All of the malware we’ve reported on comes from the same 2 servers found at 69.72.144.122 and 207.44.244.86 and this new kid on the block is no different.

DomPlayer is the latest malware to get on BitTorrent user’s nerves. In the last article on this issue we already discovered that the DomPlayer domain was sitting dormant but we didn’t know what it would become. It’s live now and here’s the deal:

Someone downloads a TV show (very often an aXXo fake) via BitTorrent. When the file is played, a message appears:

This video can only be played in DomPlayer, Visit Download.Domplayer.Com

On arrival, the user is greeted with a nice shiny site to distract them from the fact this is an elaborate trick based on DRM’ing previously-free media and forcing users to take steps to unlock it.

This is where DomPlayer differs from the other malware media players we’ve report on. The site claims: “DomPlayer is 100% clean, no bundled software!” At this stage, it doesn’t appear to install any intrusive adware etc on the host PC – there is a different trick up this 945K installer’s sleeve.

When it’s run, it’s believed the software locates the user, directs him to a telephone hotline appropriate to his country and instructs him to call it via cellphone. The call leads to the ‘activation’ of the DomPlayer software but ends up costing the user money.

If the user is in a country ‘unsupported’ by DomPlayer’s payment system, he will be directed to the 3WPlayer site where he can install 3WPlayer and a load of malware onto his PC, completely free of charge.

Although fake aXXo releases are known to be a frequent target of this scam, other media is also affected so many file-sharers find it prudent to check the comments on the site before they download a torrent.

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

However, there are companies out there who give you ‘free’ software (like a torrent client) but at the same time install some of that extra stuff you don’t want too. We have regularly reported on BitTorrent clients which also install this malware such as Torrent101, BitRoll, TorrentQ and GetTorrent. These are just a handful of bad clients currently available online.

It didn’t take much research to discover that a Swedish company called Wakenet is behind the enterprise, a company that made news on lots of spyware sites due to its Anti-Leech plugin.

Wakenet has a new domain called uvTorrent.com (currently diverting to their Cash4Downloads site) – no prizes for guessing the planned confusion with novices and the official ‘uTorrent’ client. They also have a new (fake) ‘compression’ utility called Winzix, obviously named to be confused with Winzip. Unfortunate downloaders will download something from BitTorrent, only to learn that it needs to ‘decompressed’ with Winzix in order to work. Installing Winzix again results in malware getting onto the host PC.

Our investigations revealed two major servers carrying the malware-ridden clients, media players, compression utilities and other sites supporting the enterprise:

IP: 69.72.144.122

1. netpumper.com (there’s even a link to this from Wakenet’s homepage)
2. bitgrabber.com
3. bitroll.com
4. c4dl.com
5. cash4downloads.com
6. download.play3w.com
7. get-torrent.com
8. playon.play3w.com
9. winzix.com (additional information from Symantec)
10. bitdownload.org
11. divoplayer.com
12. plugindl.com
13. torrent101.com
14. torrentq.com
15. torrentsoftware.org

IP: 207.44.244.86

1. bitroll.com
2. c4dl.com
3. cash4downloads.com (Click here for removal instructions)
4. download.netpumper.com
5. Uvtorrent.com
6. playon.play3w.com
7. wakenet.se (WakeNet’s own homepage is on the same server)
8. bitsofporn.com
9. domplayer.com
10. gamingtorrent.com
11. kitplayer.com
12. torrentmusic.org
13. torrentgamers.com
14. Torrentspeeder.com (different server currently)

We suggest that everyone stays well away from every site on the above lists. Use uTorrent or Azureus to download and if you ever download anything that requires anything other than a standard media player or WinRAR in order to play, be a little suspicious. Checking the comments to the torrent you plan to download is always a good idea.

