Just wanted to let you know about a new adware variant called Media_Play_AIR+ that I found tonight. 8 of the 50 anti-virus scanners at VirusTotal detects the Media_Play_AIR_1.1-bg.exe file, which you may see in the Windows Task Manager: Some of the anti-virus program calls Media_Play_AIR+ Artemis, CrossRider and AppRider.
These are the variants I’ve found so far:
I found Media_Play_AIR+ bundled with a Zip/Unzip utility. The setup file was digitally signed by CloverMedia SL. How did you get Media_Play_AIR on your computer? The Media_Play_AIR+ files are digitally signed by individual developer SIMONA-VIORICA MARIN, which according to the certificate is located in Bucharest, Romania. You can remove Media_Play_AIR+ with FreeFixer. Just select the Media_Play_AIR+ files as shown in the screenshots. Most of the files are located in c:\Program Files \Media_Play_AIR+_1.1 or c:\Program Files (x86)\Media_Play_AIR+_1.1 on 64-bit Windows. Media_Play_AIR+ is a variant of MPlayerPlus. Since the removal procedure is the same I’ll link that removal video where you can see FreeFixer in action removing the adware: Hope you found this useful.