Scheduled maintenance: Monday, March 30, between 3:30pm and 5:30pm UTC. This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn’t solve your issue and you want to ask a question, we have our support community waiting to help you at @firefox on Twitter

# Isithangami Sabeseki

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

## When I upgraded to Firefox 6 File RadioWMPGecko19.dll was downloaded. What is the purpose of this file, and can I delete it?

Kuphostiwe

When I upgraded to Firefox 6 File RadioWMPGecko19.dll was downloaded. What is the purpose of this file, and can I delete it? I went online to several sites and it seems to be a mystery. According to one site downloads have occured all over the world. Is this a threath?

When I upgraded to Firefox 6 File RadioWMPGecko19.dll was downloaded. What is the purpose of this file, and can I delete it? I went online to several sites and it seems to be a mystery. According to one site downloads have occured all over the world. Is this a threath?

# Eminye Imininingwane Yohlelo

## Lokhu kwenzekile

Kanye noma kabili

## Fakela amapulagi

• Foxit Reader Plug-In For Firefox and Netscape
• np-mswmp
• Coupons, Inc. Coupon Printer DLL
• Coupons, Inc. Coupon Printer Plugin
• Adobe PDF Plug-In For Firefox and Netscape 10.0.1
• NPRuntime Script Plug-in Library for Java(TM) Deploy
• CouponNetwork Coupon Activator
• Shockwave Flash 10.3 r183
• Adobe Shockwave for Director Netscape plug-in, version 11.5
• GEPlugin
• Next Generation Java Plug-in 1.6.0_26 for Mozilla browsers
• 4.0.60531.0
• The plug-in allows you to open and edit files using Microsoft Office applications

## Isisebenziso

• I-ejenti Engumsebenzisi: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

## Eminye Imininingwane

cor-el
• Top 10 Contributor
• Moderator
17845 izisombululo 161524 izimpendulo
Kuphostiwe

There is an indication of malware called RadioWMPCOREGecko19.dll

Do you mean that file?

Do a malware check with some malware scanning programs.
You need to scan with all programs because each program detects different malware.
Make sure that you update each program to get the latest version of their databases before doing a scan.

If using the above listed scanners does not fix it or if you are blocked from installing those scanners then ask advice on one of the forums that specialize in malware removal mentioned in the Popups_not_blocked article.

### Umnikazi wombuzo

Yes I mean the RadioWMPCOREGecko19.dll file. It does not come up in any scan, Norton says its OK as does other malware and antivirus programs. Can you just erase it? Does anyone know where it came from or what it does?

Yes I mean the RadioWMPCOREGecko19.dll file. It does not come up in any scan, Norton says its OK as does other malware and antivirus programs. Can you just erase it? Does anyone know where it came from or what it does?
komakai 0 izisombululo 31 izimpendulo
Kuphostiwe

Unfortunately you can't tell if a file is malware just by the filename. It's common for malware to replace standard files to avoid suspicious filenames.

Is your Norton up to date? If so and nothing comes up in the scan I suppose you just have to ask yourself how much you trust Symantec ;-)

If the filename is any indication of what it is for I would guess it's some form of plugin which allows you to stream WMP files to play them in Firefox. Again, you can't judge from a filename so that is just supposition.

Why not rename the file so it can't be used (with Firefox closed of course). Just change the .dll extension to something else or add something to the end of it. If you can start and use Firefox for the sites you usually visit with the renamed file you probably don't need it. If you can't you just need to change the name back.

Editing my post because I forgot to say:

If you are worried about it being malware, why not send a sample to your anti-virus vendor Symantec. They will be able to check if there is anything malicious in it. They might not answer you personally but if they think it is suspicious they will at least update their software so Norton will identify it so as long as you are keeping it up to date you should have no problem. In the meantime, as long as you change the .dll extension to something meaningless to Windows it will not run so you are safe even if it is malware.

Unfortunately you can't tell if a file is malware just by the filename. It's common for malware to replace standard files to avoid suspicious filenames. Is your Norton up to date? If so and nothing comes up in the scan I suppose you just have to ask yourself how much you trust Symantec ;-) If the filename is any indication of what it is for I would guess it's some form of plugin which allows you to stream WMP files to play them in Firefox. Again, you can't judge from a filename so that is just supposition. Why not rename the file so it can't be used (with Firefox closed of course). Just change the .dll extension to something else or add something to the end of it. If you can start and use Firefox for the sites you usually visit with the renamed file you probably don't need it. If you can't you just need to change the name back. Editing my post because I forgot to say: If you are worried about it being malware, why not send a sample to your anti-virus vendor Symantec. They will be able to check if there is anything malicious in it. They might not answer you personally but if they think it is suspicious they will at least update their software so Norton will identify it so as long as you are keeping it up to date you should have no problem. In the meantime, as long as you change the .dll extension to something meaningless to Windows it will not run so you are safe even if it is malware.