For the little more adventurous reader, it’s possible to use the Windows HOSTS file to block the activity caused not only by the malware listed above but also that from hundreds of other sources. We recommend the excellent guide from MVPS, “Blocking Unwanted Parasites with a Hosts File”

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Unfortunately, as fast as we report such things, the malware peddlers create yet more bad clients with new names, but carrying the same bad story. However, these guys are very determined to get software such as CIDHELP on your machine, ready to watch your activities and to this end have become quite creative. Recently BitTorrent users are reporting that they have downloaded various pieces of video (usually a TV show) only to be confronted with a message during the first few seconds of the video which advises them to download a new media player called 3wPlayer, in order to view the rest of the file.

The displayed url directs the unsuspecting to the Play3W site, where they are given the chance of installing a shiny new media player.

From the screenshot you will see that there is a ‘more’ button and when you install this player ‘more’ is exactly what you get – more malware in the form of CIDHELP, yet again. It can be difficult task to uninstall it too, especially when you consider the veiled legal threat on the CIDHELP site – the vendor warns you could be in breach of the EULA if you try to remove it with your anti-spyware software. To get rid of the software, they advise to first turn off your anti-adware/spyware software and re-install the software, something that rings a few alarm bells!

It may seem that every pusher in the world is getting involved in the BitTorrent malware scene but a simple WHOIS on all the domains hosting the torrent clients listed above, (Torrent101 for example) including the 3wPlayer site, reveals that they are more than likely the same outfit, exploiting the less experienced members of the BitTorrent community. Anyone concerned about a particular torrent should take the time to read the user comments on the site where the torrent was downloaded from. Very often problems such as fake files are spoken about there.

Anyone needing a media player that will deal with almost any video format should consider the excellent VLC Media Player, available for free download. Those who still haven’t settled on a quality BitTorrent client will find everything they need by getting uTorrent. No spyware, adware or malware present in either product.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Unfortunately, several popular torrent sites carried advertising for these bad clients but thankfully, sites like The Pirate Bay saw the damage these things can cause and removed the adverts. TPB’s brokep wrote, “We’re getting a lot of email about people downloading torrent clients that are advertised on the site. Do not download them! We have put a ban for the ad companies to sell ads for these clients on our site.” Mininova and Snarf-it also blocked the adverts.

In February, we reported on yet another client, TorrentQ after a tip-off from the owner of BT-Junkie. Of course, this wasn’t a new client but the old one with a new name.

In April, in order to try to save unsuspecting file-sharers from installing malware, we ran Google Adword campaigns on the BitRoll, Torrent101 and TorrentQ websites, informing people of just how bad these clients are. Google apparantly doesn’t like to be associated with bad news and a few days later, Adsense adverts disappeared from the sites.

Disappointingly, we are now exposed to yet another ‘new’ bad torrent client. Get-Torrent is the latest in a sequence of malware-laden torrent clients, cloned from the same infected DNA as BitRoll, Torrent101 and TorrentQ. As can be seen from the client’s ‘skinning’ pages, these products are identical;

As we promised in our earlier posts, every time a bad client appears we will do our best to let the BitTorrent community know about it. Anyone thinking of installing a BitTorrent client should stay away from these products and install a free, clean client, such as uTorrent.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Of course these campaigns were just for “fun”. It was nice to turn their advertising strategy against them, and help some naive BitTorrent users along the way. However, the downside of it all is that they now make money off my ads, which allows them to advertise their crappy BitTorrent clients on other websites, so it’s not really an optimal solution.

Here’s an example of the TorrentFreak ad on the Torrent101 website. If people clicked the link, they were directed to this post about Torrent101.

Luckily, most BitTorrent site admins don’t allow ads for these shady clients on their sites. Brokep from The Pirate Bay said earlier “We’re getting a lot of email about people downloading torrent clients that are advertised on the site. Do not download them! We have put a ban for the ad companies to sell ads for these clients on our site.”, and the admins of mininova and btjunkie also banned all ads for these BitTorrent clients on their websites.

People need to be aware that these clients can seriously mess-up up your computer, and the Google adwords campaigns were a fun way to do this. I’m happy to see that Google search is giving a helping hand as well, for free.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.