What is MPS.EXE?

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"flusters" <flusters@go4.it> wrote in message
news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> I have noticed in my startup file, one file called mps.exe. The full path
is
> c:\windows\system\mps.exe.
>
> For my education, could any one tell me what this is and does? Do I need
it?

Trojan.Progent is a Trojan Horse that attempts to steal
sensitive information and send it to the creator of the Trojan.

http://securityresponse.symantec.com/avcenter/venc/data...

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
PCBugDoctor,
AVG7, Zone Alarms plus Router Security. I have not had any report of
any
Trojan Horse. "

Although many Trojans "spy" on your computer, they are generally not
classified as spyware due to their intentionally malicious nature.
Where as spyware is often passive in nature and used by companies for
marketing purposes.(Most users would reallize they are actually
installing spyware themselves if they'd read the EULA when they are
accepting certificates or installing software.)

Instead of using the hodge podge of programs above, I'd suggest using a
piece of software that is specialized in antivirus removal only. I am
a big fan of open source, and clamwin is available in that realm, but a
commercial product is probably better here, because they have the
capital and infrastructure to support the product with vulnerability
updates, testing, and defintion file updates. For such a critical
tasks as antivirus/trojan detection/removal, I wouldn't want to delgate
to a non-commercial product. Clamwin often gives me false positives on
files that aren't really virus/trojans.

I personally use the corporate edition of Norton Antivirus.

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Are you sure its mps.exe and not mpsexe?

mpsexe = http://castlecops.com/s2203-mscifapp_exe.html

--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "flusters" <flusters@go4.it>

| I have noticed in my startup file, one file called mps.exe. The full path is
| c:\windows\system\mps.exe.
|
| For my education, could any one tell me what this is and does? Do I need it?
|
| Thanks
|
| Flusters
|

It may be a Trojan Password stealer.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove
viruses and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Hugh Candlin" <No@MeansNo.Com> wrote in message
news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
>
> "flusters" <flusters@go4.it> wrote in message
> news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > I have noticed in my startup file, one file called mps.exe. The full
path
> is
> > c:\windows\system\mps.exe.
> >
> > For my education, could any one tell me what this is and does? Do I need
> it?
>
> Trojan.Progent is a Trojan Horse that attempts to steal
> sensitive information and send it to the creator of the Trojan.
>
>
http://securityresponse.symantec.com/avcenter/venc/data...
>
So, what has Trojan.Progent got to do with mps.exe?

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Dave D" <DRD@INVALIDdavedownton.fsnet.co.uk> wrote in message
news ddfk6$7uf$1@newsg3.svr.pol.co.uk...
>
> "Hugh Candlin" <No@MeansNo.Com> wrote in message
> news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> >
> > "flusters" <flusters@go4.it> wrote in message
> > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > I have noticed in my startup file, one file called mps.exe. The full
> path
> > is
> > > c:\windows\system\mps.exe.
> > >
> > > For my education, could any one tell me what this is and does? Do I
need
> > it?
> >
> > Trojan.Progent is a Trojan Horse that attempts to steal
> > sensitive information and send it to the creator of the Trojan.
> >
> >
>
http://securityresponse.symantec.com/avcenter/venc/data...
> >
> So, what has Trojan.Progent got to do with mps.exe?

See

http://securityresponse.symantec.com/avcenter/venc/data...

Or search Yahoo.

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Hugh!

Three points before I panic:-

1. I have checked the Symantec page and read it carefully, bearing in mind I
am a novice. I have checked my registry and do not have any of those
specific values or keys mentioned as being added by Trojan.Progent So, I
cannot take the steps to remove them because they are not there in the first
place.
2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
this make a difference?
3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy, PCBugDoctor,
AVG7, Zone Alarms plus Router Security. I have not had any report of any
Trojan Horse.

I am sorry to ask but do you feel certain that we are talking about the same
file? Could it not be an innocent file related to another application?

If it is a Trojan Horse, how can I get rid of it as it has not changed the
registry as detailed by Symantec?

