3wPlayer

3wPlayer is a rogue media player software application bundled with trojans that can infect computers running Microsoft Windows. It is designed to exploit users who download video files, instructing them to download and install the program in order to view the video. The 3wPlayer employs a form of social engineering to infect computers. Seemingly desirable video files, such as recent movies, are released via BitTorrent or other distribution channels. These files resemble conventional AVI files, but are engineered to display a message when played on most media player programs, instructing the user to visit the 3wPlayer website and download the software to view the video.

The 3wPlayer is infected with Trojan.Win32.Obfuscated.en^[1] According to Symantec, 3wPlayer "may download" a piece of adware they refer to as Adware.Lop,^[2] which "adds its own toolbar and search button to Internet Explorer".^[3]

A Perl script posted online can reportedly decrypt 3wplayer files back into AVI.^[4] This claim has been tested with mixed results, as the intended AVI file is rarely the desired video file.

Clones

There are some 3wPlayer clones:

DivoCodec and X3Codec

The DivoCodec or Divo Codec or X3Codec has also been identified as a trojan similar to 3wPlayer. Users are instructed to download the codec in order to view or play an AVI/MP4/MP3/WMA file, often downloaded via P2P programs.

Instead of actual codecs, DivoCodec installs malware on the users computer. The DivoCodec is polymorphic and can change its structure. It has also been known to write to another process' virtual memory (process hijacking).

DomPlayer

The DomPlayer is similar to the DivoCodec and 3wPlayer. Users are also instructed to download the player in order to view an AVI file.

As with DivoCodec, false .avi are easily spotted because of the duration of the file, usually lying at 10–12 seconds, of which one can conclude that there is no chance that that file may be a film/TV series, despite the size of the file. This is not always the case however, as many distributors have recently begun falsifying the file meta data to display normal durations and file sizes.

x3 player

x3 player is similar to DomPlayer, and instructs users to download this player to view the avi file. Also circulated is a 5 second ASF video which is disguised as an MP3 file instructing users to install this player.

References

1. ^ Trojan.Win32.Obfuscated.en.
2. ^ 3wPlayer - Technical Details, accessed on 2008/07/24
3. ^ Adware.Lop, accessed on 2008/07/24
4. ^ Mininova Forum: 3wplayer and the like..., accessed on 10/3/07

External links

• Symantec security briefing
• Clears the avi file from any player related data
• Same as above, just with a little explanation (removes the faulty header from avi files)