Media_Play_AIR+

Media_Play_AIR+

Known Adware

by Kimahri Software inc.

What is Media_Play_AIR+?

Media_Play_AIR+ is software application developed by Kimahri Software inc.. It is most commonly found on computers running Windows 7 with nearly 64.75% of installations running this operating system. Media_Play_AIR+'s installer is typically 10.00 MB in size and installs around 32 files.

Media_Play_AIR+ is most popular in the United States with 50.00% of installations residing in this country.

Media_Play_AIR+ adds 1 scheduled task to the Windows Task Scheduler launching the program at randomly scheduled times.

About Media_Play_AIR+?

This adware integrates with popular web browsers such as Internet Explorer, Chrome, and Firefox, inserting out-of-context advertising on unrelated websites. Users may encounter banner and video ads, search-related ads, transitional and in-text ads, and links. The adware also automatically updates and communicates with its home server for new advertising content and reports on user interactions, domain visits, and web page views.

Multiple virus scanners have detected malware in Media_Play_AIR+.

Media_Play_AIR+-updater.exe (MD5: e3f9e7e66bbf3ab08023cb85a8a352cf) has been flagged by 7 scanners:
Scanner Software Result
Baidu-International Adware.Win32.CrossRider.BX
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.X
G Data Win32.Application.Plush.A
Panda Antivirus PUP/PlusHD
Symantec Adware.Crossid
VIPRE Antivirus Crossrider (fs)
Vba32 AntiVirus suspected of Trojan.Downloader.gen.h
Media_Play_AIR+-novainstaller.exe (MD5: d2125ccf84c9dd6d642a3286f6158ae0) has been flagged by 26 scanners:
Scanner Software Result
Avira AntiVir Adware/CrossRider.A.1637
Baidu-International Trojan.Win32.VMDetector.108
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.AC
Fortinet FortiGate Riskware/Toolbar_CrossRider
K7 AntiVirus Unwanted-Program ( 00454f261 )
K7GW Unwanted-Program ( 00454f261 )
Malwarebytes PUP.Optional.MediaPlayerPlus.A
McAfee Artemis!D2125CCF84C9
McAfee-GW-Edition Artemis!D2125CCF84C9
Sophos AppRider
TrendMicro-HouseCall TROJ_GEN.F47V0604
VIPRE Antivirus Crossrider (fs)
AVG Generic.BEF
Qihoo-360 Win32/Virus.Adware.537
Antiy-AVL Trojan/Win32.TSGeneric
NANO AntiVirus Riskware.Win32.AdLoad.dbayto
Symantec WS.Reputation.1
Bitdefender Gen:Variant.Adware.Kazy.374062
Emsisoft Anti-Malware Gen:Variant.Adware.Kazy.374062 (B)
F-Secure Gen:Variant.Adware.Kazy.374062
G Data Gen:Variant.Adware.Kazy.374062
MicroWorld-eScan Gen:Variant.Adware.Kazy.374062
Panda Antivirus PUP/PlusHD
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Comodo Security ApplicUnwnt
Vba32 AntiVirus suspected of Trojan.Downloader.gen.h
Media_Play_AIR+-nova.exe (MD5: b6d6bfbceaa142b503a2fe19fa5607bd) has been flagged by 32 scanners:
Scanner Software Result
Agnitum Outpost PUA.Toolbar.CrossRider!
Avira AntiVir Adware/CrossRider.A.6742
avast! Win32:Adware-gen [Adw]
Baidu-International Adware.Win32.CrossRider.bAE
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.AE
Fortinet FortiGate Riskware/Toolbar_CrossRider
G Data Win32.Application.Plush.A
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Malwarebytes PUP.Optional.MediaPlayerPlus.A
McAfee Artemis!B6D6BFBCEAA1
McAfee-GW-Edition Artemis!B6D6BFBCEAA1
