according to the registry, wmplayer is listed to open .exes? + other Q

[Keyes]

1. For some reason, in this registry location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList

Wmplayer.exe is listed. Why is it listed? I have never opened an executable file with it.


2. And a second question non related question.

If I open up a previous version of a folder, e.g c:/users/xxxx/downloads, and move a shadow copy file to tye desktop, I get an internet security warning saying the file might be harmful. Clicking show details shows the desktop directory. Why is this?

 

[Berton]

I don't have that Registry key on my Win7 64-bit Ultimate so I'd certainly suspicion an infection has hit your computer. Update your antivirus, run a full/deep scan, download and install Malwarebytes and run a full scan.

Your second question should be separately posted since as you say, it's not related. I get similar messages now and then that say the file came from a different computer and do I want to run it, have not had a problem as I always know the site I get my downloads from. Copying a file from the Downloads Folder to the Desktop is probably making Windows think it's coming from an unknown source.

 

[Keyes]

I don't have that Registry key on my Win7 64-bit Ultimate so I'd certainly suspicion an infection has hit your computer. Update your antivirus, run a full/deep scan, download and install Malwarebytes and run a full scan.

Your second question should be separately posted since as you say, it's not related. I get similar messages now and then that say the file came from a different computer and do I want to run it, have not had a problem as I always know the site I get my downloads from. Copying a file from the Downloads Folder to the Desktop is probably making Windows think it's coming from an unknown source.

I have a second pc that also shows wmplayer in the list for .exe.

Doing a google image search for the key shows similar entries.

 

[Arc]

1. For some reason, in this registry location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList

Wmplayer.exe is listed. Why is it listed? I have never opened an executable file with it.

It is not there for me, too. It should not be there. Filetype associations should be default, not with windows media player.

​

Go to http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html ... get the registry entries for exe and lnk ... merge these two with registries.

Also, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

 

[Keyes]

1. For some reason, in this registry location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList

Wmplayer.exe is listed. Why is it listed? I have never opened an executable file with it.

It is not there for me, too. It should not be there. Filetype associations should be default, not with windows media player.

View attachment 339863
​

Go to http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html ... get the registry entries for exe and lnk ... merge these two with registries.

Also, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Instead of downloading those reg files, can I just manually delete the entry?

I dont see how it could be malware, as the system is running fine I have not downloaded anything since the key was modified. I will scan with mbam and tdss. Mse is clean.

 

[Keyes]

Mbam and mbam anti rookit are clean.

 

[Arc]

Well, if all the programs are properly working, then you need not to be afraid about it.

If you want to delete the registry entry, I would suggest you to have a backup before doing it.

 

[Keyes]

Well, if all the programs are properly working, then you need not to be afraid about it.

If you want to delete the registry entry, I would suggest you to have a backup before doing it.

I checked at the beeping computer forums, and some others have the same entry. So its all safe? I just want to be certain its not something bad,
wmplayer.exe under openwithlist registry key for .exe - Am I infected? What do I do?

 

[Arc]

You scanned for virus. If your PC is not infected, and all the programs are opening as they should be, there is no point to be worried right now.

 

[Callender]

Warning when moving files

In answer to your second question perhaps you might like to read the entire thread here:

http://www.sevenforums.com/general-...store-points-open-file-securiy-warning-2.html

The last post confirms what happens when you try to move a file from a system restore point or shadow copy.

 

[Keyes]

You scanned for virus. If your PC is not infected, and all the programs are opening as they should be, there is no point to be worried right now.

Does the link I showed you look fine? There should be an image that shows it that another user has it. I just want to be 100% ots safe.

 

[Keyes]

In answer to your second question perhaps you might like to read the entire thread here:

http://www.sevenforums.com/general-...store-points-open-file-securiy-warning-2.html

The last post confirms what happens when you try to move a file from a system restore point or shadow copy.

Thanks. Would you have any comments about the first question?

