Alert level

Adware:Win32/Playmp3z


Encyclopedia entry
Updated: Jan 19, 2009  |  Published: Apr 30, 2008

Aliases
  • Win32/Adware.PlayMP3Z (ESET)
  • not-a-virus:AdWare.Win32.Agent.zk (Kaspersky)
  • W32/Agent.EFDB (Norman)
  • Adware.Agent.gen (Sunbelt Software)

Alert Level (?)
Moderate

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection last updated:
Definition: 1.63.185.0
Released: Jul 24, 2009 		Detection initially created:
Definition: 1.45.287.0
Released: Oct 07, 2008

Summary

Adware:Win32/Playmp3z may display advertisements in connection with the use of a "free music player" from the site 'PlayMP3z.biz'.

Top

Symptoms

System Changes
The following system changes may indicate the presence of Adware:Win32/Playmp3z:
  • Presence of this registry subkey:
    HKEY_CURRENT_USER\Software\MediaHoldings

Top

Technical Information (Analysis)

Adware:Win32/Playmp3z may display advertisements in connection with the use of a "free music player" from the site 'PlayMP3z.biz'.
Installation
Win32/Playmp3z may be installed as a component of a "free music player" from the site 'PlayMP3z.biz'.
 
After Win32/Playmp3z is installed, it queries the following registry subkey to identify the operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
 
It then queries the following registry subkey to identify the path of Internet Explorer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
 
Win32/Playmp3z uses Internet Explorer to download components from external Web sites, and uses the string "Mozilla" as a user agent. The installer for Win32/Playmp3z may create the following registry subkey and add a unique data value:
HKEY_CURRENT_USER\Software\MediaHoldings
 
Win32/Playmp3z may connect with the site 'PlayMP3z.biz' - if it fails to connect it displays the following error message:
 
Analysis by Francis Allan Tan Seng

Top

Prevention

Follow these general security tips to better protect your system:
  • Enable a firewall on your computer.
  • Get the latest computer updates.
  • Run an up-to-date scanning and removal tool.
  • Use caution with attachments and file transfers.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Network and Internet Connections. If you do not see Network and Internet Connections, click Switch to Category View.
  3. Click Change Windows Firewall Settings.
  4. Select On.
  5. Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Performance and Maintenance. If you do not see Performance and Maintenance, click Switch to Category View.
  3. Click System.
  4. Click Automatic Updates.
  5. Select a setting. Microsoft recommends selecting Automatic. If you do not choose Automatic, but you choose to be notified when updates are ready, a notification balloon appears when new downloads are available to install. Click the notification balloon to review and install the updates.
Run an up-to-date scanning and removal tool
Most scanning and removal software can detect and prevent the installation of known malicious software and potentially unwanted software such as adware or spyware. You should frequently run a scanning and removal tool that is updated with the latest signature files. For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.
Use caution with attachments and file transfers
Exercise caution with e-mail and attachments received from unknown sources, or received unexpectedly from known sources.  Use extreme caution when accepting file transfers from known or unknown sources.

Top

Recovery

Adware:Win32/Playmp3z may place an uninstaller entry in "Add or Remove Programs" in Control Panel. The following are possible names of applications from the site 'PlayMP3z.biz':
  • BrowsingAdvisor
  • BrowsingEnhancer
  • BrowsingProgram
  • BrowsingSoftware
  • BrowsingTool
  • ContextAdvisor
  • ContextEnhancer
  • ContextProgram
  • ContextTool
  • ErrorsTool
  • FBrowsingAdvisor
  • IntelligentAdvisor
  • InternetProgram
  • InternetSoftware
  • NavigationAdvisor
  • NavigationEnhancer
  • NavigationProgram
  • NavigationTool
  • PlayMP3
  • SmartEnhancer
  • StatsTool
  • SurfingAdvisor
If an uninstaller is not available or if you do not want to use the uninstaller that is provided, use Microsoft Windows Defender or another up-to-date scanning and removal tool to detect and remove Win32/Agent.E and other potentially unwanted software from your computer. For more information, see http://www.microsoft.com/protect/products/computer/default.mspx.

Top