Thanks

Flusters
"Hugh Candlin" <No@MeansNo.Com> wrote in message
news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
>
> "flusters" <flusters@go4.it> wrote in message
> news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > I have noticed in my startup file, one file called mps.exe. The full
path
> is
> > c:\windows\system\mps.exe.
> >
> > For my education, could any one tell me what this is and does? Do I need
> it?
>
> Trojan.Progent is a Trojan Horse that attempts to steal
> sensitive information and send it to the creator of the Trojan.
>
>
http://securityresponse.symantec.com/avcenter/venc/data...
>
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"flusters" <flusters@go4.it> wrote in message
news:%23dW00ddnFHA.4056@TK2MSFTNGP10.phx.gbl...
> Thanks Hugh!
>
> Three points before I panic:-
>
> 1. I have checked the Symantec page and read it carefully, bearing in mind
I
> am a novice. I have checked my registry and do not have any of those
> specific values or keys mentioned as being added by Trojan.Progent

There may be more than one bad guy
which drops a file of that name.

Search Yahoo, or Google if you prefer,
and check out the likely candidates
until you find one that matches your situation.

I am not familiar with any legitimate application
which uses a file of that name, except that MPS.EXE
is related to MapSource, a Garmin program,
which exchanges waypoint, route, and map data
with Garmin GPS receivers.

Is that a possibility?

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

> 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> this make a difference?

Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or a GPS
utility.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security


flusters wrote:
> Thanks Hugh!
>
> Three points before I panic:-
>
> 1. I have checked the Symantec page and read it carefully, bearing in
> mind I am a novice. I have checked my registry and do not have any of
> those specific values or keys mentioned as being added by Trojan.Progent
> So, I cannot take the steps to remove them because they are not there in
> the first place.
> 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> this make a difference?
> 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy, PCBugDoctor,
> AVG7, Zone Alarms plus Router Security. I have not had any report of any
> Trojan Horse.
>
> I am sorry to ask but do you feel certain that we are talking about the
> same file? Could it not be an innocent file related to another
> application?
>
> If it is a Trojan Horse, how can I get rid of it as it has not changed the
> registry as detailed by Symantec?
>
> Thanks
>
> Flusters
> "Hugh Candlin" <No@MeansNo.Com> wrote in message
> news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> >
> > "flusters" <flusters@go4.it> wrote in message
> > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > I have noticed in my startup file, one file called mps.exe. The full
> > > path is c:\windows\system\mps.exe.
> > >
> > > For my education, could any one tell me what this is and does? Do I
> > > need it?
> >
> > Trojan.Progent is a Trojan Horse that attempts to steal
> > sensitive information and send it to the creator of the Trojan.
> >
> >
> http://securityresponse.symantec.com/avcenter/venc/data...

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks to all and particularly PA Bear - I hope that he is right. Maybe
there is some light at the end of the tunnel.

An update. I have the similar file on 2 only out of 3 computers. Those two
computers are both linked to one printer - a Canon SmartBase MPC 200. Both
also have a software program which updates an automobile GPS Radar
spotting/tracking device. I have emailed both Canon and the GPS Device
corps.

Canon has not yet replied. The GPS Radar people say that it is definitely
not their file.

I would like to believe that there is an innocent explanation.

Will advise once Canon reply.

