HIGH ALERT MS Built in Trojan Found

I found a program task running in Windows XP that is a back_door Trojan called unregmp2.exe.

Yes you read that right a .exe file that is a component of Windows Media Player.

This file can cause all sorts of system errors and has even been reported to stop a Windows XP installation.

This program is hidden so deep in the OS that users never even see it running it is not displayed or reported by any of XP's resource components or utility's. It also cannot be turned off in any of the XP resource management tools!!

What you need to do to see this little Trojan is go to Windows and open-up C:\ Drive and set your folder options to show hidden files and folders.

The program "unregmp2.exe" is located in the "inf folder"

unregmp2.exe is a component of the Windows Media Player package however it is a very dangerous Back Door Trojan Hole. Other side effects of this Windows file are poor connection traffic flow and outside monitoring of your computer activity's by an un_authorized user (hacker). The unregmp2.exe uses so much computer resources that it even slows your operating system down and steal resources that could be better applied to other Valid resources.

If you have already gone to Windows and looked at this little prick program file found in the inf file you now know where it is and you are [looking at one of the most nasty .exe programs Microsoft has ever planted into one of their operating systems.]

*You now have a few options at this point to rid your self of this Trojan.

This is what I have done as a temporary patch of my OS.

I downloaded a program called Hacker Eliminator version 1.2 it is a 30 day trial shareware program. After you install this nice little program it WILL Report "unregmp2.exe" is active in your computers START-UP....Yep it starts every time you reboot and runs constantly.

I made a back-up of "unregmp2.exe" to a Floppy disc for safe keeping then deleted the file out of my computer. After I rebooted and went back to the Windows "inf" folder that little Trojan biotch was back.

Using the delete of the file will cause Hacker Eliminator to pop a message window up on the screen that will allow you to Eliminate the process and prevent it from starting with your operating system.

Since "unregmp2.exe" acts as a Trojan it cannot be removed manually as it will renew it's self on start-up but Hacker Eliminator will prevent unregmp2.exe from initializing at windows start-up.

I am looking into a perm fix to remove this files links and where it hides elsewhere in the OS so you can manually remove it permanently. I would presume every time you update it will yet again start so you will need to fully update your P.C at Windows update then turn this Trojan off with Hacker Eliminator.

My P.C has improved performance and internet connection speeds since I am blocking "unregmp2.exe" from being an active .exe file in my OS.

This program.exe called "unregmp2.exe is a serious issue in Windows XP and not a thing to be ignored. Anyone who values their computers resources equalling speed and performance as well as PRIVACY will need to take steps to REMOVE "unregmp2.exe" from their computer Start-UP folder.

There are more technical ways to get into the computers start-up areas and remove this little biotch but I don't want to have many users treading on thin ice. The above way I have described is the safest way to shut down this Trojan and it will Visually show you what you are doing and you will learn about this problem first hand.

This file is so nasty as I say you can use a Registry search and the damn thing shows as a...

FriendlyTypeName REG_SZ @C:\WINDOWS\inf\unregmp2.exe,-9903

It most defiantly is not a Friendly file.

I have as yet hesitated to remove it from the registry as I am watching the OS for side effects of disabling "unregmp2.exe" by locking it out with Hacker Eliminator version 1.2.

If no undue problems occur by handcuffing this Trojan I will in a few days remove it from the Registry and from the Windows inf folder and rid myself of this Microsoft exploit!!

After I have permanently removed this Trojan I can then remove the 30 day trial of Hacker Eliminator as I will not need it anymore. However I have found this little program is a handy tool and might purchase it outright.

<A HREF="http://img119.exs.cx/img119/4592/Lag_Bot_Trojan.jpg" target="_new">http://img119.exs.cx/img119/4592/Lag_Bot_Trojan.jpg</A>

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

It's SoD. Best just to not read his posts.

_______________________
<A HREF="http://www.moviewavs.com/MP3S/TV_Shows/Simpsons/flanderssong.mp3" target="_new">Audio Sig</A>

who wants to read your posts?

Name one person.

_______________________
<A HREF="http://www.moviewavs.com/MP3S/TV_Shows/Simpsons/flanderssong.mp3" target="_new">Audio Sig</A>

Ned it's not my fault you were born Mentally Retarded, your own handicaps are in fact your own problem.

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

lmao.

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Neurotic Narcissist.}=-</A>
<font color=green>{FLM}</font color=green>

Your computer science degree is much less then mine son and you dont have 20 years exp either.

