Everything opening in WMP!!!!!

[KosmikGirl]

When I click on any icon it goes to Windows Media Player and then tells me it cannot open it. Even my AVG, IE,GOOGLE EARTH,DAEMON TOOLS and all games !!! Plus all of my icons have changed to music notes! Please help! Thanks in advance for any help! :confused::confused::confused:

[RandyL]

Can you do a System Restore?

[KosmikGirl]

No Randy. Tried that. System Restore won't even open!

[RandyL]

I asked the malware team if they think this might be malware related. If they think it might be I'll move the thread to that section.

[Dalo Harkin]

It sounds like a file association problem, did you recently modify anything to do with WMP?

[KosmikGirl]

I don't recall making any modifications! Any ideas?

[Dalo Harkin]

If system restore does not work :-

 

Does it not work as in you do system restore and it's the same result.

Or does system restore not work itself?

 

If system restore does not work then I personally would remove WMP and then see if the problem goes away, regardless whether it sorts itself out after removing WMP you would then need to reinstall WMP, if its solved then good :) if not then the post be moved to Malware forum

[BeeCeeBee]

When I click on any icon it goes to Windows Media Player and then tells me it cannot open it. Even my AVG, IE,GOOGLE EARTH,DAEMON TOOLS and all games !!! Plus all of my icons have changed to music notes! Please help! Thanks in advance for any help! :confused::confused::confused:

 

I see the possibility of a lethal combination. When I see DAEMON TOOLS and games in the same sentence I suspect that many of those games were downloaded and then mounted for play using Daemon tools. IF that is true there is a much better than even chance that you have got yourself a major infection. Inability to open system restore is a very common occurrence with malware.

 

I would suggest that there is a malware problem and you need to be open and honest with the malware team or they will not be able to help. You will need to be prepared to remove any P2P programs when you are told. If I am wrong accept my apology but I am guessing that I am not.

[Starbuck]

Hi KosmikGirl,

 

Let's run a couple of programs and see if we can find out what's going on:

 

Step 1

Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

 

Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
  
• Double-click on Download_mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware

  [*]Then click Finish.

  [*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

  [*]On the Scanner tab:

  • Make sure the "Perform Full Scan" option is selected.
    
  • Then click on the Scan button.

  [*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

  [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

  [*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

  [*]Click OK to close the message box and continue with the removal process.

  [*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

  [*]Make sure that everything is checked, and click Remove Selected.

  [*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

  [*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

  [*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

 

 

Step 3

• Download OTL to your desktop.
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

Now copy the lines in the codebox below.


netsvcs
msconfig
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

In your next reply, please submit:

MBAM scan report

Both reports from OTL

 

Note:

The OTL reports can be quite large, if you have problems posting them.... add them as attachments.

Thanks.