Panda Antivirus PUP/PlusHD
Qihoo-360 Win32/Virus.Adware.0ea
TrendMicro-HouseCall TROJ_GEN.F47V0601
VIPRE Antivirus Crossrider (fs)
Lavasoft Ad-Aware Gen:Variant.Adware.Kazy.374109
Bitdefender Gen:Variant.Adware.Kazy.374109
Emsisoft Anti-Malware Gen:Variant.Adware.Kazy.374109 (B)
F-Secure Gen:Variant.Adware.Kazy.374109
IKARUS anti.virus Win32.SuspectCrc
MicroWorld-eScan Gen:Variant.Adware.Kazy.374109
Tencent Win32.Risk.Adware.Tcvv
AVG Generic.BEF
K7 AntiVirus Unwanted-Program ( 00454f261 )
K7GW Unwanted-Program ( 00454f261 )
Sophos AppRider
Dr.Web Trojan.Crossrider.17967
Symantec Adware.Crossid
Antiy-AVL Trojan/Win32.TSGeneric
NANO AntiVirus Riskware.Win32.AdLoad.dbayto
Comodo Security ApplicUnwnt
Vba32 AntiVirus suspected of Trojan.Downloader.gen.h
Media_Play_AIR+-firefoxinstaller.exe (MD5: 8ddc4132dad0c4d65c057ef183b48627) has been flagged by 27 scanners:
Scanner Software Result
Avira AntiVir Adware/CrossRider.A.6391
AVG Generic5.AULN
Baidu-International Adware.Win32.CrossRider.bAD
Dr.Web Trojan.Crossrider.17967
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.AD
G Data Win32.Application.Plush.A
McAfee Artemis!8DDC4132DAD0
McAfee-GW-Edition Artemis!8DDC4132DAD0
Panda Antivirus PUP/PlusHD
Sophos Generic PUA DK
Symantec Adware.Crossid
TrendMicro-HouseCall TROJ_GEN.F47V0530
VIPRE Antivirus Crossrider (fs)
Fortinet FortiGate Riskware/Toolbar_CrossRider
K7 AntiVirus Unwanted-Program ( 00454f261 )
K7GW Unwanted-Program ( 00454f261 )
Malwarebytes PUP.Optional.MediaPlayerPlus.A
Qihoo-360 Win32/Virus.Adware.537
Antiy-AVL Trojan/Win32.TSGeneric
NANO AntiVirus Riskware.Win32.AdLoad.dbayto
Bitdefender Gen:Variant.Adware.Kazy.374062
Emsisoft Anti-Malware Gen:Variant.Adware.Kazy.374062 (B)
F-Secure Gen:Variant.Adware.Kazy.374062
MicroWorld-eScan Gen:Variant.Adware.Kazy.374062
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Comodo Security ApplicUnwnt
Vba32 AntiVirus suspected of Trojan.Downloader.gen.h
Media_Play_AIR+-enabler.exe (MD5: 7b2e54655f9316bbfc6d345c699b7d55) has been flagged by 32 scanners:
Scanner Software Result
Avira AntiVir Adware/CrossRider.A.6462
avast! Win32:Adware-gen [Adw]
Baidu-International Adware.Win32.CrossRider.BX
Dr.Web Trojan.Crossrider.18512
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.X
Fortinet FortiGate Riskware/Toolbar_CrossRider
G Data Win32.Application.Plush.A
Malwarebytes PUP.Optional.MediaPlayerPlus.A
McAfee Artemis!7B2E54655F93
McAfee-GW-Edition Artemis!7B2E54655F93
Panda Antivirus PUP/PlusHD
Sophos AppRider
Symantec Adware.Crossid
TrendMicro-HouseCall TROJ_GEN.F47V0530
VIPRE Antivirus Crossrider (fs)
Bitdefender Gen:Variant.Adware.Kazy.374062
Emsisoft Anti-Malware Gen:Variant.Adware.Kazy.374062 (B)
F-Secure Gen:Variant.Adware.Kazy.374062
MicroWorld-eScan Gen:Variant.Adware.Kazy.374062
Qihoo-360 Win32/Virus.Adware.2df
Agnitum Outpost PUA.Toolbar.CrossRider!
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Lavasoft Ad-Aware Gen:Variant.Adware.Kazy.374109
IKARUS anti.virus Win32.SuspectCrc
Tencent Win32.Risk.Adware.Tcvv
AVG Generic.BEF
K7 AntiVirus Unwanted-Program ( 00454f261 )
K7GW Unwanted-Program ( 00454f261 )
Antiy-AVL Trojan/Win32.TSGeneric
NANO AntiVirus Riskware.Win32.AdLoad.dbayto
Comodo Security ApplicUnwnt
Vba32 AntiVirus suspected of Trojan.Downloader.gen.h

