BitTorrent Malware Spreads to Media Players
-from Torrent Freak
When someone or something becomes a huge success, inevitably some people want a piece of that and try to cash in. The BitTorrent scene is no exception and in recent months we have reported on a raft of torrent clients hitting the internet, each installing malware on unsuspecting user’s PC’s. Sadly this disease is now spreading to their latest tool; malware-infected media players.
We have regularly reported on BitTorrent clients which also install malware such as Torrent101, BitRoll, TorrentQ and GetTorrent and have done our very best to let people know about the dangers of using such a product.
Unfortunately, as fast as we report such things, the malware peddlers can create yet another and another and another bad client with new names, but carrying the same bad story. However, these guys are very determined to get software such as CIDHELP on your machine, ready to watch your activities and to this end have become quite creative. Recently BitTorrent users are reporting that they have downloaded various pieces of video (usually a TV show) only to be confronted with a message during the first few seconds of the video which advises them to download a new media player called 3wPlayer, in order to view the rest of the file.
The displayed url directs the unsuspecting to the Play3W site, where they are given the chance of installing a shiny new media player.

From the screenshot you will see that there is a ‘more’ button and when you install this player ‘more’ is exactly what you get - more malware in the form of CIDHELP, yet again. It can be difficult task to uninstall it too, especially when you consider the veiled legal threat on the CIDHELP site - the vendor warns you could be in breach of the EULA if you try to remove it with your anti-spyware software. To get rid of the software, they advise to first turn off your anti-adware/spyware software and re-install the software, something that rings a few alarm bells!
It may seem that every pusher in the world is getting involved in the BitTorrent malware scene but a simple WHOIS on all the domains hosting the torrent clients listed above, (Torrent101 for example) including the 3wPlayer site, reveals that they are more than likely the same outfit, exploiting the less experienced members of the BitTorrent community. Anyone concerned about a particular torrent should take the time to read the user comments on the site where the torrent was downloaded from. Very often problems such as fake files are spoken about there.
Anyone needing a media player that will deal with almost any video format should consider the excellent VLC Media Player, available for free download. Those who still haven’t settled on a quality BitTorrent client will find everything they need by getting uTorrent. No spyware, adware or malware present in either product.
11 Comments
Comments RSS TrackBack Identifier URI
Leave a comment

Thank you so much for posting this. I just recently downloaded a movie using bittorrent (today!) and the same exact message stating that i would need to install play3w came on when I played the video with VLC. Let’s hope that no one falls for this.
thanks be to god that this crap doesn’t work on ubuntu
Thanks a million!!! I almost fell for this crap. I just thought of checking on the reviews while the software was being downloaded
I just downloaded a movie and got a message that I needed 3wplayer. I have VMware 6 Workstation on my PC and if I am worried about downloaded software, I install it on a clone of a vertual PC. If the software is bad, I delete the clone. No more problem. I tried the player and then deleted the vertual pc.
Thanks for the notes. I just downladed a movie that gave me this error and i immediately went searching for reviews on 3w and its player. I got lazy and didnt check the reviews on the torrent. saved me a ton of work you did.
Thank a million I just D/L a file that requested the 3wplayer as well and I use VLC and utorrent allready so something smelled fishy.
in addition the 3wplayer site took a couple extra seconds to load and that made me suspicious so I looked for reviews.
Can anyone tell what to do withfiles which have this message, i recently downloaded 3 movies with getting same kind of message. how to remove that message, or do we have to just delete those infected files???
My brother fell for this, sadly. I went into the control panel and removed the player, but I suspect it could be lurking around on my computer under a different name. Any suggestions?
I’m thinking about wiping my entire hard drive and then reformatting, but I’d like to avoid such an extreme measure if possible.
Can you make any recommendations in so far as malware software is concerned?
i too downloaded this kind of movie, but i of course became suspicious and looked for reviews for this 3wPlayer
thanks for alerting people of this!
Cool.
Thanks guys! This is really helpful. I am going back to the torrent site to comment on the fraud torrent I just spent hours downloading on!!!