Home Malware Programs Adware PopCorn.net

PopCorn.net

Posted: September 22, 2006

ScreenshotPopCorn.net, also known as Movieland and MoviePass, is a P2P program that offers a 3 day free trial download for online users. PopCorn.net takes over the whole screen and displays pop-ups to keep reminding you that payment is due following the trial.

According to PopCorn.net's terms of service, unless you cancel the service during the three-day period, the company will bill you $29.95 a month. PopCorn.net billing reminder pops up even when you're not surfing the web. PopCorn.net comes bundled with malicious files that allow it to keep popping up requests for payment, making it difficult to remove.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 247cams.lnk
    2 agent.dll
    3 alconfig.xml
    4 alp2plib.log
    5 api.exe
    6 camnotifier.exe
    7 dm.exe
    8 downloadmanager.exe
    9 downloadmanager.ini
    10 downloadmanager.lnk
    11 entry.dll
    12 errorlog.txt
    13 insdl.dll
    14 install.log
    15 itbill.exe
    16 itbill_terms.txt
    17 license_manager.exe
    18 movieland.url
    19 movieland_access_g.exe
    20 movielandterms.html
    21 movielandterms.lnk
    22 mpp2pl.exe
    23 mptray.exe
    24 mpupdate.exe
    25 nodeipproc.exe
    26 p2pinst.exe
    27 p2pl.exe
    28 p2pnetworks.exe
    29 register.dll
    30 sp2p.cache
    31 terms.lnk
    32 uninst.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\247camsHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LicenseManagerHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\run247camsHKEY_CURRENT_USER\Software\NotifyHKEY_LOCAL_MACHINE\SOFTWARE\DownloadManagerHKEY_LOCAL_MACHINE\SOFTWARE\MediaPipeHKEY_LOCAL_MACHINE\SOFTWARE\itbillHKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\AMNotifier.HUBAWindowHKEY_CLASSES_ROOT\AMNotifier.HUBAWindow.1HKEY_CLASSES_ROOT\AppID\downloadmanager.exeHKEY_CLASSES_ROOT\AppID\mediapipe.exeHKEY_CLASSES_ROOT\AppID\mpagent.dllHKEY_CLASSES_ROOT\AppID\sp2p.exeHKEY_CLASSES_ROOT\AppID\trayicon.exeHKEY_CLASSES_ROOT\AppID\{4C0B0548-AE0B-4008-999D-DB33B8B2EB90}HKEY_CLASSES_ROOT\AppID\{626873AC-27F3-4D48-BE81-535CF2360071}HKEY_CLASSES_ROOT\AppID\{9236268D-8B29-49E5-96D9-DAF5FE76941C}HKEY_CLASSES_ROOT\AppID\{99C4F93D-42A7-478D-8746-4AFB6C10BC26}HKEY_CLASSES_ROOT\AppID\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}HKEY_CLASSES_ROOT\CLSID\{1E9ADAF2-4EDA-4074-96CE-C9972E675C88}HKEY_CLASSES_ROOT\CLSID\{48BB16AA-3F6C-4B28-9884-1FCEC1C5DA65}HKEY_CLASSES_ROOT\CLSID\{7BF58804-E672-4B96-8EEC-BFCCE6492C9A}HKEY_CLASSES_ROOT\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}HKEY_CLASSES_ROOT\CLSID\{DFE95408-FD86-4818-A30A-BC859D9658E1}HKEY_CLASSES_ROOT\DownloadManager.ManagerHKEY_CLASSES_ROOT\DownloadManager.Manager.1HKEY_CLASSES_ROOT\Interface\{1A7BCC8E-B65D-409A-BB67-57E8226D1780}HKEY_CLASSES_ROOT\Interface\{8E33F539-11BC-44E5-80BF-057FA1E511A6}HKEY_CLASSES_ROOT\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}HKEY_CLASSES_ROOT\Interface\{AFE46CDD-00CE-45EE-BB73-8349D624F7AF}HKEY_CLASSES_ROOT\Interface\{DE2BF8DA-A159-4758-8199-0B2435268212}HKEY_CLASSES_ROOT\MPAgent.AgentHKEY_CLASSES_ROOT\MPAgent.Agent.1HKEY_CLASSES_ROOT\MediaPipe.GUIHKEY_CLASSES_ROOT\MediaPipe.GUI.1HKEY_CLASSES_ROOT\SP2P.SP2PHKEY_CLASSES_ROOT\SP2P.SP2P.1HKEY_CLASSES_ROOT\TypeLib\{45C2360E-BFDF-439B-A3EA-65E8383F9353}HKEY_CLASSES_ROOT\TypeLib\{555FB512-9F3B-4359-9D2A-3C10E750CE5E}HKEY_CLASSES_ROOT\TypeLib\{97D860C4-F072-477B-B241-409F7CFFB954}HKEY_CLASSES_ROOT\TypeLib\{AB3B59A5-8BB4-46AB-A878-DFDB237D5BD5}HKEY_CLASSES_ROOT\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}HKEY_CLASSES_ROOT\appid\amnotifier.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MediaPipe P2P LoaderHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Notification UtilityHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}247camsMediaPipeNotifyitbillp2pnetworks
Loading...