Author Topic: WMA Wimad[Drp]  (Read 22725 times)

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
WMA Wimad[Drp]
« on: January 07, 2009, 11:05:49 AM »
I have discovered that many of my mp3 and wmv files come up as having been infected with the above trojan.  When I scan the files with Spybot, the trojan is identified in heuristic mode as Fraud.Installer .as.  The curious thing is that everything I have read about this malware says that it creates fake mp3 files which then say they require additional software to play them.  This hasn't been the case with me.  The files that are infected are legitimate mp3 files, and they have all been created on this computer.  They play normally.  While I did download some codecs in the past, none of them showed up as being infected.

The problem I have is that the infection is so widespread (literally hundreds of files) that if I were to delete them all, it would take weeks, if not months, to restore them again.

Presumably because the files play normally, it is only the header that has been infected.  Is there any way the files can be repaired?   
« Last Edit: January 07, 2009, 11:20:47 AM by Lang »

Offline kubecj

  • Administrator
  • Advanced Poster
  • ***
  • Posts: 1127
  • Gender: Male
    • ALWIL Software
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #1 on: January 07, 2009, 12:34:47 PM »
If we report them as WMA:Wimad, they're not MP3's anymore, they're Windows Media Audio files and they were auto-converted. They're not in the original state and quality - the only thing what to do with them is to delete and recreate.
Jindrich Kubec

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #2 on: January 07, 2009, 01:27:03 PM »
Thank you for your response, although it is a very depressing one.   :'(   Many of the files affected are irreplaceable.

The only other thing I can ask you is this:  assuming the trojan concerned is not apparently doing anything to my system (it hasn't asked me to download anything), would there be any harm in allowing the files to remain on my computer, so long as I didn't send them to anybody else?  I ask, because although you said the quality would be affected, there is no obvious difference that I can hear.  Many of the files are classical, and are just as acceptable as the original mp3s.

So in their present state, are the files causing any active harm?  Could they remain on my system?

Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #3 on: January 07, 2009, 01:43:23 PM »
Hi Lang,

Try this as a last resort solution:
This procedure has deleted the problem:

1) Logon with user that has not been affected by the problem

2) type "regedit" in Run window

3) locate [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer]

4) Export that section as filename.reg

5) edit with NOTEPAD this file and replace any string that's containing
last username with your! (ex: c:\document & settings\anne\document --->>
c:\document & settings\Max\document)
Save the file

5) Logoff

6) Logon with the user affected by the problem

7) type "regedit" in Run window

7)locate [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer]

8) delete it!

9) close regedit

10) locate the file you've modified, click with right mouse and choose

That's all, now you can play all your MP3!

polonus
« Last Edit: January 07, 2009, 01:45:38 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #4 on: January 07, 2009, 03:13:48 PM »
Polonus,

Many thanks for your help.

Ok, a couple of things.  Firstly, was your solution designed to remove the infection, or just to make the files playable?  I ask, because in fact they *are* already playable.  They play normally, with no noticeable loss of quality.  That is why I asked whether the infection is actually doing any harm in its current form, because if not I could leave the files alone, and just make sure I don't send them to anybody.  If it did remove the infection, then it would certainly be worth pursuing, as I really don't want to lose some of these files.

(Incidentally, I tried to treat these as wma files and used a converter to change them back to mp3.  When I did this the conversion worked, but the resultant files were very choppy and unusable.)

Secondly, I went through your procedure, and extracted the section from the registry.  The only problem was that when I searched for my old user name, it is not there.  I did find the new one, in one entry, but that was all

Once again, many thanks for the help.
« Last Edit: January 07, 2009, 03:15:39 PM by Lang »

Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #5 on: January 07, 2009, 03:29:12 PM »
Hi Lang,

Yes it would remove the infection, because that is going on actually online. If you deleted the previous malicious string, you have lost it. Make a note of all I mentioned there and perform everything meticulously step by step. I gave the solution as I found it, but it is well worth a try, else you will start it over again opening up your media player. After you have cleared this completely, switch for VLC Media Player to be downloaded from here: http://www.videolan.org/mirror-geo.php?file=vlc/0.9.8a/win32/vlc-0.9.8a-win32.exe

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #6 on: January 07, 2009, 04:05:59 PM »
Ok, as I said, I couldn't find my original user name in there at all.  The only line which had a user name had the second user name:-

"shortcut2"="C:\\Documents and Settings\\Username2\\Start Menu\\Programs\\Windows Media Player.lnk"

Do you mean that I should change Username2 back to my original user name?

Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #7 on: January 07, 2009, 04:13:19 PM »
Yes, now edit with Notepad.exe to:

"shortcut1"="C:\\Documents and Settings\\Username1\\Start Menu\\Programs\\Windows Media Player.lnk"

Save this file as all files, then proceed as instructed,

5) Logoff

6) Logon with the user affected by the problem

7) type "regedit" in Run window (see picture)

7)locate [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer]

8 ) delete it!

9) close regedit

10) locate the file you've modified, click with right mouse and choose


polonus

« Last Edit: January 07, 2009, 04:16:36 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #8 on: January 07, 2009, 05:33:30 PM »
Ok - I am not sure what that was supposed to do.  The situation is now as follows:-

Before - The files all gave rise to warning messages when they were scanned by Avast.  However, they played ok on Windows Media Player.

After - The files still give rise to warning messages.  When played by Windows Media Player they first of all tell me that they are not mp3 files (which I had been warned about in an earlier posting).  If I tell media player to play them anyway they stop after a few seconds, and Avast comes up with an error message.  It appears that I am being directed to a site which no longer exists:- www.isvbr.net.  They play ok on the VLC player, although the quality seems to have deteriorated.

I am not sure how those instructions were supposed to help the problem I outlined in my previous postings.  But thanks anyway for the help.

My problem is that I have a large number of music and video files which, when scanned with Avast, tell me they contain a trojan.  As many of these files were created by me or bought from sites I cannot now locate, many of them cannot be replaced.  I was hoping there was some way to access these files so as to remove the trojan, but to leave the files intact, but it appears that this is not the case.   :'(

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #9 on: January 07, 2009, 05:36:48 PM »
PS:  Ah, I see the assumption was that the malware was residing in WMP, and infected every file that it played.  Yes, that makes sense, although I am not sure that it remained in the media player, because later files have not been affected, although they have been played.

Anyway, better to be safe than sorry.

Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #10 on: January 07, 2009, 07:06:17 PM »
Hi Lang,

There is a tool to rename all the questioned files at once, see: http://sourceforge.net/project/showfiles.php?group_id=46941 download link for rename.it: http://sourceforge.net/project/showfiles.php?group_id=46941&package_id=39884&release_id=273583

What is this repair tool doing for you: http://www.softpedia.com/get/Multimedia/Audio/Other-AUDIO-Tools/MP3RepairTool.shtml

Also perform a full scan with this DrWebCureIt: ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe
It may be able to repair it,

polonus
« Last Edit: January 07, 2009, 08:41:21 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #11 on: January 08, 2009, 09:37:29 PM »
The Dr. Web tool is brilliant!  I have fixed all 1000-odd files that have been affected.  Took all day, but it did a great job.  Many thanks for that link!  :)

Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #12 on: January 08, 2009, 09:56:20 PM »
OK. Lang,

You are welcome, I am happy when you are happy,
and that is why we have put all the effort together in finding a solution.
That is why we malware fighters all do this.
Great it worked for you, enjoy your valuable files, and be safe and secure,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69213
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #13 on: January 08, 2009, 10:46:15 PM »
The Dr. Web tool is brilliant!  I have fixed all 1000-odd files that have been affected.  Took all day, but it did a great job.  Many thanks for that link!  :)

Now that you have recovered (excuse the pun) from the shock of your life, it is time to think about a back-up and recovery strategy so you don't lose valuable data, etc.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline Lang

  • Newbie
  • *
  • Posts: 8
    • Personal Message (Offline)
Re: WMA Wimad[Drp]
« Reply #14 on: January 11, 2009, 11:24:19 AM »
Believe it or not, I have one.  In this case the trojan wasn't detected until I did a thorough scan, and by then it had infected both my backup disks.  I suppose the only lesson I can draw from this is to do thorough scans more often. 

Interestingly, if I'd been running my previous virus checker, for which I had been paying for the last five years (I changed to Avast because I could no longer afford the other one) I would still be blissfully unaware of the trojan, which would be happily infecting my new drive.

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now