Windows XP 'hidden song' found on Windows 7 desktop

alex2000robert · 05 Feb 2013

Hello, today when booted up my pc found an WMA file with title '$291Ae3' (without quotes), I played it and it's the Windows XP Welcome Song! I was wondering how did I get it instantly on my desktop? (Note that it's hidden file) I have no Windows XP, no virtualization, etc... My Windows 7 is original too. How did I get it then? I have no viruses too. I'm adding an attachment right now to prove it. If you want, I can add the song too.

Cheers,

Alexandru

P.S: I didn't download it either... Just found it on desktop!

gregrocker · 05 Feb 2013

Run a full scan with Malwarebytes anyway just to be sure.

alphanumeric · 06 Feb 2013

Are you the only user of this PC? Where you or someone else looking for that song on the Internet? Did you install any software lately that may have used that song as background music during the install?

Erick Aguilar · 06 Feb 2013

I thought this would be related to OneStep..

patio · 06 Feb 2013

It may be there for XP Compatibility Mode...

alex2000robert · 06 Feb 2013

@gregrocker The malwarebytes scan gave me no results.
@alphanumeric I'm the only user, no search on Internet. No software with this music either
@Erick Aguilar What is OneStep?
@patio Maybe, I don't know.

So, anybody got it on desktop too? Maybe this 'easter egg' spreads over more Windows 7 systems...

gregrocker · 06 Feb 2013

Delete it. Look in Control Panel>Programs and Features to see if anything has installed on your PC that you don't absolutely know you want. If so, delete it.

I'd also run SUPERAntiSpyware.com - Downloads which goes deeper into spyware than Malwarebytes. Turn it as well as all other programs except AV off at Startup in msconfig>Startup and msconfig>Services after hiding all MS Services. Keep all others out.

Check also in your browsers Add-Ons to see that only Flash, Shockwave, Silverlight, WMP or QT helper, Reader helper are enabled and keep all others out.

alex2000robert · 06 Feb 2013

Still no results of malware! Deleted it and the next reboot I got it back, with the same name, still as hidden. Did all you said, but it didn't solve the... probem? By the way, only flash and shockwave are on. Oh, and I got on my PC nothing but some games and drivers (not downloaded games).

gregrocker · 06 Feb 2013

What was found by SuperAntiSpyware?

Have you had a Clean Reinstall recently?

How is Enterprise activated?

ydylan77 · 06 Feb 2013

I am never comfotable with files that simply appear on my system. Well becuase files don't just appear, someone puts them there. Computers are dumb machines that do brilliant things, but coputers will only do as instructed by code. So there is a bit of code running somewhere on your machine that wants this file to exist on your system. IMO.
Does this file exist anywhere else?

I smell virus/Malware. You can get either of these without ever installing/downloading anything online. If you visit a virus hosting site, even accidentally, your system can become affected.