Archived from groups: microsoft.public.win98.gen_discussion (More info?)

I have noticed in my startup file, one file called mps.exe. The full path is
c:\windows\system\mps.exe.

For my education, could any one tell me what this is and does? Do I need it?

Thanks

Flusters

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"flusters" <flusters@go4.it> wrote in message
newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> I have noticed in my startup file, one file called mps.exe. The full path
is
> c:\windows\system\mps.exe.
>
> For my education, could any one tell me what this is and does? Do I need
it?

Trojan.Progent is a Trojan Horse that attempts to steal
sensitive information and send it to the creator of the Trojan.

http://securityresponse.symantec.c [...] ogent.html

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Hugh Candlin" <No@MeansNo.Com> wrote in message
news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
>
> "flusters" <flusters@go4.it> wrote in message
> newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > I have noticed in my startup file, one file called mps.exe. The full
path
> is
> > c:\windows\system\mps.exe.
> >
> > For my education, could any one tell me what this is and does? Do I need
> it?
>
> Trojan.Progent is a Trojan Horse that attempts to steal
> sensitive information and send it to the creator of the Trojan.
>
>
http://securityresponse.symantec.c [...] ogent.html
>
So, what has Trojan.Progent got to do with mps.exe?

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Hugh!

Three points before I panic:-

1. I have checked the Symantec page and read it carefully, bearing in mind I
am a novice. I have checked my registry and do not have any of those
specific values or keys mentioned as being added by Trojan.Progent So, I
cannot take the steps to remove them because they are not there in the first
place.
2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
this make a difference?
3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy, PCBugDoctor,
AVG7, Zone Alarms plus Router Security. I have not had any report of any
Trojan Horse.

I am sorry to ask but do you feel certain that we are talking about the same
file? Could it not be an innocent file related to another application?

If it is a Trojan Horse, how can I get rid of it as it has not changed the
registry as detailed by Symantec?

Thanks

Flusters
"Hugh Candlin" <No@MeansNo.Com> wrote in message
news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
>
> "flusters" <flusters@go4.it> wrote in message
> newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > I have noticed in my startup file, one file called mps.exe. The full
path
> is
> > c:\windows\system\mps.exe.
> >
> > For my education, could any one tell me what this is and does? Do I need
> it?
>
> Trojan.Progent is a Trojan Horse that attempts to steal
> sensitive information and send it to the creator of the Trojan.
>
>
http://securityresponse.symantec.c [...] ogent.html
>
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
PCBugDoctor,
AVG7, Zone Alarms plus Router Security. I have not had any report of
any
Trojan Horse. "

Although many Trojans "spy" on your computer, they are generally not
classified as spyware due to their intentionally malicious nature.
Where as spyware is often passive in nature and used by companies for
marketing purposes.(Most users would reallize they are actually
installing spyware themselves if they'd read the EULA when they are
accepting certificates or installing software.)

Instead of using the hodge podge of programs above, I'd suggest using a
piece of software that is specialized in antivirus removal only. I am
a big fan of open source, and clamwin is available in that realm, but a
commercial product is probably better here, because they have the
capital and infrastructure to support the product with vulnerability
updates, testing, and defintion file updates. For such a critical
tasks as antivirus/trojan detection/removal, I wouldn't want to delgate
to a non-commercial product. Clamwin often gives me false positives on
files that aren't really virus/trojans.

I personally use the corporate edition of Norton Antivirus.

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Dave D" <DRD@INVALIDdavedownton.fsnet.co.uk> wrote in message
newsddfk6$7uf$1@newsg3.svr.pol.co.uk...
>
> "Hugh Candlin" <No@MeansNo.Com> wrote in message
> news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> >
> > "flusters" <flusters@go4.it> wrote in message
> > newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > I have noticed in my startup file, one file called mps.exe. The full
> path
> > is
> > > c:\windows\system\mps.exe.
> > >
> > > For my education, could any one tell me what this is and does? Do I
need
> > it?
> >
> > Trojan.Progent is a Trojan Horse that attempts to steal
> > sensitive information and send it to the creator of the Trojan.
> >
> >
>
http://securityresponse.symantec.c [...] ogent.html
> >
> So, what has Trojan.Progent got to do with mps.exe?

See

http://securityresponse.symantec.c [...] ogent.html

Or search Yahoo.

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"flusters" <flusters@go4.it> wrote in message
news:%23dW00ddnFHA.4056@TK2MSFTNGP10.phx.gbl...
> Thanks Hugh!
>
> Three points before I panic:-
>
> 1. I have checked the Symantec page and read it carefully, bearing in mind
I
> am a novice. I have checked my registry and do not have any of those
> specific values or keys mentioned as being added by Trojan.Progent

There may be more than one bad guy
which drops a file of that name.

Search Yahoo, or Google if you prefer,
and check out the likely candidates
until you find one that matches your situation.

I am not familiar with any legitimate application
which uses a file of that name, except that MPS.EXE
is related to MapSource, a Garmin program,
which exchanges waypoint, route, and map data
with Garmin GPS receivers.

Is that a possibility?

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Are you sure its mps.exe and not mpsexe?

mpsexe = http://castlecops.com/s2203-mscifapp_exe.html

--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "flusters" <flusters@go4.it>

| I have noticed in my startup file, one file called mps.exe. The full path is
| c:\windows\system\mps.exe.
|
| For my education, could any one tell me what this is and does? Do I need it?
|
| Thanks
|
| Flusters
|

It may be a Trojan Password stealer.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove
viruses and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

> 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> this make a difference?

Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or a GPS
utility.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security


flusters wrote:
> Thanks Hugh!
>
> Three points before I panic:-
>
> 1. I have checked the Symantec page and read it carefully, bearing in
> mind I am a novice. I have checked my registry and do not have any of
> those specific values or keys mentioned as being added by Trojan.Progent
> So, I cannot take the steps to remove them because they are not there in
> the first place.
> 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> this make a difference?
> 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy, PCBugDoctor,
> AVG7, Zone Alarms plus Router Security. I have not had any report of any
> Trojan Horse.
>
> I am sorry to ask but do you feel certain that we are talking about the
> same file? Could it not be an innocent file related to another
> application?
>
> If it is a Trojan Horse, how can I get rid of it as it has not changed the
> registry as detailed by Symantec?
>
> Thanks
>
> Flusters
> "Hugh Candlin" <No@MeansNo.Com> wrote in message
> news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> >
> > "flusters" <flusters@go4.it> wrote in message
> > newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > I have noticed in my startup file, one file called mps.exe. The full
> > > path is c:\windows\system\mps.exe.
> > >
> > > For my education, could any one tell me what this is and does? Do I
> > > need it?
> >
> > Trojan.Progent is a Trojan Horse that attempts to steal
> > sensitive information and send it to the creator of the Trojan.
> >
> >
> http://securityresponse.symantec.c [...] ogent.html

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks to all and particularly PA Bear - I hope that he is right. Maybe
there is some light at the end of the tunnel.

An update. I have the similar file on 2 only out of 3 computers. Those two
computers are both linked to one printer - a Canon SmartBase MPC 200. Both
also have a software program which updates an automobile GPS Radar
spotting/tracking device. I have emailed both Canon and the GPS Device
corps.

Canon has not yet replied. The GPS Radar people say that it is definitely
not their file.

I would like to believe that there is an innocent explanation.

Will advise once Canon reply.

Flusters
"PA Bear" <PABearMVP@gmail.com> wrote in message
news9m0m8hnFHA.2860@TK2MSFTNGP15.phx.gbl...
> > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> > this make a difference?
>
> Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or a
GPS
> utility.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE/OE) & Security
>
>
> flusters wrote:
> > Thanks Hugh!
> >
> > Three points before I panic:-
> >
> > 1. I have checked the Symantec page and read it carefully, bearing in
> > mind I am a novice. I have checked my registry and do not have any of
> > those specific values or keys mentioned as being added by Trojan.Progent
> > So, I cannot take the steps to remove them because they are not there in
> > the first place.
> > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> > this make a difference?
> > 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> > SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
PCBugDoctor,
> > AVG7, Zone Alarms plus Router Security. I have not had any report of any
> > Trojan Horse.
> >
> > I am sorry to ask but do you feel certain that we are talking about the
> > same file? Could it not be an innocent file related to another
> > application?
> >
> > If it is a Trojan Horse, how can I get rid of it as it has not changed
the
> > registry as detailed by Symantec?
> >
> > Thanks
> >
> > Flusters
> > "Hugh Candlin" <No@MeansNo.Com> wrote in message
> > news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> > >
> > > "flusters" <flusters@go4.it> wrote in message
> > > newsnogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > > I have noticed in my startup file, one file called mps.exe. The full
> > > > path is c:\windows\system\mps.exe.
> > > >
> > > > For my education, could any one tell me what this is and does? Do I
> > > > need it?
> > >
> > > Trojan.Progent is a Trojan Horse that attempts to steal
> > > sensitive information and send it to the creator of the Trojan.
> > >
> > >
> >
http://securityresponse.symantec.c [...] ogent.html
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Brian

No, it is definitely c:\windows\system\mps.exe

"Brian A." <gonefish'n@afarawaylake> wrote in message
news:ug7J3KfnFHA.3316@tk2msftngp13.phx.gbl...
> Are you sure its mps.exe and not mpsexe?
>
> mpsexe = http://castlecops.com/s2203-mscifapp_exe.html
>
> --
>
> Brian A. Sesko { MS MVP_Shell/User }
> Conflicts start where information lacks.
> http://basconotw.mvps.org/
>
> Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
> How to ask a question: http://support.microsoft.com/kb/555375
>
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Sorry, just checked the second computer and it is slightly different. It
reads

c:\windows\system\mps.exe /s

Flusters

"flusters" <flusters@go4.it> wrote in message
news:%23pfrseqnFHA.3304@tk2msftngp13.phx.gbl...
> Thanks Brian
>
> No, it is definitely c:\windows\system\mps.exe
>
> "Brian A." <gonefish'n@afarawaylake> wrote in message
> news:ug7J3KfnFHA.3316@tk2msftngp13.phx.gbl...
> > Are you sure its mps.exe and not mpsexe?
> >
> > mpsexe = http://castlecops.com/s2203-mscifapp_exe.html
> >
> > --
> >
> > Brian A. Sesko { MS MVP_Shell/User }
> > Conflicts start where information lacks.
> > http://basconotw.mvps.org/
> >
> > Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
> > How to ask a question: http://support.microsoft.com/kb/555375
> >
> >
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More