Help! Trojan problem, phase 2

In a thread posted about a month ago, I asked about a trojan my system picked up at some point- the bymer.scanner backdoor.

This weekend it corrupted some system files, and I used the system recovery utility to reload the corrupt files. I had to do a reboot, and now my system hangs on an error in “mprexe”.

Do I need to reload the operating system, or is there a workaround for this? If I need to reload the op system (Win98), how do I do it?

Reloading the OS might be a last resort depending on how your system does it. Mine requires you to reformat the hard drive and reload the original shipped configuration.

You might try holding the CONTROL key as you’re booting up, which should give you a menu to continue. Select Safe Mode. That boots into Windows without loading a bunch of support stuff. You have limited capabilities but also fewer things to go wrong. That might allow you to boot far enough to further diagnose and fix the problem, although I have no wisdom as to what that problem might be.

Windows won’t enter either mode. I suspect something has changed or corrupted the autoexec.bat file, because config.sys will not load. The system just puts a my background pic on the desktop, then an error message- Mprexe has performed an illegal operation- and the cursor is active, but the system is hung.

I have a startup disk from another computer, it allows me access to DOS. What are the steps i should be taking from here?

I had some problem with MPREXE in the past but, for the life of me, I cannot remember what it was or how I solved it. In any case, when I have any problem, or just to see what each single task is supposed to be doing, I always do a google. Search google for MPREXE and you will get plenty of info.

Microsoft Knowledge Base Article - Q178084

SYMPTOMSWhen you log on to Windows, or after you install Windows, you may receive the following error message, and your computer may stop responding (hang): MPREXE not responding

CAUSE: This behavior can occur for any of the following reasons:
Your password list (.pwl) file is damaged.
A service or program that loads during the startup process conflicts with another service or program.
You are using user profiles.
There is a hardware conflict on your computer.
A hardware driver on your computer is missing or damaged.
If profiles are enabled, Windows may not be able to contact the primary domain controller’s Netlogon share when looking for a Config.pol file. (Windows checks for a Config.pol file even if policies are not used.)
Your primary domain controller (PDC) is not local to your Windows 95/Windows 98 clients.
A single user profile is corrupted.
Your network adapter is not correctly seated.
You are using a reserved word for your user name.

config.sys is run before autoexec.bat so the later does not affect the former. Go into MS-DOS mode and check both of those for what is running. Also check win.ini and system.ini for “run=” and “load=” lines to suspicious progs.

To reload the OS, just run the CD setup program as if it was never loaded in the first place.