There is an indication of malware called RadioWMPCOREGecko19.dll

Do you mean that file?

Do a malware check with some malware scanning programs.
You need to scan with all programs because each program detects different malware.
Make sure that you update each program to get the latest version of their databases before doing a scan.

• http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
• http://www.superantispyware.com/ - SuperAntispyware
• http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
• http://www.safer-networking.org/en/index.html - Spybot Search & Destroy
• http://www.lavasoft.com/products/ad_aware_free.php - Ad-Aware Free

See also:

• "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

If using the above listed scanners does not fix it or if you are blocked from installing those scanners then ask advice on one of the forums that specialize in malware removal mentioned in the Popups_not_blocked article.

Yes I mean the RadioWMPCOREGecko19.dll file. It does not come up in any scan, Norton says its OK as does other malware and antivirus programs. Can you just erase it? Does anyone know where it came from or what it does?

Unfortunately you can't tell if a file is malware just by the filename. It's common for malware to replace standard files to avoid suspicious filenames.

Is your Norton up to date? If so and nothing comes up in the scan I suppose you just have to ask yourself how much you trust Symantec ;-)

If the filename is any indication of what it is for I would guess it's some form of plugin which allows you to stream WMP files to play them in Firefox. Again, you can't judge from a filename so that is just supposition.

Why not rename the file so it can't be used (with Firefox closed of course). Just change the .dll extension to something else or add something to the end of it. If you can start and use Firefox for the sites you usually visit with the renamed file you probably don't need it. If you can't you just need to change the name back.

Editing my post because I forgot to say:

If you are worried about it being malware, why not send a sample to your anti-virus vendor Symantec. They will be able to check if there is anything malicious in it. They might not answer you personally but if they think it is suspicious they will at least update their software so Norton will identify it so as long as you are keeping it up to date you should have no problem. In the meantime, as long as you change the .dll extension to something meaningless to Windows it will not run so you are safe even if it is malware.

What is the location of that file?

Is it part of a Firefox extension?

• https://support.mozilla.com/kb/Troubleshooting+extensions+and+themes

As I am curious about this file now I have done some searching and have come across a test media player file provided by Mozilla.

It may be wise to confirm whether the file is part of an extension first as cor-el asks but then after changing the name of the dll you could try accessing http://hg.mozilla.org/qa/litmus-data/raw-file/tip/firefox/plugins/mediaplayer.html to see if the audio plays.

Of course even if it doesn't it doesn't mean it is not a Firefox file. Now that Microsoft have to give users the choice of a browser they cannot assume that IE will be installed on Windows and to use the Radio functionality within Media Player they need to go through a configured browser. So another potential valid use of a file like this might be to allow WMP to access the internet on machines where Firefox is the only browser. Again, just speculation but if this file did come with the Firefox update (not an extension or from somewhere else) then either there is a valid reason for it (whether or not you yourself need it) or Mozilla or the provider of the extension have fallen foul of malicious behaviour.

I don't use Windows so can't confirm if it is part of the standard installation.

Hallo everybody! As Norton found out and wrote to me, RadioWMPGecko19.dll or RadioWMPGecko5.dll is no malware but an update (extension) for the Firefox browser. That´s the reason, that malware scanning programs can´t detect it. The solution to prevent this update from slowing down the computers must be found by Mozilla. Hope this will help.

Exactly where is that RadioWMPGecko19.dll sitting on your PC?
The folder that DLL file is sitting in might give you an idea about what program installed that file.

It shouldn't be in a Firefox folder. Firefox doesn't allow 3rd party plugins to be installed or dropped in Firefox folders any longer, that ended as of Firefox 3.6. And Firefox 4+ versions don't even have the Firefox program files \plugins\ folder as Firefox 3.6 and earlier versions did. (But the user can create that folder and drop plugin files in that folder; Firefox will still use plugin files that the user "installs" in that manner.) Plugin providers need to use Windows Registry keys to make Firefox aware that their plugins are found and used by Firefox.

If you have the WeLoveMusic (Or something like that) toolbar that is what uses the RadioWMPGecko.dll Files and updates the files that's why you are getting a message from your anti-virus message saying that its "Ok" is because it updates the files and thus overwrites the old updated one.

Hope this Helps!

-Cursedx3

Here`s it`s route; E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\{915793b2-0a75-4c84-8ed7-479086c6d84e}\components

You might notice there are other WMP dlls in there...numbered 5,6,7,8,9,19.  ???

I do have a 3rd party toolbar from "Nirsoft"that I got from the Firefox site a long ways back...and it updates itself as a Firefox add-on/extension soon after. It has a net radio and net tv section built into it. The tv vid player app uses WMP. The toolbar uses it`s own GUI for the radio section.