Flusters
"PA Bear" <PABearMVP@gmail.com> wrote in message
news 9m0m8hnFHA.2860@TK2MSFTNGP15.phx.gbl...
> > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> > this make a difference?
>
> Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or a
GPS
> utility.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE/OE) & Security
>
>
> flusters wrote:
> > Thanks Hugh!
> >
> > Three points before I panic:-
> >
> > 1. I have checked the Symantec page and read it carefully, bearing in
> > mind I am a novice. I have checked my registry and do not have any of
> > those specific values or keys mentioned as being added by Trojan.Progent
> > So, I cannot take the steps to remove them because they are not there in
> > the first place.
> > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe. Does
> > this make a difference?
> > 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> > SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
PCBugDoctor,
> > AVG7, Zone Alarms plus Router Security. I have not had any report of any
> > Trojan Horse.
> >
> > I am sorry to ask but do you feel certain that we are talking about the
> > same file? Could it not be an innocent file related to another
> > application?
> >
> > If it is a Trojan Horse, how can I get rid of it as it has not changed
the
> > registry as detailed by Symantec?
> >
> > Thanks
> >
> > Flusters
> > "Hugh Candlin" <No@MeansNo.Com> wrote in message
> > news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> > >
> > > "flusters" <flusters@go4.it> wrote in message
> > > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > > I have noticed in my startup file, one file called mps.exe. The full
> > > > path is c:\windows\system\mps.exe.
> > > >
> > > > For my education, could any one tell me what this is and does? Do I
> > > > need it?
> > >
> > > Trojan.Progent is a Trojan Horse that attempts to steal
> > > sensitive information and send it to the creator of the Trojan.
> > >
> > >
> >
http://securityresponse.symantec.com/avcenter/venc/data...
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Brian

No, it is definitely c:\windows\system\mps.exe

"Brian A." <gonefish'n@afarawaylake> wrote in message
news:ug7J3KfnFHA.3316@tk2msftngp13.phx.gbl...
> Are you sure its mps.exe and not mpsexe?
>
> mpsexe = http://castlecops.com/s2203-mscifapp_exe.html
>
> --
>
> Brian A. Sesko { MS MVP_Shell/User }
> Conflicts start where information lacks.
> http://basconotw.mvps.org/
>
> Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
> How to ask a question: http://support.microsoft.com/kb/555375
>
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Sorry, just checked the second computer and it is slightly different. It
reads

c:\windows\system\mps.exe /s

Flusters

"flusters" <flusters@go4.it> wrote in message
news:%23pfrseqnFHA.3304@tk2msftngp13.phx.gbl...
> Thanks Brian
>
> No, it is definitely c:\windows\system\mps.exe
>
> "Brian A." <gonefish'n@afarawaylake> wrote in message
> news:ug7J3KfnFHA.3316@tk2msftngp13.phx.gbl...
> > Are you sure its mps.exe and not mpsexe?
> >
> > mpsexe = http://castlecops.com/s2203-mscifapp_exe.html
> >
> > --
> >
> > Brian A. Sesko { MS MVP_Shell/User }
> > Conflicts start where information lacks.
> > http://basconotw.mvps.org/
> >
> > Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
> > How to ask a question: http://support.microsoft.com/kb/555375
> >
> >
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks to everyone for their suggestions.

Regret Canon has not responded as yet.

I asked Microsoft if they had heard of this file in case it was a virus.
Having checked a number of things on my pc, their conclusion is that it is
not a Trojanhorse nor a virus.

flusters
"flusters" <flusters@go4.it> wrote in message
news:udOhqRqnFHA.2916@TK2MSFTNGP14.phx.gbl...
> Thanks to all and particularly PA Bear - I hope that he is right. Maybe
> there is some light at the end of the tunnel.
>
> An update. I have the similar file on 2 only out of 3 computers. Those two
> computers are both linked to one printer - a Canon SmartBase MPC 200. Both
> also have a software program which updates an automobile GPS Radar
> spotting/tracking device. I have emailed both Canon and the GPS Device
> corps.
>
> Canon has not yet replied. The GPS Radar people say that it is definitely
> not their file.
>
> I would like to believe that there is an innocent explanation.
>
> Will advise once Canon reply.
>
> Flusters
> "PA Bear" <PABearMVP@gmail.com> wrote in message
> news 9m0m8hnFHA.2860@TK2MSFTNGP15.phx.gbl...
> > > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe.
Does
> > > this make a difference?
> >
> > Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or a
> GPS
> > utility.
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE/OE) & Security
> >
> >
> > flusters wrote:
> > > Thanks Hugh!
> > >
> > > Three points before I panic:-
> > >
> > > 1. I have checked the Symantec page and read it carefully, bearing in
> > > mind I am a novice. I have checked my registry and do not have any of
> > > those specific values or keys mentioned as being added by
Trojan.Progent
> > > So, I cannot take the steps to remove them because they are not there
in
> > > the first place.
> > > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe.
Does
> > > this make a difference?
> > > 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> > > SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
> PCBugDoctor,
> > > AVG7, Zone Alarms plus Router Security. I have not had any report of
any
> > > Trojan Horse.
> > >
> > > I am sorry to ask but do you feel certain that we are talking about
the
> > > same file? Could it not be an innocent file related to another
> > > application?
> > >
> > > If it is a Trojan Horse, how can I get rid of it as it has not changed
> the
> > > registry as detailed by Symantec?
> > >
> > > Thanks
> > >
> > > Flusters
> > > "Hugh Candlin" <No@MeansNo.Com> wrote in message
> > > news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> > > >
> > > > "flusters" <flusters@go4.it> wrote in message
> > > > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > > > I have noticed in my startup file, one file called mps.exe. The
full
> > > > > path is c:\windows\system\mps.exe.
> > > > >
> > > > > For my education, could any one tell me what this is and does? Do
I
> > > > > need it?
> > > >
> > > > Trojan.Progent is a Trojan Horse that attempts to steal
> > > > sensitive information and send it to the creator of the Trojan.
> > > >
> > > >
> > >
>
http://securityresponse.symantec.com/avcenter/venc/data...
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