 

[Callender]

wmplayer issue

In answer to your second question perhaps you might like to read the entire thread here:

http://www.sevenforums.com/general-...store-points-open-file-securiy-warning-2.html

The last post confirms what happens when you try to move a file from a system restore point or shadow copy.

Thanks. Would you have any comments about the first question?

Sorry but no I can't comment. I don't use wmp - it's disabled via "choose windows features"

The only thing I can say is what's already been suggested. Backup the registry and delete the entry then reboot and test that everything still works. Even better - create a system image backup first.

 

[Keyes]

In answer to your second question perhaps you might like to read the entire thread here:

http://www.sevenforums.com/general-...store-points-open-file-securiy-warning-2.html

The last post confirms what happens when you try to move a file from a system restore point or shadow copy.

Thanks. Would you have any comments about the first question?

Sorry but no I can't comment. I don't use wmp - it's disabled via "choose windows features"

The only thing I can say is what's already been suggested. Backup the registry and delete the entry then reboot and test that everything still works. Even better - create a system image backup first.

Hi, I just found out something. I deleted the key, and nothing happened. It didnt come back. When I entered windows media player, and clicked play on a piece of music (example, windows 7 default jazz) the key came back.

Playing the music outside of the media player program and just opening the file did nothing. Could you test this? If you cant becaude its disabled maybe you could refer this to someone else who could? Thanks.

 

[Callender]

Test Windows Media Player

Keyes states in the original post:


For some reason, in this registry location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList

Wmplayer.exe is listed. Why is it listed? I have never opened an executable file with it.


"Hi, I just found out something. I deleted the key, and nothing happened. It didnt come back. When I entered windows media player, and clicked play on a piece of music (example, windows 7 default jazz) the key came back.

Playing the music outside of the media player program and just opening the file did nothing. Could you test this?"

Is there any other member who can check if this happens on their machine?

 

[Arc]

It does not happen on my machine. I use WMP, but I dont have that registry entry. I switched the default association of .mp3 between vlc and wmp a couple times, nothing changed.

 

[Keyes]

It does not happen on my machine. I use WMP, but I dont have that registry entry. I switched the default association of .mp3 between vlc and wmp a couple times, nothing changed.

Did you try to recreate my steps I took?

1.Delete the key (if it exists)
2. Open windows media player LIBRARY
3. Double click a song or album to play it.
4. Refresh key, wmplayer.exe is added

If this is the origin, is it confirmed not malicious?

 

[Callender]

Malicious registry key?

I don't see any reason to think that it's malicious. I can find posts by other users with similar entries:

Any viruses remaining? - Page 4 - Tech Support Forum

MXit Forum ? View topic - Mxit EVO download problems on Windows 7

This really isn't something that I have any knowledge of and at best I'd be guessing. Possibly check through your list of file associations and see if anything looks screwed up. Sort the list by clicking on "Current default" in order to group applications.

Control Panel> Default Programs > Associate a file with a program

 

[Keyes]

I don't see any reason to think that it's malicious. I can find posts by other users with similar entries:

Any viruses remaining? - Page 4 - Tech Support Forum

MXit Forum ? View topic - Mxit EVO download problems on Windows 7

This really isn't something that I have any knowledge of and at best I'd be guessing. Possibly check through your list of file associations and see if anything looks screwed up. Sort the list by clicking on "Current default" in order to group applications.

Control Panel> Default Programs > Associate a file with a program

They all appear to be fine. I deleted the entry, and they dont come back unless I play a song through wmp library, which is odd.

 

[Callender]

WMP add ons?

Well like I said I don't use WMP at all but I'm left wondering if you're using the default version or have you installed any add ons for WMP? If you have then possibly that's the cause. It seems that other members don't have the same issue so they can't test what happens when the registry key is deleted. They don't have that registry key.

If you are familiar with ProcessMonitor from Sysinternals and know how to run a capture with the clutter minimized and can zip and upload the results to a file sharing site it might be possible to work out what's going on but there's no guarantees.