Trojan -- loader.exe in Windows Media Player folder

[Jim Watkins]

I recently downloaded the basic RealAudio Player in order
to listen to a file with that format. By coincidence or
not, Norton Anti-Virus shortly after that notified me
that I had a Trojan in the Windows Media Player folder
labled loader.exe. I managed to quarantine it with
Norton, but can not delete it.

Has anyone else had this problem? Is there a way to
delete loader.exe and continue to use Windows Media
Player?

I tried to uninstall Windows Media Player with the idea
of re-installing a fresh version, but was unable to do
that using the add/remove programs option.

 

[Doug Knox MS-MVP]

Loader.exe is not part of Windows Media Player, it is the virus/trojan.
Click Start, Run and enter TASKMGR.EXE to run Task Manager. Locate the
loader.exe process in the Processes tab. Highlight it and click End
Process. Then run your AV software again.

You'll also need to delete the Registry entries that run this trojan. See
www.dougknox.com, Win XP Utilities, Startup Programs Tracker. This small
utility scans your system for startup programs and running processes and
will show you where things are loading from. If you opt to post the results
in a reply, DO NOT include the running services information.

 

[KTT]

Can I delete "loader.exe" safely from the registry?
Thanks in advance...
Keith

 

[Doug Knox MS-MVP]

I would say so, Keith, but it may depend on where it is in the Registry. If
you're sure that the value is pointing to the loader.exe file in the Media
Player folder, then its probably safe to delete. If in doubt, right click
the key that the value is in and select Export. This creates a backup.