifications

This adware adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\.3gp
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.aac
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.aif
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.avi
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.divx
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.flv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mkv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mov
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mp3
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mp4
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mpeg
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.mpg
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wav
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wma
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\.wmv
newp.backup = "{depends on user's media player}"

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.3gp = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aac = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.aif = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.avi = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.divx = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.flv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mkv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mov = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp3 = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mp4 = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpeg = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.mpg = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wav = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wma = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes
.wmv = ""

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aac
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
newp.backup = "{depends on user's media player}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command
(Default) = ""%Program Files%\NewPlayer\NewVideoPlayer.exe" /m "%1""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.3gp = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aac = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.aif = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.avi = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.divx = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.flv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mkv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mov = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp3 = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mp4 = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpeg = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.mpg = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wav = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wma = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes
.wmv = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe
FriendlyAppName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
(Default) = "%Program Files%\NewPlayer\NewPlayer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer
InstallDir = "%Program Files%\NewPlayer"

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
shell\Play\command

HKEY_CLASSES_ROOT\Applications\NewVideoPlayer.exe\
SupportedTypes

HKEY_CLASSES_ROOT\newp.3gp

HKEY_CLASSES_ROOT\newp.aac

HKEY_CLASSES_ROOT\newp.aif

HKEY_CLASSES_ROOT\newp.avi

HKEY_CLASSES_ROOT\newp.divx

HKEY_CLASSES_ROOT\newp.flv

HKEY_CLASSES_ROOT\newp.mkv

HKEY_CLASSES_ROOT\newp.mov

HKEY_CLASSES_ROOT\newp.mp3

HKEY_CLASSES_ROOT\newp.mp4

HKEY_CLASSES_ROOT\newp.mpeg

HKEY_CLASSES_ROOT\newp.mpg

HKEY_CLASSES_ROOT\newp.wav

HKEY_CLASSES_ROOT\newp.wma

HKEY_CLASSES_ROOT\newp.wmv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\shell\
Play\command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\NewVideoPlayer.exe\SupportedTypes

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.3gp

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aac

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.aif

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.avi

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.divx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.flv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mkv

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mov

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp3

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mp4

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpeg

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.mpg

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wav

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wma

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
newp.wmv

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer

HKEY_LOCAL_MACHINE\SOFTWARE\NewPlayer\
NewPlayer

It modifies the following registry entries:

HKEY_CLASSES_ROOT\.3gp
(Default) = "newp.3gp"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.AAC
(Default) = "newp.aac"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.aif
(Default) = "newp.aif"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.divx
(Default) = "newp.divx"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.avi
(Default) = "newp.avi"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.flv
(Default) = "newp.flv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mkv
(Default) = "newp.mkv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mov
(Default) = "newp.mov"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mp3
(Default) = "newp.mp3"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mp4
(Default) = "newp.mp4"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mpeg
(Default) = "newp.mpeg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.mpg
(Default) = "newp.mpg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wav
(Default) = "newp.wav"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wma
(Default) = "newp.wma"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_CLASSES_ROOT\.wmv
(Default) = "newp.wmv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.3gp
(Default) = "newp.3gp"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.AAC
(Default) = "newp.aac"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.aif
(Default) = "newp.aif"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.avi
(Default) = "newp.avi"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.divx
(Default) = "newp.divx"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.flv
(Default) = "newp.flv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mkv
(Default) = "newp.mkv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mov
(Default) = "newp.mov"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp3
(Default) = "newp.mp3"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mp4
(Default) = "newp.mp4"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpeg
(Default) = "newp.mpeg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.mpg
(Default) = "newp.mpg"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wav
(Default) = "newp.wav"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
(Default) = "newp.wma"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
(Default) = "newp.wmv"

(Note: The default value data of the said registry entry is "{depends on user's media player}".)

Propagation

This adware does not have any propagation routine.

Backdoor Routine

This adware does not have any backdoor routine.

Other Details

This adware adds the following registry entries to add an uninstall option to the Control Panel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayIcon = "%Program Files%\NewPlayer\NewVideoPlayer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayName = "NewPlayer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
DisplayVersion = "v2.1.2.6"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
EstimatedSize = "31391"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
Publisher = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
NewPlayer
UninstallString = "%Program Files%\NewPlayer\uninstall.exe"

It comes with an uninstall package that completely removes the files it dropped and the registries it added.

NOTES:

It connects to the following URL to check for program updates:

• http://{BLOCKED}rr.{BLOCKED}eoplayer.com/sdb/be/NewPlayerUpdate.xml?{hash}

It connects to the following URLs for software statistics and advertisements purposes:

• http://{BLOCKED}e.{BLOCKED}t.com/ltv/activity/?idapp={application ID}&action={action}&mac={mac}
• http://ltv-pre.tguhost.com/ltv/install/?idapp={application ID}&action={action}&mac={mac}&country={language}
• http://www.{BLOCKED}eoplayer.com/analytics.html?UID={UID}&MAC={mac}&installationid={installation ID}&action={action}&aversion={version}

It connects to the following URLs to get the host's IP and location:

• http://checkip.amazonaws.com
• http://www.iptolatlng.com/?ip={IP address retrieved from http://checkip.amazonaws.com}

It contains advertisements in its GUI. Sample advertisement link is the following URL:

• http://{BLOCKED}.{BLOCKED}ter.com/offer?prod={product number}&ref={reference ID}&pid={spid}

It connects to the following URL after uninstallation:

• http://www.{BLOCKED}eoplayer.com/farewellpage

It does not have rootkit capabilities.

It does not exploit any vulnerability.