Software Behaviors

Scheduled tasks:
  • Uninstall.exe is scheduled as a task with the class '{D72B0399-7CA2-435A-8296-7856C8114B5E}' (runs on registration).

Startup Entries

Startup tasks:
  • dca6915e-c188-42e3-ae3b-6edb861f0320-3.exe is automatically launched at startup through a scheduled task named dca6915e-c188-42e3-ae3b-6edb861f0320-3.
  • Media_Play_AIR+-nova.exe is automatically launched at startup through a scheduled task named dca6915e-c188-42e3-ae3b-6edb861f0320-7.
  • 2c878fba-4668-491f-8140-950acbbefcfd-3.exe is automatically launched at startup through a scheduled task named 2c878fba-4668-491f-8140-950acbbefcfd-3.
  • Media_Play_AIR+-codedownloader.exe is automatically launched at startup through a scheduled task named Media_Play_AIR+-novainstaller.
  • 2c878fba-4668-491f-8140-950acbbefcfd-5.exe is automatically launched at startup through a scheduled task named 2c878fba-4668-491f-8140-950acbbefcfd-5.
  • 2c878fba-4668-491f-8140-950acbbefcfd-4.exe is automatically launched at startup through a scheduled task named 2c878fba-4668-491f-8140-950acbbefcfd-4.

Software Details

URL:
https://crossrider.com/install/58488-med-play-air-++
Support:
–
Installation path:
C:\Program Files\media_play_air+
Uninstaller:
C:\Program Files\Media_Play_AIR+\Uninstall.exe /fcp=1
Size:
10.00 MB
Language:
English

Media_Play_AIR+ Executable Details

Primary executable:
Media_Play_AIR+-bho.dll
Name:
Media_Play_AIR+
Path:
C:\Program Files\media_play_air+\Media_Play_AIR+-bho.dll
MD5:
f96729ea90e8bf309e943f9ca80577c5
SHA-1:
–
SHA-256:
–
Files installed by Media_Play_AIR+
File Type Filename MD5
EXE
91b456c1-be2d-4c3a-a875-6101ffc02aa9-5.exe
Malware
56a8ebcd7df85094e3e749a9826e2b26
EXE
91b456c1-be2d-4c3a-a875-6101ffc02aa9-4.exe
Malware
a894edaced779a8b713c4760b25c4202
EXE
91b456c1-be2d-4c3a-a875-6101ffc02aa9-3.exe
Malware
08d2a43054fa4d27d0f676074e977637
EXE
91b456c1-be2d-4c3a-a875-6101ffc02aa9-2.exe
Malware
da4e7f4bc309a0adf667cf1daf87cf26
EXE
5d34f10d-076a-4b95-8a7b-2e7c7e1940b5-5.exe
Malware
abc6afdebdb9077690140990ef529165
EXE
5d34f10d-076a-4b95-8a7b-2e7c7e1940b5-4.exe
Malware
cb443784fc8c64c70b128537abe6b9be
EXE
5d34f10d-076a-4b95-8a7b-2e7c7e1940b5-3.exe
Malware
f980161b53470074c3f2d49fe487d02e
EXE
5d34f10d-076a-4b95-8a7b-2e7c7e1940b5-2.exe
Malware
53de7c5aa8ff56b7196467d2b55fd583
EXE
2c878fba-4668-491f-8140-950acbbefcfd-5.exe
Malware
caf7e710343cc1e4dca921a7a5854418
EXE
2c878fba-4668-491f-8140-950acbbefcfd-4.exe
Malware
d250ecb22b6906c8f89cb34e7fd8b749