In the spirit of discovery, there are two tidbits here.
http://social.technet.microsoft.com/Forums/en-US/w7itpromedia/thread/360a255b-3a90-45cf-b5cc-5d4fbbc60a1f
C:\Users\%userdata%\AppData\Local\Microsoft\Media Player
CurrentDatabase_360.wmdb
CurrentDatabase_371.wmdb
It doesn't say what format the database takes. I wouldn't expect you could
read the .wmdb directly.
At the end of the thread, there is a tool available, which
backs up the .wmdb.
"Metadata Backup"
http://www.dalepreston.com/Blog/2007/03/windows-media-player-metadata-backup.html
What that does, is convert .wmdb to .xml. (And maybe, vice versa)
XML files are text files. You should be able to view them in Wordpad or Notepad.
(You can temporarily change the extension to .txt, if you can't otherwise
figure out how to open them.) It's a wordy format, that humans aren't likely
to appreciate. (Even the Registry is more fun, than walking through an XML.)
What you'll be looking for in there, is whether each album has a
status of "found" or not. If the albums aren't "found", perhaps the
metadata (tracks, cover, details) are getting updated from the Internet
somehow.
In any case, review the information in the .wmdb, as an XML file
first, and see if there is anything that looks wrong to you.
I don't see any reason to postulate malware at a time like this,
when the software is likely capable of making a mess all on its own.
(I hate software which is too damn clever.)
Paul