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

I think you have an authority problem son or perhaps a Father figure problem.

Is that what your problem is you are both computer illiterate and you don't have a father.

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

he's swinging











































but hes missing...

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Neurotic Narcissist.}=-</A>
<font color=green>{FLM}</font color=green>

you cant man.

its difficult.

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Neurotic Narcissist.}=-</A>
<font color=green>{FLM}</font color=green>

evidently youre an idiot...

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Neurotic Narcissist.}=-</A>
<font color=green>{FLM}</font color=green>

Nnnooooooooooooooooooo!!!!!!!!!!!

<font color=red><pre>\\//__________________________________
And the sign says "You got to have a membership card to get inside" Huh
So I got me a pen and paper And I made up my own little sign</pre><p></font color=red>

Yes they do, click here [url]http://securityresponse.symantec.com/avcenter/venc/auto/index/indexT.html[/ur] if you scroll down you can see loads of trojan programs that norton antivirus detects. There are 25 other pages like this.

What do you think the majority of viri are?

Why would microsoft include a program that allows people to gain illegal access to your computer with thier operating system. Windows has enough security issues with out microsft making more.

Damn, you guys are ruthless...

<font color=red><pre>\\//__________________________________
And the sign says "You got to have a membership card to get inside" Huh
So I got me a pen and paper And I made up my own little sign</pre><p></font color=red>

<A HREF="http://" target="_new">http://www.pestpatrol.com/PestInfo/u/unregmp2_exe.asp#Origins</A>



<A HREF="http://www.tv-ark.org.uk/commercials/commercials_s-z/unigate1970sa.rm" target="_new">Watch out, there's a Humphrey about.</A>

<A HREF="http://www.pestpatrol.com/pestinfo/u/unregmp2_exe.asp" target="_new">Sorry</A>


<A HREF="http://www.tv-ark.org.uk/commercials/commercials_s-z/unigate1970sa.rm" target="_new">Watch out, there's a Humphrey about.</A>

I cant find any site that says its a trojan, I think it is just a program that can be exploited to gain access to a PC. There is nothing malicious about it.
SoD, I have said it before and I will say it again, u are an idiot.

And he's calling me an idiot lol..........

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

Jammy TROJANS are programs and unregmp2.exe is a program.

<A HREF="http://img97.exs.cx/img97/2193/unregmp2_exe_pic1.jpg" target="_new">http://img97.exs.cx/img97/2193/unregmp2_exe_pic1.jpg</A>

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

I don't know why you goof balls are picking the post apart simply remove unregmp2.exe for your own protection or stick a sock in it makes no matter to me now does it.

If you cant accept that your were told valuable information then accept the fact that you did not make the post because you did not know anything about it and get on with your life.

As I said I removed it from the registry and the inf file already. It's an Exploit it is a Program and it is therefore a Trojan simple as that. By any definition. You must work for MS the way you are trying to sidetrack the vulnerability found.

Makes people wonder.........

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

Ned Wrote

Children generally spend time out's in their room.

Microsoft sell software with Trojans in it..........Wow he finally woke the He Double Hockey Sticks Up.

<font color=red>GOD</font color=red> <font color=orange>LOVES</font color=orange> <font color=red>CANADA</font color=red>

Haha, this thread made me laugh.

Yes this file does pose a security risk, but it is NOT a trojan as SoD insists, it is simply another piece of poor Microsoft programming which can be exploited to gain access to the machine. The program itself is not acting maliciously. Still worth getting rid of though.

Fatal Error #449: Unable to process the "Go to Hell" command specified.

i'm still curious what it actually does.

i mean if its been put there it must be doing somthing.

Alltaken

<A HREF="http://www.mudpuddle.co.nz" target="_new">http://www.mudpuddle.co.nz</A> its where its all going on, oh and its also all going on HERE <A HREF="http://doug.mudpuddle.co.nz/gallery/" target="_new">http://doug.mudpuddle.co.nz/gallery/</A>

I've already hypothesised that it allows you to access
http://community.tomshardware.com, and input a Username / Password on forementioned site. Also this program stops your PSU from exploding

_______________________
<A HREF="http://www.moviewavs.com/MP3S/TV_Shows/Simpsons/flanderssong.mp3" target="_new">Audio Sig</A>

Read the full sentance moron. Don't bother to reply.

_______________________
<A HREF="http://www.moviewavs.com/MP3S/TV_Shows/Simpsons/flanderssong.mp3" target="_new">Audio Sig</A>