Okulungisiwe ngu komakai

cor-el
• Top 10 Contributor
• Moderator
17845 izisombululo 161524 izimpendulo
Kuphostiwe

What is the location of that file?

Is it part of a Firefox extension?

What is the location of that file? Is it part of a Firefox extension? *https://support.mozilla.com/kb/Troubleshooting+extensions+and+themes
komakai 0 izisombululo 31 izimpendulo
Kuphostiwe

As I am curious about this file now I have done some searching and have come across a test media player file provided by Mozilla.

It may be wise to confirm whether the file is part of an extension first as cor-el asks but then after changing the name of the dll you could try accessing http://hg.mozilla.org/qa/litmus-data/raw-file/tip/firefox/plugins/mediaplayer.html to see if the audio plays.

Of course even if it doesn't it doesn't mean it is not a Firefox file. Now that Microsoft have to give users the choice of a browser they cannot assume that IE will be installed on Windows and to use the Radio functionality within Media Player they need to go through a configured browser. So another potential valid use of a file like this might be to allow WMP to access the internet on machines where Firefox is the only browser. Again, just speculation but if this file did come with the Firefox update (not an extension or from somewhere else) then either there is a valid reason for it (whether or not you yourself need it) or Mozilla or the provider of the extension have fallen foul of malicious behaviour.

I don't use Windows so can't confirm if it is part of the standard installation.

As I am curious about this file now I have done some searching and have come across a test media player file provided by Mozilla. It may be wise to confirm whether the file is part of an extension first as cor-el asks but then after changing the name of the dll you could try accessing http://hg.mozilla.org/qa/litmus-data/raw-file/tip/firefox/plugins/mediaplayer.html to see if the audio plays. Of course even if it doesn't it doesn't mean it is not a Firefox file. Now that Microsoft have to give users the choice of a browser they cannot assume that IE will be installed on Windows and to use the Radio functionality within Media Player they need to go through a configured browser. So another potential valid use of a file like this might be to allow WMP to access the internet on machines where Firefox is the only browser. Again, just speculation but if this file did come with the Firefox update (not an extension or from somewhere else) then either there is a valid reason for it (whether or not you yourself need it) or Mozilla or the provider of the extension have fallen foul of malicious behaviour. I don't use Windows so can't confirm if it is part of the standard installation.

Okulungisiwe ngu komakai

wolfrail 0 izisombululo 3 izimpendulo
Kuphostiwe

### Impendulo Ewusizo

Hallo everybody! As Norton found out and wrote to me, RadioWMPGecko19.dll or RadioWMPGecko5.dll is no malware but an update (extension) for the Firefox browser. That´s the reason, that malware scanning programs can´t detect it. The solution to prevent this update from slowing down the computers must be found by Mozilla. Hope this will help.

Hallo everybody! As Norton found out and wrote to me, ''RadioWMPGecko19.dll'' or ''RadioWMPGecko5.dll'' is no malware but an update (extension) for the Firefox browser. That´s the reason, that malware scanning programs can´t detect it. The solution to prevent this update from slowing down the computers must be found by Mozilla. Hope this will help.
the-edmeister
• Top 25 Contributor
• Moderator
5433 izisombululo 40562 izimpendulo
Kuphostiwe

The folder that DLL file is sitting in might give you an idea about what program installed that file.

It shouldn't be in a Firefox folder. Firefox doesn't allow 3rd party plugins to be installed or dropped in Firefox folders any longer, that ended as of Firefox 3.6. And Firefox 4+ versions don't even have the Firefox program files \plugins\ folder as Firefox 3.6 and earlier versions did. (But the user can create that folder and drop plugin files in that folder; Firefox will still use plugin files that the user "installs" in that manner.) Plugin providers need to use Windows Registry keys to make Firefox aware that their plugins are found and used by Firefox.