An update.

Someone has been very kind and found that 44 files were created/modified at
10.00.36 on 11 Sept 2002. They all appear to relate to the Canon SmartBase
MPC200 Printer/Scanner installation as follows.

C:\Program Files Qty 19
C:\Windows\System\* Qty 18
C:\Windows\Twain_32\MPC200 Qty 7

The C:\Windows\System\Mps.exe file is one of the 18 shown under this exact
date and time - so I am hopeful that Canon will confirm this - eventually.

Thanks to everyone and in particular PABear.

Flusters
"flusters" <flusters@go4.it> wrote in message
news:udzGwU3nFHA.3996@TK2MSFTNGP12.phx.gbl...
> Thanks to everyone for their suggestions.
>
> Regret Canon has not responded as yet.
>
> I asked Microsoft if they had heard of this file in case it was a virus.
> Having checked a number of things on my pc, their conclusion is that it is
> not a Trojanhorse nor a virus.
>
> flusters
> "flusters" <flusters@go4.it> wrote in message
> news:udOhqRqnFHA.2916@TK2MSFTNGP14.phx.gbl...
> > Thanks to all and particularly PA Bear - I hope that he is right. Maybe
> > there is some light at the end of the tunnel.
> >
> > An update. I have the similar file on 2 only out of 3 computers. Those
two
> > computers are both linked to one printer - a Canon SmartBase MPC 200.
Both
> > also have a software program which updates an automobile GPS Radar
> > spotting/tracking device. I have emailed both Canon and the GPS Device
> > corps.
> >
> > Canon has not yet replied. The GPS Radar people say that it is
definitely
> > not their file.
> >
> > I would like to believe that there is an innocent explanation.
> >
> > Will advise once Canon reply.
> >
> > Flusters
> > "PA Bear" <PABearMVP@gmail.com> wrote in message
> > news 9m0m8hnFHA.2860@TK2MSFTNGP15.phx.gbl...
> > > > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe.
> Does
> > > > this make a difference?
> > >
> > > Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer or
a
> > GPS
> > > utility.
> > > --
> > > ~Robear Dyer (PA Bear)
> > > MS MVP-Windows (IE/OE) & Security
> > >
> > >
> > > flusters wrote:
> > > > Thanks Hugh!
> > > >
> > > > Three points before I panic:-
> > > >
> > > > 1. I have checked the Symantec page and read it carefully, bearing
in
> > > > mind I am a novice. I have checked my registry and do not have any
of
> > > > those specific values or keys mentioned as being added by
> Trojan.Progent
> > > > So, I cannot take the steps to remove them because they are not
there
> in
> > > > the first place.
> > > > 2. My file is c:\windows\system\mps.exe and not c:\windows\mps.exe.
> Does
> > > > this make a difference?
> > > > 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> > > > SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
> > PCBugDoctor,
> > > > AVG7, Zone Alarms plus Router Security. I have not had any report of
> any
> > > > Trojan Horse.
> > > >
> > > > I am sorry to ask but do you feel certain that we are talking about
> the
> > > > same file? Could it not be an innocent file related to another
> > > > application?
> > > >
> > > > If it is a Trojan Horse, how can I get rid of it as it has not
changed
> > the
> > > > registry as detailed by Symantec?
> > > >
> > > > Thanks
> > > >
> > > > Flusters
> > > > "Hugh Candlin" <No@MeansNo.Com> wrote in message
> > > > news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> > > > >
> > > > > "flusters" <flusters@go4.it> wrote in message
> > > > > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > > > > I have noticed in my startup file, one file called mps.exe. The
> full
> > > > > > path is c:\windows\system\mps.exe.
> > > > > >
> > > > > > For my education, could any one tell me what this is and does?
Do
> I
> > > > > > need it?
> > > > >
> > > > > Trojan.Progent is a Trojan Horse that attempts to steal
> > > > > sensitive information and send it to the creator of the Trojan.
> > > > >
> > > > >
> > > >
> >
>
http://securityresponse.symantec.com/avcenter/venc/data...
> > >
> >
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

