[OMNIFORCE13]

Hello,

I'm new here and I'm an absolute PC novice, so forgive me if I am unfamiliar with jargin or procedures.

---------------------------

Anyway, every time i turn my PC on, I get the following pop-up window:


C:\WINDOWS\System32\services\wmplayer.exe
Windows cannot find 'C:\WINDOWS\System32\services\wmplayer.exe'. Make sure you
typed the name correctly and then try again. To search for a file, click the Start button,
and then click search.

I can only click "OK" on that window and then a new window immediately pops up:

DESKTOP
Could not load or run 'C:\WINDOWS\System32\services\wmplayer.exe' specified in the
registry. Make sure the file exists on your computer or remove the reference to it in
the registry.

I tried to download Windows Media 9.0, thinking that that may return the wmplayer.exe file to the folder, but it stated that I have a newer version already installed and wouldn't allow a reinstall.

I appreciate any help available.

Thanks!

[Advertisements]

Click start then run, type sfc /scannow then press enter to replace the system files, you need the XP CD.

Windows File Protection will show an on screen blue progress bar which will simply disappear when the scan is complete, reboot when it does

System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.

System File Checker also checks and repopulates the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker.

The System File Check is only concerned with replacing missing or corrupt system files, and does not affect installed software or data

You should be able to download Media Player 10 here if you need to after running sfc /scannow

http://www.filehippo...s_media_player/

[Retired Tech]

Click start then run, type sfc /scannow then press enter to replace the system files, you need the XP CD.

Windows File Protection will show an on screen blue progress bar which will simply disappear when the scan is complete, reboot when it does

System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.

System File Checker also checks and repopulates the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker.

The System File Check is only concerned with replacing missing or corrupt system files, and does not affect installed software or data

You should be able to download Media Player 10 here if you need to after running sfc /scannow

http://www.filehippo...s_media_player/

[weAponX]

Keith, is that command line supposed to be part of the boot sequence?

"C:\WINDOWS\System32\services\wmplayer.exe "

I don't know if WMP runs as a service in itself. Perhaps "Omni" has gotten a virus, one of those ones that adds a "service" that looks legit but is not?

Also, is there a "Services" folder in System32 under XP? I do not have one.

This sounds like a Trojan or malware: I would suggest tying Start>Run>Msconfig and check out the startup section for this as a command line, and remove it if it is there.

If it is not under startup it may be in "Services" and you can click "hide all Microsoft services" and if this thing is starting as a service, it will show up as a non-MS service.

Then, check the Win and System INI files (you can check those right from msconfig)

If it is not there, then Ad Aware or Spy Sweeper should be run (or whatever anti spyware is at hand)

I just checked real quick: Seems that the command line typed like that is part of some spyware. But the hijack logs that are linked that I found in Google are not up to date. I'll try to find a direct reference to this.

IS there a link to Hijack This on this site? I think that may tell you some things. Also, search for any copy of WMPLAYER.exe and right click on every copy you find and make sure it is the real wmplayer- If you are very careful you can inspect the properties for it without activating it.

Edited by weAponX, 17 March 2006 - 01:36 PM.

[Retired Tech]

Hello weaponx

There is an wmplayer.exe installed by an agobot variant

[OMNIFORCE13]

Thank you both for your help. I tried to use the file sfc /scannow method, but it didn't work for me. However, I read another solution on another bolg under this same topic and tried it and it worked. I just wanted to share it in case someone else has a similar problem.

I clicked Start > Run and typed in msconfig. Then I selected the STARTUP tab and deselected Windows Media Player. That did the trick!

Thanks again ----

[Retired Tech]

Thank You for the update

Does media player work?

[weAponX]

Agobot heh? I had one of those once, like the same thing Omni had, which is why I asked about it being in the startup command line like that. It didn;t sound right and so I would only caution the guy to be careful opening any wmplayer.exe files unless it is in the place where it is supposed to be:

If he is starting WMplayer he ought to check the location of the file... The only valid location for WMplayer.exe is x:\Program Files\Windows Media Player... If the file shows up in any other location, like say in your x:\windows or x:\windows\system folders, it ought to be investigated. You can use a text editor to just look at the file and sometimes you can see if it is what it says it is. But you can also right click on it, and view the file properties, and if there is no "file version" property sheet, that makes it suspect. Most MS OS files will have something in them that will allow you to ID them.