Exactly where is that RadioWMPGecko19.dll sitting on your PC? <br /> The folder that DLL file is sitting in might give you an idea about what program installed that file. It shouldn't be in a Firefox folder. Firefox doesn't allow 3rd party plugins to be installed or dropped in Firefox folders any longer, that ended as of Firefox 3.6. And Firefox 4+ versions don't even have the Firefox program files \plugins\ folder as Firefox 3.6 and earlier versions did. ''(But the user can create that folder and drop plugin files in that folder; Firefox will still use plugin files that the user "installs" in that manner.)'' Plugin providers need to use Windows Registry keys to make Firefox aware that their plugins are found and used by Firefox.
Cursedx3 0 izisombululo 1 izimpendulo
Kuphostiwe

### Impendulo Ewusizo

If you have the WeLoveMusic (Or something like that) toolbar that is what uses the RadioWMPGecko.dll Files and updates the files that's why you are getting a message from your anti-virus message saying that its "Ok" is because it updates the files and thus overwrites the old updated one.

Hope this Helps!

-Cursedx3

If you have the WeLoveMusic (Or something like that) toolbar that is what uses the RadioWMPGecko.dll Files and updates the files that's why you are getting a message from your anti-virus message saying that its "Ok" is because it updates the files and thus overwrites the old updated one. Hope this Helps! -Cursedx3
annode 0 izisombululo 4 izimpendulo
Kuphostiwe

Heres its route; E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\{915793b2-0a75-4c84-8ed7-479086c6d84e}\components

You might notice there are other WMP dlls in there...numbered 5,6,7,8,9,19.  ???

I do have a 3rd party toolbar from "Nirsoft"that I got from the Firefox site a long ways back...and it updates itself as a Firefox add-on/extension soon after. It has a net radio and net tv section built into it. The tv vid player app uses WMP. The toolbar uses its own GUI for the radio section.

Funny though, "Conduit" is also in that folder...but it appears to handle the search engine feature of the toolbar. I never see adverts or blocked popups...but I have to say, its really a strange thing when you see the Norton pop-up....and you know it has dloaded that same xxx19.dll many times over the last 2 weeks. Thats just too weird.

Oh...Norton also says its source is from the Firefox.exe.

Heres its route; E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\{915793b2-0a75-4c84-8ed7-479086c6d84e}\components You might notice there are other WMP dlls in there...numbered 5,6,7,8,9,19. ??? I do have a 3rd party toolbar from "Nirsoft"that I got from the Firefox site a long ways back...and it updates itself as a Firefox add-on/extension soon after. It has a net radio and net tv section built into it. The tv vid player app uses WMP. The toolbar uses its own GUI for the radio section. Funny though, "Conduit" is also in that folder...but it appears to handle the search engine feature of the toolbar. I never see adverts or blocked popups...but I have to say, its really a strange thing when you see the Norton pop-up....and you know it has dloaded that same xxx19.dll many times over the last 2 weeks. Thats just too weird. Oh...Norton also says its source is from the Firefox.exe.

Okulungisiwe ngu annode

AJ Godinho 33 izisombululo 134 izimpendulo
Kuphostiwe

I have experienced the same thing. This file is installed or updated almost daily and I get this notification from Norton 360 indicating that the file has been confirmed safe and being used by hundreds of thousands of users without a problem.

This is where the file is located on my hard-drive:

C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\{32be036a-4d7a-44e7-827d-4cb5b3da428f}\components

Also, I noticed that there are several other files with the same name, except that the last digit(s) are different. For example:

The reason I found it strange is because I have seen this file being updated almost everyday for the past month or so and it is updated several times (i.e. I have to "x" out of the little Norton notification 5 0r 6 times), I guess 'cos it's updating all the above mentioned files.

I don't use too many extensions, but I do use a toolbar for Squidoo purposes (i.e. building web pages) from SquidUtils.com which I know is safe.

I have experienced the same thing. This file is installed or updated almost daily and I get this notification from Norton 360 indicating that the file has been confirmed safe and being used by hundreds of thousands of users without a problem. This is where the file is located on my hard-drive: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\{32be036a-4d7a-44e7-827d-4cb5b3da428f}\components Also, I noticed that there are several other files with the same name, except that the last digit(s) are different. For example: * radiowmpcoregecko5.dll, * radiowmpcoregecko6.dll, * radiowmpcoregecko7.dll, * radiowmpcoregecko8.dll, * radiowmpcoregecko9.dll, and * radiowmpcoregecko19.dll The reason I found it strange is because I have seen this file being updated almost everyday for the past month or so and it is updated several times (i.e. I have to "x" out of the little Norton notification 5 0r 6 times), I guess 'cos it's updating all the above mentioned files. I don't use too many extensions, but I do use a toolbar for Squidoo purposes (i.e. building web pages) from SquidUtils.com which I know is safe.

