Media Player

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Ioadqm	Media Player.exe	"Added by the HAWAWI WORM!"
X	Media Player	media.exe	"Added by the FLDMEDIA-A TROJAN!"
X	Media Player	wmplayer.exe	"Added by a variant of the AGOBOT.BM WORM! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Media Player	Sysdll.exe	"Added by the BANKER-BR TROJAN!"
X	Media Player	Sysnet.exe	"BANKER.MW spyware"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Media player 9	msmedia32.exe	"Added by the RBOT-ADO WORM!"
X	Microsoft Windows Media Player	mediaplayer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Media Player	wimp.exe	"Added by the RBOT-FN WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Real Media Player	realplayer2.exe	"Added by a variant of the RBOT WORM!"
X	Winamp media player	winapa.exe	"Added by an unidentified VIRUS
X	Winamp Media Player	winamap.exe	"Added by the SDBOT.ACJM BACKDOOR!"
X	Winamp Media Player	winamp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of %ProgramFiles%"
X	Windows Media Player	wmediaplayer.exe	"Added by the AGOBOT-NQ WORM!"
X	Windows Media Player	MediaPIayer.exe	"Added by the SDBOT-QO TROJAN! Note - the lower case ""l"" in ""MediapIayer"" is a capital ""i"""
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	msa.exe	"Added by the RBOT-SI WORM!"
X	Windows Media Player	mcafe32.exe	"Added by the RBOT-YO WORM!"
X	Windows Media Player	wmplayer.exe	"Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Windows Media Player	50cent.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	mpwe.exe	"Added by the RBOT-TT WORM!"
X	Windows Media Player	msams.exe	"Added by the RBOT.AHR WORM!"
X	Windows Media Player	vmmreg32.exe	"Added by the AGENT.AQO TROJAN!"
X	Windows Media Player	msass43.exe	"Added by the RBOT-RT WORM!"
X	Windows Media Player	mpupdata.exe	"Added by the SDBOT.BBG WORM!"
X	Windows Media Player	wmplayerc.exe	"Added by the SILLYFDC.DBG WORM!"
X	Windows Media Player 3.6	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 3.6b	WMPA36B.EXE	"Added by the RBOT-VV WORM!"
X	Windows Media Player 3.6d	wmpa36d.exe	"Added by the RBOT-YA WORM!"
X	Windows Media Player 3.9	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 6.1.2	wmplayer612.exe	"Added by the RBOT.AIB BACKDOOR!"
X	Windows Media Player Service	wmedia.exe	"Added by the RBOT.213504 WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.