<wink> You're welcome & thanks for your persistence and posting back.
--
~PA Bear

flusters wrote:
> An update.
>
> Someone has been very kind and found that 44 files were created/modified
> at
> 10.00.36 on 11 Sept 2002. They all appear to relate to the Canon SmartBase
> MPC200 Printer/Scanner installation as follows.
>
> C:\Program Files Qty 19
> C:\Windows\System\* Qty 18
> C:\Windows\Twain_32\MPC200 Qty 7
>
> The C:\Windows\System\Mps.exe file is one of the 18 shown under this exact
> date and time - so I am hopeful that Canon will confirm this - eventually.
>
> Thanks to everyone and in particular PABear.
>
> Flusters
> "flusters" <flusters@go4.it> wrote in message
> news:udzGwU3nFHA.3996@TK2MSFTNGP12.phx.gbl...
> > Thanks to everyone for their suggestions.
> >
> > Regret Canon has not responded as yet.
> >
> > I asked Microsoft if they had heard of this file in case it was a virus.
> > Having checked a number of things on my pc, their conclusion is that it
> > is not a Trojanhorse nor a virus.
> >
> > flusters
> > "flusters" <flusters@go4.it> wrote in message
> > news:udOhqRqnFHA.2916@TK2MSFTNGP14.phx.gbl...
> > > Thanks to all and particularly PA Bear - I hope that he is right.
> > > Maybe there is some light at the end of the tunnel.
> > >
> > > An update. I have the similar file on 2 only out of 3 computers.
> > > Those two computers are both linked to one printer - a Canon
> > > SmartBase MPC 200. Both also have a software program which updates an
> > > automobile GPS Radar spotting/tracking device. I have emailed both
> > > Canon and the GPS Device corps.
> > >
> > > Canon has not yet replied. The GPS Radar people say that it is
> > > definitely not their file.
> > >
> > > I would like to believe that there is an innocent explanation.
> > >
> > > Will advise once Canon reply.
> > >
> > > Flusters
> > > "PA Bear" <PABearMVP@gmail.com> wrote in message
> > > news 9m0m8hnFHA.2860@TK2MSFTNGP15.phx.gbl...
> > > > > 2. My file is c:\windows\system\mps.exe and not
> > > > > c:\windows\mps.exe. Does this make a difference?
> > > >
> > > > Yes. MPS.EXE may be associated with a Canon MultiPass F20 printer
> > > > or a GPS utility.
> > > > --
> > > > ~Robear Dyer (PA Bear)
> > > > MS MVP-Windows (IE/OE) & Security
> > > >
> > > >
> > > > flusters wrote:
> > > > > Thanks Hugh!
> > > > >
> > > > > Three points before I panic:-
> > > > >
> > > > > 1. I have checked the Symantec page and read it carefully,
> > > > > bearing in mind I am a novice. I have checked my registry and do
> > > > > not have any of those specific values or keys mentioned as being
> > > > > added by Trojan.Progent So, I cannot take the steps to remove
> > > > > them because they are not there in the first place.
> > > > > 2. My file is c:\windows\system\mps.exe and not
> > > > > c:\windows\mps.exe. Does this make a difference?
> > > > > 3. I run ( and keep updated) a minimum of 3 times weekly AdAware,
> > > > > SpyBlaster, CCleaner, CWShredder, Spybot Search and Destroy,
> > > > > PCBugDoctor, AVG7, Zone Alarms plus Router Security. I have not
> > > > > had any report of any Trojan Horse.
> > > > >
> > > > > I am sorry to ask but do you feel certain that we are talking
> > > > > about the same file? Could it not be an innocent file related to
> > > > > another application?
> > > > >
> > > > > If it is a Trojan Horse, how can I get rid of it as it has not
> > > > > changed the registry as detailed by Symantec?
> > > > >
> > > > > Thanks
> > > > >
> > > > > Flusters
> > > > > "Hugh Candlin" <No@MeansNo.Com> wrote in message
> > > > > news:uC4dyFdnFHA.2452@TK2MSFTNGP10.phx.gbl...
> > > > > >
> > > > > > "flusters" <flusters@go4.it> wrote in message
> > > > > > news nogK9cnFHA.708@TK2MSFTNGP09.phx.gbl...
> > > > > > > I have noticed in my startup file, one file called mps.exe.
> > > > > > > The full path is c:\windows\system\mps.exe.
> > > > > > >
> > > > > > > For my education, could any one tell me what this is and
> > > > > > > does? Do I need it?
> > > > > >
> > > > > > Trojan.Progent is a Trojan Horse that attempts to steal
> > > > > > sensitive information and send it to the creator of the Trojan.
> > > > > >
> > > > > >
> > > > >
> > >
> >
> http://securityresponse.symantec.com/avcenter/venc/data...

