Mplayer2.exe and Download.Trojan problem

R

RedFox

Esteemed Virus Gurus :)

I have been running NAV on an installation of
Win2k, now with SP4, for almost two years. I cannot
remember installing WMP and I was not interested
in it. Meantime I ran NAV at least every week on
the drive.

A couple of weeks ago I was surprised to see
Windows Media Player in the C:\program files
folder. I clicked on the folder for some reason
and NAV popped up a message Virus Alert - object
name C:\prog files\Windows Media Player\wmplayer.exe.
Virus name: Download.Trojan. It indicated that the virus
was automatically deleted.

Curiously there was no wmplayer.exe but there was
a mplayer2.exe and 4 other files: 3 dlls and a
logagent.exe. In the past few months there were
several attempts by mplayer2.exe to access the
Internet but Zonealarm blocked it. At that time I
didn't know where this program was. At one time I
noticed it in the control panel and I removed it.
Mplayer2.exe has a file version 6.4.9.1109

Today I clicked on that folder again and the NAV
virus alert popped again with the same message as
before. I then tried to delete the files but
within ten seconds they were back. I renamed a
few but very soon the original files were back.
Now I know that windows 2k has an auto mechanism
that replaces system files if the are deleted, but
these are not system files and I suspect that
there is a virus there.

I used NAV to quarantine the two .exe files but
I doubt that will do any good.

I have been an NAV subscriber for two years and,
the first time I need to contact them, I see that they charge
$30 or $3 an minute. Does the competition have these kind
of charges? I would think subscribers should at least have
one or two free incidents per year.

TIA

MR
 
D

David W. Hodgins

Today I clicked on that folder again and the NAV
virus alert popped again with the same message as
before. I then tried to delete the files but
within ten seconds they were back. I renamed a

Try running an online scan of your system.

See http://www.claymania.com/anti-virus.html for a list of available sites.

I suspect you'll find bugbear. You may want to try the removal instructions at
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

Regards, Dave Hodgins
 
R

RedFox

David W. Hodgins said:
Try running an online scan of your system.

See http://www.claymania.com/anti-virus.html for a list of available sites.

I suspect you'll find bugbear. You may want to try the removal instructions at
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
oval.tool.html

Regards, Dave Hodgins

--

Thanks Dave for the suggestions.

I scanned (from the Internet) using NAV (I should have guessed!) and McAffee
and they found nothing. I dnloaded the W32.BugBear.B and ran it, but it
found nothing.

RF
 
D

David W. Hodgins

I scanned (from the Internet) using NAV (I should have guessed!) and McAffee
and they found nothing. I dnloaded the W32.BugBear.B and ran it, but it
found nothing.

Try using filemon from http://sysinternals.com/ to at least find out which
process is recreating the files. Then post back with the results.

Regards, Dave Hodgins
 
R

RedFox

David W. Hodgins said:
Try using filemon from http://sysinternals.com/ to at least find out which
process is recreating the files. Then post back with the results.

Regards, Dave Hodgins
Thank you David.

I cleaned out all the mplayer2 entries from the registry. Now all that
remains is the folder "windows media player" - all in lower case. I cannot
delete this. At least there are no files there any more. It will be
interesting to see what Windows Update does with it.

Thanks again.

RF
 
D

David W. Hodgins

I cleaned out all the mplayer2 entries from the registry. Now all that
remains is the folder "windows media player" - all in lower case. I cannot
delete this. At least there are no files there any more. It will be
interesting to see what Windows Update does with it.

Did you check the directory attribute settings for hidden/system/readonly?

Regards, Dave Hodgins
 
R

RedFox

David W. Hodgins said:
Did you check the directory attribute settings for hidden/system/readonly?

Regards, Dave Hodgins

Thanks again David.

I do have the "Show hidden files and folders" selected in the Win2K Tools |
..Folder options.
The directory still will not delete. -- sharing violation - the source may
be in use. I
did a search of the drive for "windows media player" and found 24 entries in
the 16 SP4
$NtUninstall..............$ folders just under the WINNT directory. A
typical entry is:

"d:\program files\windows media player.restore.files" = 0, "d:\program
files\windows media player"

Note that wmp is all lower case. These entries could be the reason for not
allowing deletion of the folder. Quite a sloppy SP4 install program that
doesn't delete the "undo" entries after a successful SP installation. Now
I'm pondering whether to delete all these folders and files.

Yesterday I had a ms that my Windows updates were ready for installation.
One of the two related to WMP, which I deleted instantly. It could be that I
didn't choose Custom when I recently reinstalled Win2K to this drive and it
installed wmp. Now I'm paying for my negligence.

Looks like MicroShaft may be doing its best to force wmp on us :-( I'm
happy with dinky little FooBar2000 :)

Thanks again.

RF
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top