VideoPlay
Threat LevelDamageDistribution

Effects 

VideoPlay carries out the following actions:

• It is an adware program that passes itself off as a codec to view videos. This malware is usually downloaded from dubious websites where videos can be viewed.
• When the users try to watch a video, they are required to download and install a codec, as can be seen in the following image:
  
  
• If the downloaded file is run, a false codec to view the video will be installed in the computer.
• The program has the following icon, imitating a clapperboard:
  
  
• When it is run, the installation process of the application starts and several screens are displayed, among them, the following:
  
  
• Once the installation process finishes, if the users access the option Programs of the Start menu, they will see a folder created with the name of the program, but actually no program has been installed:
  
  
• What has been run is a file belonging to a worm designed to:
  -  Make copies of itself in the system drives, both shared and removable. Additionally, it creates an AUTORUN.INF file in them so that the copies of itself are run when the users access those drives.
  - Steal the stored data in the Internet browsers, such as email accounts, login passwords to different web services...
  Then, it attempts to connect to an address to send the data it has gathered.

Means of transmission 

VideoPlay can be downloaded from certain dubious websites passing itself as a codec to view videos.

Further Details  

VideoPlay is 117,273 bytes in size.