Most of the media player programs are fairly aggressive about attempting to set themselves up as your favorite program for everything, and often try to reset themselves as the default player even for things they can't play.

Many, if not most, of the media player programs try to open a web connection every time you open the player, so that they can get all that "enriched content" to show you all the details about each track you play. (The real purpose of this connection probably is so that they can track what you do against their Digital Rights Management (DRM) systems so that you take the heat instead of them if there's a claim against someone.) Many of these systems for "enhancing your pleasure" skirt the fringes of accepted practice regarding privacy, and a few are considered outright spyware by the anti-spyware policy groups. The connection they open should usually be a "background" connection and should not normally produce a web page in your browser.

Any time you enter a URL and your browser goes somewhere else, malware must be suspected. You should also be wary about whether the page it takes you to is a real page, or is a faked one.

The only semi-legitimate redirect I've seen associated with WinXP is a result of automatic updates. I think it happens only when my dialup connection drops offline before an update is completed. In this case, a "run once" link is dropped into Startup so that when I open my browser it goes directly to the Microsoft download center instead of to my normal home page - ONCE. I've confirmed that it goes to the right place, and it's been helpful for checking that I've gotten all of the update. The run once tag self destructs once it's run and I leave the Microsoft site.

From Russ:

http://www.lavasoftusa.com/software/adaware/ Click on AdAware SE Personal for the free version.

http://www.safer-networking.org/en/download/ Spybot Search & Destroy.

These are good programs (Spybot S&D, Ad-Aware SE) and they're free. Get them, UPDATE THEM immediately after download, and run them. Update and run regularly - at least weekly is recommended.

You should also be setup to get WinXP automatic updates from Microsoft. Once an update is released, the malware producers know how to use it. The patch protects those who get it, but the danger to those who don't update skyrockets.

You should also include the Microsoft "Malware Remover" or sign up for the "Microsoft Defender" program if you haven't done so. Microsoft checks about 300,000,000 computers with these programs monthly, and removes malware from about 70 percent of them. They are NOT a substitute for your other AV and AntiSpyware programs, but look only for currently common and damaging malware. You do have to verify that your WinXP has a valid license to get these, but it's not difficult - if your WinXP has a valid license.

You can check on whether RealPlayer has inserted itself to play things you don't want it to, at Start|Settings|Control Panel, double-click Folder Options, click on the File Types tab. Just remove RealPlayer from any file extension you don't want it to play. IFF it pops up to offer to play something not on the list, be sure to always uncheck the box where it says "always use this program to play this filetype" before you let it try to play anything.

RealPlayer may have inserted itself in your Startup folder so that it starts every time you reboot. An icon should be in the System Tray at the bottom right of the toolbar if it's done this. You may reduce the intrusiveness of the program by removing it from the Startup. Some programs offer a "disable" by right-clicking the icon¹, but for others you may have to go to C:\Documents and Settings\username\Start\Programs\Startup and delete the shortcut. Note that you may have to check both the "All Users" and your own "username," since the startup shortcut can appear in either or both places.

¹ Some SysTray icons offer a "disable" that sticks, and some only "disable until reboot" when you right-click in the tray. Others offer no options.

John