How to Remove the WinCodecPro Trojan [Delete Guide]

This guide will give you easy instructions on how to remove WinCodecPro.


What is WinCodecPro? (Information)

WinCodecPro is a fake codec software which uses fraudulent strategies by displaying false or exaggerated issues on your computer rather than any legitimate ones to coerce you into purchasing their software.


WinCodecPro Homepage/Infection Screenshots:

---

Symptoms in a HijackThis log:

O4 - HKLM\..\Run: [WmpTray] C:\Program Files\MediaSystem\wmptray.exe

---

Follow these instructions to continue for the automatic removal:

1. Please download this removal tool: Malwarebytes' Anti-Malware.

If you are having problems downloading from the link above, click here:


Spoiler:

Download from here only if you have problems downloading from the link above.

2. Extract the file and install Malwarebytes' Anti-Malware by double clicking on winlogon.exe

3. Follow the prompts. Make sure that Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware are checked. Then click finish.

4. Malwarebytes' Anti-Malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.

If you are having problems with the updater, you can use this link to manually update Malwarebytes' Anti-Malware with the latest database

Spoiler:

• Malwarebytes' Anti-Malwares' latest database
  

Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that Malwarebytes' Anti-Malware is closed before installing the update.

5. Close ALL open Windows, Programs, File or Folders.

6. Make sure you are on the Scanner tab. Select Perform quick scan then click the Scan button as shown above.

7. Malwarebytes' Anti-Malware will now start scanning your computer for infected files as shown below.


8. When the scan is finished a message box will appear, click Ok to continue.

9. Click Show Results.


10. You will now be presented with a screen showing you the malware infections like shown below. Yours may look different depending on the infection you have.

11. Click on Remove seletced


12. When removing the files, Malwarebytes' Anti-Malware may require you to restart the computer in order to do a complete removal. If it displays a message stating that it needs to restart, please allow it to do so.

13. After that you can close the Malwarebytes' Anti-Malware window, your computer is now cleaned.

To protect your computer from future threats like this, you may want to consider purchasing the Pro version of Malwarebytes' Anti-Malware with real-time protection from this link.

---

If you are still experiencing problems or difficulties following this guide or require any assistance removing this software, please post your questions in our Virus, Spyware & Malware Removal forums for free help.

You have to be logged in to post questions. Registration is free. By registering you are privileged to other virus removal resources in future.

---

Files Associated With the WinCodecPro Trojan:

Spoiler:

c:\Program Files\MediaSystem
c:\Program Files\MediaSystem\1.gif
c:\Program Files\MediaSystem\wall.html
c:\Program Files\MediaSystem\wmptray.exe

Yea I know this one. Would be a great to have this codec installation file. I would examine it.
If someone has it Plz contact me
thxs

I've sent the link to you via PM.

So you play with malware too?

UUUu yes I do If there is suspicious programs or files bring it ;) I will test it out ;)

Hi there,
I followed this guide today after I got infected with this programme off a local website which I expected to be safe - I tried PC Tools Spyware Doctor which has absolutely no effect, before using the smitfraud programme above. The link in the post doesn't work, but I quickly found it on a different site. This seems to have has some impact - it's no longer changing my screen resolution or background, and my computer seems to have returned to normal speed. I'm still not convinced however, as I have the small red circle with the white "x" on it down in the taskbar (is that the right name? The bit which shows icons for some programs in the bottom right hand corner of the screen)

- Live edit - As I've just typed that it's literally just changed my resolution again. So maybe it isn't gone at all. What should I do now? I'm running much faster than I was before but I clearly still have the virus, despite following the steps above. Maybe they upgraded it?

I hope someone has a newer fix,

Winchester

Winchester wrote:Hi there,
I followed this guide today after I got infected with this programme off a local website which I expected to be safe - I tried PC Tools Spyware Doctor which has absolutely no effect, before using the smitfraud programme above. The link in the post doesn't work, but I quickly found it on a different site. This seems to have has some impact - it's no longer changing my screen resolution or background, and my computer seems to have returned to normal speed. I'm still not convinced however, as I have the small red circle with the white "x" on it down in the taskbar (is that the right name? The bit which shows icons for some programs in the bottom right hand corner of the screen)

- Live edit - As I've just typed that it's literally just changed my resolution again. So maybe it isn't gone at all. What should I do now? I'm running much faster than I was before but I clearly still have the virus, despite following the steps above. Maybe they upgraded it?

I hope someone has a newer fix,

Winchester

Post a Hijack This log in the malware removal guide section.

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

Urgh. Now the Sophos Anti-Virus I have on here wont let me open it as it claims it holds a trojan? I'm talking about the HijackThis program - It won't let me open the installation guide as it says is has a virus in it. How can I get around that? I assume this program is actually clean...Seeing as this virus won't let me get into TaskManager I cant shut down the Sophos processes that way either.

Scrap that, I've got around it by adding an exclusion to Sophos :every time HijackThis makes a new folder, I've excluded that folder from scans etc.

I got this virus yesterday, and its quite annoying. I tried to remove it using software recommended online, but they don't work. In fact, I can't even find MediaSystem folder nor the wmptray.exe

So i figure that the company have updated the virus.

After looking up processes that auto start, I found out the file name is mediacodec.exe

It's the red X thing. After I close that in the process, its gone.

However, this probably does not solve the problem. Since mediacodec.exe was created in the temp folder... that means some other software must have trigger and create it there.

Hello Billwaa,

Please read this: http://www.geekpolice.net/-t3821.htm

And post a HijackThis log in a new topic here: http://www.geekpolice.net/virus-spyware-malware-removal-f11/

has anyone figured thsi out. the download link is broken. please help. thanks.

Link updated.

I just ran into this PITA on my HP Pavilion laptop running Vista.

The behavior was:

a. Red "Error" in system tray. Clicking it tells you that your media system is corrupt, etc.
b. Every 15 minutes, the screen resolution is set to 800x600 at 8-bit color depth, and "Display Settings" is disabled via registry change, complicating the correction.
c. Going into "Notepad" causes an IE session to be launched, taking you to their website to buy their codec.

I followed various posted procedures for the removal of this beast, but nȯne of them worked. Malware scanners don't locate it directly, although PC Tools Spyware Doctor *did* locate/remove a trojan which is probably how is was installed.

With the trojan gone, I ran "msconfig", went into "Startup", and located an entry for "ecQPService", with a manufacturer of "Unknown". ("QPService" is a legitimate QuickTime media service, and came bundled on this laptop. "ecQPService.exe" was subsequently installed in the directory.) I made note of the full path of the command, disabled this as a startup item and rebooted.

After rebooting, the symptoms were gone. I went into the folder containing ecQPService.exe, and removed it as well as 2 other files with the same date/time stamp that appeared related. (One was the red "x" image, and the other was a .htm with the "Your media system is corrupt" message.)

You'll also need to go into regedit, browse down to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System, and set "NoDispSettingsPage" to "00" from "01". This will re-enable "Display Settings".

Haven't had any recurring symptoms. If you've run through the other procedures and still have the problem, try this.