?
Solved

MPREXE... virus?

Posted on 2005-03-09
6
Medium Priority
?
259 Views
Last Modified: 2013-12-04
Anyone know anything about  this virus. I know that I picked it up by stupidly clicking on a popup disguised as a security patch for msie. It seemed to start automatically downloading a bunch of dll's and stuff from some porno site. Anyway even though I got rid of all the dll's and exe files from the hard drive and from the registry it just wouldnt go away. Windows would load but would show only my desktop background along with a message box stating that  mprexe caused a fault in kernell32.dll.
So I had to reformat my hard drive and reload windows98. Everything seemed fine and it was going okay until i turned the computer off and then back on about 3 hours later. Then it loads and up comes the mprexe message. But after turning it off and back on the message disappeared.
Now the only thing on there that was copied from the infected disk were the Favorites for msie which I had transferred to a floppy and then back to the new reload. Is it possible that the virus could be hiding in the Favorites
file.
I did a scan with trend micro housecall and it showed no viruses or trojans.
I did read somewhere on the net perhaps it was here at experts exchange that someone had a problem with mprexe showing up from time to time but not really causing any harm. Perhaps it no longer has the dll's to help spawn itself but anyway I'd really like to know a lot more about how it functions.
thanks
0
Comment
Question by:librazone
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 13494648
Hi librazone,
> MPREXE
do you mean mpr.exe - this is a windows 95/98 file?

PeteL
0
 
LVL 4

Accepted Solution

by:
Mikho earned 160 total points
ID: 13495248
i did a little search about mpr.exe and found this message

Copy/Pasted from other page
The message means that password file has been corrupted.
Solution is to delete all .pwl files.
To do so, go to Start/Search
Use *.pwl as a search term.
When the files are found, delete them.
Reboot.
However, deleting pwl files will mean that you will have to re-enter all passwords you have been using.

end copy/paste.

Try that and see if the error still is showing.
0
 
LVL 1

Assisted Solution

by:FMComputers
FMComputers earned 120 total points
ID: 13495798
Interesting that your password files would be corrupted when the system was re-loaded from scratch.

There is a MS 9x process called MPREXE for using multiple network adapters.  Did you re-load any software (AOL, etc) after you re-started the machine?  I would disable all network adapters in Control Panel and see if that makes the error go away.

If so, re-load your network "stuff" to the system.  Sorry I can't be more specific on the re-load, but 98 was a long long time ago for me . . .
0
Need protection from advanced malware attacks?

Look no further than WatchGuard's Total Security Suite, providing defense in depth against today's most headlining attacks like Petya 2.0 and WannaCry. Keep your organization out of the news with protection from known and unknown threats.

 
LVL 24

Assisted Solution

by:SunBow
SunBow earned 120 total points
ID: 13498596
MPR is valid, in that it is part of managing yourself as a client.  But as everything else, it is subject to invasions and cloning attempts.  Format is of course a solution.

An IE hack can leave you vulnerable to anything managing its configuration and preferences. The format wiped your registry (better than any attempt to merely replace damaged files or other recovery options).  Home pages are hacked, and then there's the java, ActiveX, and plugin problems.  Best guess is they hijacked the homepage to run their dirty deeds.

Before loading any favorites, you can try advanced options under internet tools and uncheck any autoruns etc
0
 
LVL 1

Author Comment

by:librazone
ID: 13500849
well it seems to be working okay now.thanks for the input.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 13501237
Thanx
0

Featured Post

Want to be a Web Developer? Get Certified Today!

Enroll in the Certified Web Development Professional course package to learn HTML, Javascript, and PHP. Build a solid foundation to work toward your dream job!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question