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Canon has now agreed that the file (mps.exe) is one of their installation
files.

I suspect the long delay in their reply was caused by Canon's realisation
that third-parties are using a similar named file.

Thanks to everyone

Flusters

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%23ck$$QfnFHA.3656@TK2MSFTNGP09.phx.gbl...
> From: "flusters" <flusters@go4.it>
>
> | I have noticed in my startup file, one file called mps.exe. The full
path is
> | c:\windows\system\mps.exe.
> |
> | For my education, could any one tell me what this is and does? Do I need
it?
> |
> | Thanks
> |
> | Flusters
> |
>
> It may be a Trojan Password stealer.
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script
Interpreter {
> http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
scripts, one Link
> (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and
WGET.EXE. It will
> simplify the process of using; Sophos, Trend and McAfee Anti Virus
Command Line Scanners to
> remove
> viruses and various other malware.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
Normal Mode. This
> way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files
or you can
> download the files and perform a scan in Normal Mode. Once you have
downloaded the files
> needed for each scanner you want to use, you should reboot the PC into
Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want
to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
> file.
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "flusters" <flusters@go4.it>

| Canon has now agreed that the file (mps.exe) is one of their installation
| files.
|
| I suspect the long delay in their reply was caused by Canon's realisation
| that third-parties are using a similar named file.
|
| Thanks to everyone
|
| Flusters

Thank you for updating this thread !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

It is not a normal file,it is must be a virus/worm/spyware/trojan.And I
am sure you don't need it at all.Security Expert can help you make a
judgement of a suspicious process is a backdoor or a virus.
You can make judgement of a suspicious process easily by this way:
1) Run Security Expert,click Security Tools->Process Manage
2) Choose "Hide windows' process" to help you to remove legitimate
process of system
3) Notice suspicious process with special color marked by Security
Expert
4) Notice whole route of the process is not in "program files"
5) If the process doesn't have information of companyname,the process
possible is a backdoor or a worm.
And you also can use Security Expert to kill the process.
Go to http://securityexpert.cnns.net/process01.htm to know more.