Windows Media Player Keeps Popping Up

[readermaniax]

Well, I was having this problem for a loong time.. WMP used to keep popping up. That time i just re installed windows. (a fresh Install)
But, The Problem Didnt Go!

Im on a Win XP SP2

And - Kaspersky shows that i dont have any kind of a threat on mah PC

It was like.. the moment i installed WIndows and Just retarted pc.. windows loaded.. desktop came.. and Boom.. WMP kept popping up fr no Fkn reason

[slugger]

have u put d WMP in ur starup entrie

or any media-realted entry dat cna startup WMP

[sakumar79]

Post your hijackthis log to help diagnose the problem

Arun

[slugger]

OR JUST TELL US wat u got here

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

if ne thin its most likely 2 b here

[readermaniax]

Logfile of HijackThis v1.99.1
Scan saved at 2:44:31 PM, on 9/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Explorer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Web Accelerator\slipcore.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\BandwidthMonitor\BWMonitor.exe
C:\Program Files\Premium Booster\scheduler.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\RazR\Desktop\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Web Accelerator\PBHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Explorer] C:\WINDOWS\system32\Explorer.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Web Accelerator\slipcore.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BandwidthMonitor] C:\Program Files\BandwidthMonitor\BWMonitor.exe
O4 - HKCU\..\Run: [pb_scheduler_agent] C:\Program Files\Premium Booster\scheduler.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E232DB8B-634B-429E-B5E5-8862A9631C49}: NameServer = 59.179.243.70,203.94.243.70
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: Explorer - C:\WINDOWS\SYSTEM32\Explorer.dll

[b]@slugger.. I dont know.. dint do anything.. Startup looks fineee

Bump

[slugger]

ok d00d can u just tell me wat entry u have in here

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

(verify which of d last 2 paths exist in ur registry and post d result accordingly)

[readermaniax]

[slugger]

Originally Posted by readermaniax

i think it is d HKEY_Local_Machine entry

cau give d HKEY_CURRENT_User entry

HCU shud also hav a key called Run

[readermaniax]

Here You Go :s

[sakumar79]

There are 2 different Explorer.exe entries C:\WINDOWS\system32\Explorer.exe
C:\WINDOWS\Explorer.EXE

The one in system32 folder is not the real Explorer.exe - could be some malware... It might be causing the problem... Try using hijackthis to remove it (and its HKLM\..Run entry) and post your results...

Arun

[readermaniax]

okey Brother, Will try that. But i dont get this, the moment i foramted the pc and installed windows again..
the prob dint go!

THANXXX

Buddies..

No pop up till Now..

[slugger]

ur OS setup files probably infected