What is BeansPlayer?
The Malwarebytes research team has determined that BeansPlayer is adware. These adware applications display advertisements not originating from the sites you are browsing.
How do I know if my computer is affected by BeansPlayer?
You may see this entry in your list of installed programs and features:
this icon in your startmenu and your desktop:
and this warning during install:
This is the main screen of the program:
How did BeansPlayer get on my computer?
Adware applications use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove BeansPlayer?
Our program Malwarebytes can detect and remove this potentially unwanted program.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes BeansPlayer completely.
- The shortcut called BeansPlayer on the desktop can be deleted if it belonged to the rogue.
Technical details for experts
Possible signs in FRST logs:
() C:\Program Files (x86)\BeansPlayer\BeansPlayer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BeansPlayer.lnk
C:\Users\Public\Desktop\BeansPlayer.lnk
C:\Program Files (x86)\BeansPlayer
BeansPlayer version 1.0 (HKLM-x32\...\{0DB86D3A-F3B4-4541-AD28-D31249B2AF8E}_is1) (Version: 1.0 - BeansPlayer)Alterations made by the installer:File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Program Files (x86)\BeansPlayer
Adds the file bass.dll"="2/14/2017 12:14 PM, 206336 bytes, A
Adds the file Bass.Net.dll"="8/25/2009 11:00 AM, 565248 bytes, A
Adds the file BeansPlayer.exe"="2/15/2017 1:59 PM, 1338368 bytes, A
Adds the file BeansPlayer.exe.config"="3/23/2017 1:19 PM, 1141 bytes, A
Adds the file Microsoft.WindowsAPICodePack.dll"="1/28/2010 2:18 PM, 90112 bytes, A
Adds the file Microsoft.WindowsAPICodePack.Shell.dll"="1/28/2010 2:18 PM, 527360 bytes, A
Adds the file taglib-sharp.dll"="1/26/2010 3:47 PM, 307200 bytes, A
Adds the file unins000.dat"="4/25/2017 4:04 PM, 1650 bytes, A
Adds the file unins000.exe"="4/25/2017 4:04 PM, 722597 bytes, A
In the existing folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs
Adds the file BeansPlayer.lnk"="4/25/2017 4:04 PM, 1055 bytes, A
In the existing folder C:\Users\Public\Desktop
Adds the file BeansPlayer.lnk"="4/25/2017 4:04 PM, 1043 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0DB86D3A-F3B4-4541-AD28-D31249B2AF8E}_is1]
"DisplayName"="REG_SZ", "BeansPlayer version 1.0"
"DisplayVersion"="REG_SZ", "1.0"
"EstimatedSize"="REG_DWORD", 3659
"Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\BeansPlayer"
"Inno Setup: Deselected Tasks"="REG_SZ", ""
"Inno Setup: Icon Group"="REG_SZ", "(Default)"
"Inno Setup: Language"="REG_SZ", "english"
"Inno Setup: Selected Tasks"="REG_SZ", "desktopicon"
"Inno Setup: Setup Version"="REG_SZ", "5.5.8 (a)"
"Inno Setup: User"="REG_SZ", "{username}"
"InstallDate"="REG_SZ", "20170425"
"InstallLocation"="REG_SZ", "C:\Program Files (x86)\BeansPlayer\"
"MajorVersion"="REG_DWORD", 1
"MinorVersion"="REG_DWORD", 0
"NoModify"="REG_DWORD", 1
"NoRepair"="REG_DWORD", 1
"Publisher"="REG_SZ", "BeansPlayer"
"QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\BeansPlayer\unins000.exe" /SILENT"
"UninstallString"="REG_SZ", ""C:\Program Files (x86)\BeansPlayer\unins000.exe""
Malwarebytes log:Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 4/25/17
Scan Time: 4:13 PM
Logfile: mbamBeansPlayer.txt
Administrator: Yes
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.96
Update Package Version: 1.0.1804
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 328342
Time Elapsed: 1 min, 30 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 1
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\BeansPlayer.exe, Quarantined, [8862], [383832],1.0.1804
Module: 2
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\bass.dll, Quarantined, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\BeansPlayer.exe, Quarantined, [8862], [383832],1.0.1804
Registry Key: 1
PUP.Optional.BeansPlayer, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0DB86D3A-F3B4-4541-AD28-D31249B2AF8E}_is1, Delete-on-Reboot, [8862], [383832],1.0.1804
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 1
PUP.Optional.BeansPlayer, C:\PROGRAM FILES (X86)\BEANSPLAYER, Delete-on-Reboot, [8862], [383832],1.0.1804
File: 10
PUP.Optional.BeansPlayer, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\BEANSPLAYER.LNK, Delete-on-Reboot, [8862], [383833],1.0.1804
PUP.Optional.BeansPlayer, C:\PROGRAM FILES (X86)\BEANSPLAYER\UNINS000.DAT, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\bass.dll, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\Bass.Net.dll, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\BeansPlayer.exe, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\BeansPlayer.exe.config, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\Microsoft.WindowsAPICodePack.dll, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\Microsoft.WindowsAPICodePack.Shell.dll, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\taglib-sharp.dll, Delete-on-Reboot, [8862], [383832],1.0.1804
PUP.Optional.BeansPlayer, C:\Program Files (x86)\BeansPlayer\unins000.exe, Delete-on-Reboot, [8862], [383832],1.0.1804
Physical Sector: 0
(No malicious items detected)
(end)At Malwarebytes we use different ways of protecting your computer(s):- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
