Solved

MPNotify.exe Application Error after virus fixes

Posted on 2009-05-05
12
2,011 Views
Last Modified: 2012-05-06
I was given a laptop with a number of viruses on it. I ran avast on it to start the removal process and it found a load and deleted the files. It also ran a boot time virus check. One of the files was mpnotify.exe which had a virus. It couldn't repair the file so it deleted it.

Now when I try to login to the machine, it comes up with the error "Mpnotify.exe Application Error" and then gives a memory referenced error message below. Once you click ok, it immediately closes the machine down. The only way I can get into the machine is to boot into safe mode with no networking and login to the computer not the domain.

Can anyone help with this please?
0
Comment
Question by:GuitarRich
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 3
  • 3
12 Comments
 
LVL 27

Expert Comment

by:Jonvee
ID: 24303813
Found a similar problem here, see if this helps>

mpnotify.exe - Application Error:
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_23141181.html
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 24303824
Which suggested this>
mpnotify.exe > Multiple Provider Notification application

Has more to do with windows login on a network, rather than windows updates.

http://support.microsoft.com/kb/885423
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_23136305.html
http://km-dev.blogspot.com/2007/05/xpe-tip-37-mpnotifyexe-is-not-held-by.html
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 24303857
Also i recommend downloading, then updating Malwarebytes' Anti-Malware:
http://www.malwarebytes.org/mbam.php
When updated, reboot into Safe Mode by selecting F8 at bootup & run a scan.
Tutorial available, if you require >
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t169669.html

Then to be really sure, try the Kaspersky free online virus scanner which is a good way to find out if you have any viruses or spyware without having to uninstall your existing antivirus software>
http://www.kaspersky.co.uk/virusscanner

This scanner is also very good>
 Trend Micro's free online virus scanner:            
http://housecall.trendmicro.com/uk/
Ideal for scanning online, using "Safe Mode with networking".
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 12

Author Comment

by:GuitarRich
ID: 24303859
yeah - I've looked at that and its not much help unfortunately. I used the XP recovery console to copy mpnotify.exe from the XP disc back over the top and that has changed the message. Now I'm getting an svchost.exe error. But it still logs the user off straight away after logging in. I can't even get into safe mode anymore :(
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 24303895
Maybe the laptop is still quite infected so an alternative could be to remove the infected HD, connect it as 'slave' in another machine, then run Malware & virus scanners from the new machine.
0
 
LVL 16

Accepted Solution

by:
warturtle earned 400 total points
ID: 24303928
Get a blank CD and download Dr Web Cure It Live CD file from: http://www.freedrweb.com/livecd/ . The same webpage contains instructions on how to use it. Download the ISO file and burn it as an image on a CD, then boot the PC using this CD and run the virus scan, it could take sometime, but do let us know what you get.

If Dr Web Scanner finds any viruses, then the best option is to select all and then click on Cure. Anything that can be cured will be, or else will be deleted.

It might also be helpful to burn another CD containing Knoppix Live, its basically a linux installation and will allow you to copy all office documents from this PC to a USB drive for backup purposes. It can be downloaded from www.knoppix.net and has to be burnt as an image as well. Do a backup and re-install XP (although its the last option, but is surely an option).
0
 
LVL 27

Assisted Solution

by:Jonvee
Jonvee earned 100 total points
ID: 24304034
Have to ask this .. can you start your computer in Safe mode *with a Command prompt* ?
If yes, type the following command >
%systemroot%\system32\restore\rstrui.exe

Details> http://support.microsoft.com/?kbid=304449

Failing that, if you can access that second machine try running Combofix on the problematic HD.  Download ComboFix and save to Desktop >
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Before using ComboFix it may be necessary to rename it before saving it to your desktop.  
Double click "combofix.exe" and follow the prompts.
When it's finished it will have produced a Logfile, probably at C:\ComboFix.txt.
You could post that log together with a HijackThis log, in a reply for us.
Please do not mouseclick Combofix's window while it is running, because it may stall.  It is absolutely normal for you to see a blue screen with flashing cursor, and this can last for up to 30 mins.  Just let it run.
Try initially to run Combofix in normal mode, although it works well in normal mode or safe mode.
Have to logoff for a few hours , will drop by later ...
0
 
LVL 12

Author Comment

by:GuitarRich
ID: 24312765
Ran Dr Curit and it seems the PC is infect with the Virut.56 virus - everywhere I look says to format and re-install windows :( oh well. Thank you for your help in getting this far!
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24312805
Yes, Virut is going to be difficult to remove. Infected files generally have to be replaced and there could be thousands of them in Windows alone. The only things that you can possibly save are your word, excel and powerpoint documents and that can be done by creating the Knoppix CD as advised in the previous post and taking a backup on USB drive.  

Virut will infect exe files, so don't copy any of those.
0
 
LVL 12

Author Closing Comment

by:GuitarRich
ID: 31577966
Thanks for the help guys
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24312954
Glad to be of assistance :) and thanks for the feedback.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 24314424
You're welcome.   Thanks.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question