Can you point to exactly where you downloaded player from? I'd like to try and replicate this.
Note, funwebproducts is usually installed by an existing trojan, or through a bundle on a third party download site. The spyware has been unmaintained for several years so I don't see this being a new VMware development.