Submitted by Deepesh Agarwal on Sun, 08/05/2007 - 08:34
Recently Torrent sites are getting spammed by malicious torrent uploads disguised as new movie releases, torrent users are reporting that they have downloaded various videos mostly claiming to be new movie releases or TV shows only to be confronted with a short video which advises them to download a new media player called 3wPlayer to view the rest of file. The few second clip show the Url to download this malware media player 3wPlayer.
The player installs a form of CIDHELP malware which is very hard to get rid of, The only solution to this problem is to make the user aware of this kind of tactic and reporting any such torrent to the torrent website for removal.
UPDATE:
USAGE: decoder.exe 3wPlayerencodedfilename.avi outputfilename.avi
To decrypt the underlying video data you can the following perl script.
