Strange Letters under startup system config

Night Hawk · 28 Oct 2012

The MSConfig Cleanup Utility can easily take care of the entry itself. The question now however is when was this noticed since the mention of "reinstalled Windows a few days ago" was mentioned right off. The only way that would be added in following any reinstall would be from using the Upgrade to Repair install method where everything in the present installation is preserved.

The one absolute guaranty of erasing all traces of this as well as anything else a good sweep could find would be nuking the entire drive to see a full clean install of everything from scratch. That even goes as far as deletion of the C primary and creating a brand new one to replace it. Nothing left after full cleaning!

I think we can all agree the information on that variation of the "wmplayer.exe" file name is limited but is most likely the stray variant of a worm where someone simply added the one lettter so it would go right on without a clash and prompt to overwrite the genuine file. No red flags or prompting dups the pc owner until it is too late and the virus has done it's job!

The best possible move now besides a total wipe would be booting up in safe mode or from a live disk in order to manually remove the bug file if necessary to be followed by a full sweep of the drive(s) on the system. If the bug got on before the reinstall or repair and not afterwards since it was not found active the sweep should be enough once the file and even folder there is gone entirely.

If you have any doubts about which program to use try out a few since often it takes more then one to find something another misses!

F5ing · 29 Oct 2012

Good post Night Hawk!

Night Hawk said:

The one absolute guaranty of erasing all traces of this as well as anything else a good sweep could find would be nuking the entire drive to see a full clean install of everything from scratch. That even goes as far as deletion of the C primary and creating a brand new one to replace it. Nothing left after full cleaning!

Yeah, at a minimum the first MB should be wiped before the install, clearing out the old MBR and the hidden area behind it. That would clear out all references (definitions/pointers) to any other data that may be elsewhere on the disk (including any partitions that were there).

Night Hawk said:

The best possible move now besides a total wipe would be booting up in safe mode or from a live disk in order to manually remove the bug file if necessary to be followed by a full sweep of the drive(s) on the system. If the bug got on before the reinstall or repair and not afterwards since it was not found active the sweep should be enough once the file and even folder there is gone entirely.

If you have any doubts about which program to use try out a few since often it takes more then one to find something another misses!

If a true clean install is out of the question then at a minimum I would probably run a few offline scans (alternate bootable media via CD/DVD/USB), and a few online scans, all from different vendors. Anything found, remove it and start over.

Slartybart · 29 Oct 2012

Art, are you still there? The consensus here seems to be: Scan you system with a few malware tools. Malwarebytes, Windows Dfender Ofline (WDO), ESET online scanner are all well regarded. Run one at a time, your choice how many.

Also beef up your real-time Malware protection and ensure defs are up-to-date.

I'd still like to know if WMplayerd.exe is even on your system.

Bill
.

Night Hawk · 30 Oct 2012

I think we all in agreement that ArtG818 will need to reply in order to see how far he has gone since the thread was started.

It's never any fun finding out you have to wipe everything in order to start over fresh if the last resort is found to be needed. But some more info on when this was first seen before or after what type of Windows reinstall is needed here.

As far as the entry in the msconfig itself the cleanup utility was designed specifically for removing invalid msconfig entries once a program or in this case a bug is no longer present while the unwanted startup item is still seen. That part is a quick fix.

The rest will be the decision on how to proceed as far as clean up or totally nuking the works to start fresh from scratch. Been there enough times lately to remove malwares other people managed to acquire.