Funny though, "Conduit" is also in that folder...but it appears to handle the search engine feature of the toolbar. I never see adverts or blocked popups...but I have to say, it`s really a strange thing when you see the Norton pop-up....and you know it has dloaded that same xxx19.dll many times over the last 2 weeks. That`s just too weird.

Oh...Norton also says it`s source is from the Firefox.exe.

I have experienced the same thing. This file is installed or updated almost daily and I get this notification from Norton 360 indicating that the file has been confirmed safe and being used by hundreds of thousands of users without a problem.

This is where the file is located on my hard-drive:

C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\{32be036a-4d7a-44e7-827d-4cb5b3da428f}\components

Also, I noticed that there are several other files with the same name, except that the last digit(s) are different. For example:

• radiowmpcoregecko5.dll,
• radiowmpcoregecko6.dll,
• radiowmpcoregecko7.dll,
• radiowmpcoregecko8.dll,
• radiowmpcoregecko9.dll, and
• radiowmpcoregecko19.dll

The reason I found it strange is because I have seen this file being updated almost everyday for the past month or so and it is updated several times (i.e. I have to "x" out of the little Norton notification 5 0r 6 times), I guess 'cos it's updating all the above mentioned files.

I don't use too many extensions, but I do use a toolbar for Squidoo purposes (i.e. building web pages) from SquidUtils.com which I know is safe.

annode = E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\{915793b2-0a75-4c84-8ed7-479086c6d84e}\components

ajgodinho = C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\{32be036a-4d7a-44e7-827d-4cb5b3da428f}\components

Two different extensions = 2 unique GUID's. If you open the install.rdf in a text editor program you can see the name of that extension and maybe mention of it being created by or with Conduit.

I could see that the DLL would need to be updated every time a new version of Firefox is released (binary files), but not every day or every week.

IMO, just turn off updates for those extensions in the Add-on Manager > Extensions -> More for the extension = Automatic updates = off

BTW, all Conduit extensions were banned and pulled from the Add-ons website 3 or 4 years ago due to a few extension developers scamming the update system to keep their add-ons near the top of the most popular and most downloaded lists. A couple years went by before any Conduit extensions were allowed back at AMO.

Thanks edmeister. I didn`t find any .rdf file associated with the extension...but on moving those xxxWMPxxx files out of there, I lost the Nirsoft Community Toolbar`s net-radio function. On returning them, function returned.

I also had a slurry of updates to those files minutes after booting tonight. So, I took your welcome advice and turned off Nirsoft auto-updating. And yes, the toolbar is produced by Conduit. Lets see what happens.

right now i don't see that this is more than a nuisance: Norton gives their file a green light.

is use firefox 11(beta) as my main browser; ie only for things FF\beta doesn't handle correctly ( it won't update the text field on my ZEN photo site ) .

when i installed WinZip 16 that's when this conduit showed up and added itself to ie9. ie9 won't let me boot that thing out and un-installing ie9 is a PITA (msft needs to be foreced to fix this: ie9 should stand on the same basis as any other browser. but that is another issue ) .

but this stupid .dll has migrated itself across to FF\11 - even though i can't find conduit in FF anyplace . i blocked access to conduit in ie9 hopefully that kills the problem. is hasn't come back for now: i just checked the directory again

i will continue to monitor this and thanks to the admin here for helping !! :-)

I have this RadioWMP.dl and RadioWMP.XPT. Norton said it was from Mozilla. I e-mailed the WebMaster of Firefox and we have tried several things. Thought it was gone, but it downloaded again at 9:35pm tonight like every night. But when I go to Norton Performance and click on the download it says file not found. But it STILL is downloading! The Webmaster I worked with said it may be from an add on or a tool bar, but it wasn't from Mozilla. But the FULL PATH (see below) takes me to Mozilla.

c:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\gj0urcuv.default\extensions\staged\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\components\RadioWMPCoreGecko19.dll

I have deleted ALL the files that were downloaded every night since May 1st. Last night I deleted the conduit files as well. When I looked on the C: tonight the files are listed, but on Norton it says they are not found.

If I need these files ok, but they download at a very inconvenient time, and apparently they aren't doing anything since my computer worked great all day long until they downloaded again. Tonight there was a different file added an XPT file.

I am at a loss. Mozilla's WEBMASTER is telling me it is not part of Mozilla, and Norton is telling me it IS! I would just like SOMEONE to take responsibility for it and tell us what the heck it is and make it so we can download it at a more convenient time like 3am!