Windows XP 'hidden song' found on Windows 7 desktop

alex2000robert · Feb 5, 2013

Hello, today when booted up my pc found an WMA file with title '$291Ae3' (without quotes), I played it and it's the Windows XP Welcome Song! I was wondering how did I get it instantly on my desktop? (Note that it's hidden file) I have no Windows XP, no virtualization, etc... My Windows 7 is original too. How did I get it then? I have no viruses too. I'm adding an attachment right now to prove it. If you want, I can add the song too.

Cheers,

Alexandru

P.S: I didn't download it either... Just found it on desktop!

gregrocker · Feb 5, 2013

Run a full scan with Malwarebytes anyway just to be sure.

alphanumeric · Feb 6, 2013

Are you the only user of this PC? Where you or someone else looking for that song on the Internet? Did you install any software lately that may have used that song as background music during the install?

Erick Aguilar · Feb 6, 2013

I thought this would be related to OneStep..

patio · Feb 6, 2013

It may be there for XP Compatibility Mode...

alex2000robert · Feb 6, 2013

@gregrocker The malwarebytes scan gave me no results.
@alphanumeric I'm the only user, no search on Internet. No software with this music either
@Erick Aguilar What is OneStep?
@patio Maybe, I don't know.

So, anybody got it on desktop too? Maybe this 'easter egg' spreads over more Windows 7 systems...

gregrocker · Feb 6, 2013

Delete it. Look in Control Panel>Programs and Features to see if anything has installed on your PC that you don't absolutely know you want. If so, delete it.

I'd also run SUPERAntiSpyware.com - Downloads which goes deeper into spyware than Malwarebytes. Turn it as well as all other programs except AV off at Startup in msconfig>Startup and msconfig>Services after hiding all MS Services. Keep all others out.

Check also in your browsers Add-Ons to see that only Flash, Shockwave, Silverlight, WMP or QT helper, Reader helper are enabled and keep all others out.

alex2000robert · Feb 6, 2013

Still no results of malware! Deleted it and the next reboot I got it back, with the same name, still as hidden. Did all you said, but it didn't solve the... probem? By the way, only flash and shockwave are on. Oh, and I got on my PC nothing but some games and drivers (not downloaded games). :huh:

gregrocker · Feb 6, 2013

What was found by SuperAntiSpyware?

Have you had a Clean Reinstall recently?

How is Enterprise activated?

ydylan77 · Feb 6, 2013

I am never comfotable with files that simply appear on my system. Well becuase files don't just appear, someone puts them there. Computers are dumb machines that do brilliant things, but coputers will only do as instructed by code. So there is a bit of code running somewhere on your machine that wants this file to exist on your system. IMO.
Does this file exist anywhere else?

I smell virus/Malware. You can get either of these without ever installing/downloading anything online. If you visit a virus hosting site, even accidentally, your system can become affected.

alex2000robert · Feb 6, 2013

What was found by SuperAntiSpyware?

I'll tell you once again: it found nothing!
I hadn't got any clean reinstall yet...
And Enterprise activated me the computer salesman from where I bought this PC; However after 180 days got a message that is not registered and I found on my PC... an 'Activator'! This program activates windows 7 without buying it... :|

ydylan: It doesn't exist anywhere else... and I don't visit unknown sites, by the way, or 'green-flagged' sites by Avast.

Golden · Feb 6, 2013

alex2000robert said:
However after 180 days got a message that is not registered and I found on my PC... an 'Activator'! This program activates windows 7 without buying it... :|

Time to check this installation before proceeding with further troubleshooting:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click 'Copy' - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the validation tool here in your next reply

gregrocker · Feb 6, 2013

I tell you now: You are using criminal methods to activate Win7.

No shop can legally sell you Windows 7 without a COA sticker attached showing its authenticity. If a shop sold you Enterprise version it was knowingly illegal and they should be reported to MS Customer Service. If you can provide documentation to them of this they might reward you with a free copy for cooperating in their investigation.

alex2000robert · Feb 6, 2013

Who used the illegal methods is the salesman, not ME! Golden: I'm going right now to do that...
Found a Windows Vista COA sticker attached to my system (here I smell a problem)

gregrocker · Feb 6, 2013

Then you need to buy a copy of Win7.

We cannot help you further as long as an illegal crack was used on a version of the software you shouldn't have had anyway - Enterprise is volume licensed for business.

alex2000robert · Feb 6, 2013

Golden: That program deleted itself after download. Tried to download but still deletes itself.

Golden · Feb 6, 2013

Mmmm, I've never seen that happen before.......I suspect that the current installation is deeply cracked to the point it avoids attempts at checking its authenticity.

I would contact Microsoft as suggested - they have been known to reward persons with a free copy of Windows if you report counterfeits.

https://www.microsoft.com/en-us/howtotell/cfr/report.aspx

alex2000robert · Feb 6, 2013

Went out of city to search for this shop and... it's still open! Just reported it to microsoft... But I didn't answer at all my contact information....

z3r010 · Feb 6, 2013

You will need to buy and install a genuine copy of Windows before we can offer any help.

alex2000robert · Feb 6, 2013

Well I can't afford to buy it... I well let it like it is until I find a solution. Thanks for your help until here!

Windows XP 'hidden song' found on Windows 7 desktop

New member

Attachments

My Computer

New member

slightly off center

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

New member

My Computer

New member

New member

My Computer

New member

My Computer

000

My Computer

New member

New member

My Computer

New member

New member

My Computer

000

My Computer

New member

My Computer

Administrator

My Computer

New member

My Computer