Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

WMP is missing, and I'm sad and scared


  • Please log in to reply
7 replies to this topic

#1 eli

eli

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:02:00 PM

Posted 13 August 2004 - 03:50 PM

My WMP 9 has been taken over by an ad for zantrex 3. If
I try to lauch it or run wmplayer.exe it opens this ad
which plays on something other than WMP 9. It also opens
IE and directs it to a site to buy the product being
advertised. I've scanned my computer with everything
under the sun (nortons, ad-aware, spybot, stinger,
trojanhunter...). Nothing seems to help. My wmsetup
file (found in WINDOWS) is now extremely different than a
normal wmsetup file (I've compared to others running WMP
9 on XP). My file is about 10X as long as the normal
file, talks alot
about "userapproveoverdowning", "forceoverwrite", and
lots of copying. I know this is just telling me what is
happening, but I don't know what to do about it. Can
anyone help? Does anyone know where I can or should
turn? If anyone could help, I sure could use it. :thumbsup:
.

Edited by eli, 13 August 2004 - 03:58 PM.


BC AdBot (Login to Remove)

 


#2 Guest_brunt_*

Guest_brunt_*

  • Guests
  • OFFLINE
  •  

Posted 13 August 2004 - 04:04 PM

Simply go to add and remove software in WINXP. Look to the left for the Windows Setup Add/remove. Then when you're in, look for Windows Media Player. Unselect it and choose ok to remove it. It will resort back to the previous natural version that comes with WinXP. Then you can recheck it to restore it off the WINXP CD, OR download it from HEREas Windows Media Player Version 9. I would Go HERE as well and do a virus scan! It seems you might have the Wallon virus..

And Here is the Pacth for it Pacthed Version

#3 eli

eli
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  

Posted 13 August 2004 - 05:17 PM

Okay, I removed wmp 9 under windows components like you said. I then scanned using trend micro. It found a single file (called troj_by) and I deleted this file. I went to Microsoft and downloaded WMP 9, but I have a question. Do I want my system restore turned on or off. I've been told by others that if I have the restore turned on the virus will simply put itself back into the computer. Note: I scanned with trend micro with system restore disabled. Thanks for your help too. It's great. :thumbsup:

#4 Guest_brunt_*

Guest_brunt_*

  • Guests
  • OFFLINE
  •  

Posted 13 August 2004 - 05:20 PM

no turn system restore back on if you want to!I leave mine off all the time but its just a choice! But since you had it off when trend deleted the virus you can turn it back on. Since the virus is gone all is good!

#5 Guest_brunt_*

Guest_brunt_*

  • Guests
  • OFFLINE
  •  

Posted 13 August 2004 - 05:27 PM

also download this program it only has a 30 day trial but will get rid of any spyware in there and is much btter that adaware IMO



http://www.webroot.com/wb/products/spysweeper/index.php

#6 eli

eli
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:02:00 PM

Posted 13 August 2004 - 05:32 PM

Problem. So I turned system restore back on, and installed WMP 9. It installed, and after installing, the "other" player launched, ran the ad, and opened IE and directed it to that website. I'll run webroot, but any other thoughts, suggestions?

#7 Guest_brunt_*

Guest_brunt_*

  • Guests
  • OFFLINE
  •  

Posted 13 August 2004 - 05:34 PM

ya download HIJACK this from my site here and post the results in the hijack this forum! Seems maybe you got hijacked!!

http://webpages.charter.net/brunt73/

#8 eli

eli
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  

Posted 13 August 2004 - 06:31 PM

Thanks for your help. I've posted a hijack log on the hijack forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users