Okulungisiwe ngu AJ Godinho

the-edmeister
• Top 25 Contributor
• Moderator
5433 izisombululo 40562 izimpendulo
Kuphostiwe

annode = E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\{915793b2-0a75-4c84-8ed7-479086c6d84e}\components

ajgodinho = C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\{32be036a-4d7a-44e7-827d-4cb5b3da428f}\components

Two different extensions = 2 unique GUID's. If you open the install.rdf in a text editor program you can see the name of that extension and maybe mention of it being created by or with Conduit.

I could see that the DLL would need to be updated every time a new version of Firefox is released (binary files), but not every day or every week.

IMO, just turn off updates for those extensions in the Add-on Manager > Extensions -> More for the extension = Automatic updates = off

BTW, all Conduit extensions were banned and pulled from the Add-ons website 3 or 4 years ago due to a few extension developers scamming the update system to keep their add-ons near the top of the most popular and most downloaded lists. A couple years went by before any Conduit extensions were allowed back at AMO.

annode = '''''E:\Documents and Settings\Barry\Application Data\Mozilla\Firefox\Profiles\knr3vdtj.default\extensions\''{915793b2-0a75-4c84-8ed7-479086c6d84e}''\components ''''' ajgodinho = '''''C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\1jup89bo.default\extensions\''{32be036a-4d7a-44e7-827d-4cb5b3da428f}''\components ''''' Two different extensions = 2 unique GUID's. If you open the '''install.rdf''' in a text editor program you can see the name of that extension and maybe mention of it being created by or with Conduit. I could see that the DLL would need to be updated every time a new version of Firefox is released (binary files), but not every day or every week. IMO, just turn off updates for those extensions in the Add-on Manager > Extensions -> '''''More''''' for the extension = Automatic updates = off BTW, all Conduit extensions were banned and pulled from the Add-ons website 3 or 4 years ago due to a few extension developers scamming the update system to keep their add-ons near the top of the most popular and most downloaded lists. A couple years went by before any Conduit extensions were allowed back at AMO.
annode 0 izisombululo 4 izimpendulo
Kuphostiwe

Thanks edmeister. I didnt find any .rdf file associated with the extension...but on moving those xxxWMPxxx files out of there, I lost the Nirsoft Community Toolbars net-radio function. On returning them, function returned.

I also had a slurry of updates to those files minutes after booting tonight. So, I took your welcome advice and turned off Nirsoft auto-updating. And yes, the toolbar is produced by Conduit. Lets see what happens.

Thanks edmeister. I didnt find any .rdf file associated with the extension...but on moving those xxxWMPxxx files out of there, I lost the Nirsoft Community Toolbars net-radio function. On returning them, function returned. I also had a slurry of updates to those files minutes after booting tonight. So, I took your welcome advice and turned off Nirsoft auto-updating. And yes, the toolbar is produced by Conduit. Lets see what happens.

Okulungisiwe ngu annode

bill.albert 0 izisombululo 2 izimpendulo
Kuphostiwe

right now i don't see that this is more than a nuisance: Norton gives their file a green light.

is use firefox 11(beta) as my main browser; ie only for things FF\beta doesn't handle correctly ( it won't update the text field on my ZEN photo site ) .

when i installed WinZip 16 that's when this conduit showed up and added itself to ie9. ie9 won't let me boot that thing out and un-installing ie9 is a PITA (msft needs to be foreced to fix this: ie9 should stand on the same basis as any other browser. but that is another issue ) .

but this stupid .dll has migrated itself across to FF\11 - even though i can't find conduit in FF anyplace . i blocked access to conduit in ie9 hopefully that kills the problem. is hasn't come back for now: i just checked the directory again

i will continue to monitor this and thanks to the admin here for helping !! :-)

right now i don't see that this is more than a nuisance: Norton gives their file a green light. is use firefox 11(beta) as my main browser; ie only for things FF\beta doesn't handle correctly ( it won't update the text field on my ZEN photo site ) . when i installed WinZip 16 that's when this conduit showed up and added itself to ie9. ie9 won't let me boot that thing out and un-installing ie9 is a PITA (msft needs to be foreced to fix this: ie9 should stand on the same basis as any other browser. but that is another issue ) . but this stupid .dll has migrated itself across to FF\11 - even though i can't find conduit in FF anyplace . i blocked access to conduit in ie9 hopefully that kills the problem. is hasn't come back for now: i just checked the directory again i will continue to monitor this and thanks to the admin here for helping !! :-)