Perhaps the best way is to boot to DOS mode (this releases the Windows
files), and BACKUP the infected files somewhere (they'll still be
infected, but they won't load), and then run a DOS level anti-virus
utility. Norton allows you to create Emergency Disks that will bot to
DOS, and run the AV against all files on the drive, using the latest
.SIG file (I'm sure that all of them do, I am just MOST familiar with
Norton). Read the manual for instructions on how to do this.
> -----Original Message-----
> From: Snow, Corey [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, January 30, 2002 12:51 PM
> To: 'Kernel32.dll & Mprexe.exe HOWTO CLEAN?';
> [EMAIL PROTECTED]
> Subject: RE: Kernel32.dll & Mprexe.exe HOWTO CLEAN?
>
>
> You probably can't update (repair) KERNEL32.DLL or MPREXE.EXE
> (I don't know what the second one is, but it seems to have
> something to do with Distributed File System) because they're
> in use by the operating system. You can extract the originals
> from your Windows 98 CD and replace them. This is not
> guaranteed to remove any virus infection. Also, if the
> version(s) on your CD is out of date for your current
> installation (because of updates, etc), your operating system
> may not start at all. So proceed at your own risk!
>
> See the following MS KB article at support.microsoft.com for
> some information that may be of use:
>
> Q129605
>
> You can extract the files from the original media, put them
> on a floppy disk and copy them over the infected ones in DOS
> mode by booting to a Win98 DOS prompt.
>
> Once again, this is not guaranteed to work, and could make
> the problem worse! KERNEL32.DLL in particular is a core
> operating system file- if it isn't the correct version or is
> damaged in some way, your Windows installation will be unable
> to start in anything but DOS mode.
>
> Corey Snow
>
>
> > -----Original Message-----
> > From: Kernel32.dll & Mprexe.exe HOWTO CLEAN?
> > [mailto:[EMAIL PROTECTED]]
> > Sent: Wednesday, January 30, 2002 5:03 PM
> > To: [EMAIL PROTECTED]
> > Subject: Kernel32.dll & Mprexe.exe HOWTO CLEAN?
> >
> >
> > Hello security listers :
> >
> > I'm asking permission to post my message asking answer for
> > those have an idea to how be able to clean my Kernel32.dll
> > and Mrexe.exe where infected by a virii, it happened after
> > when I was infected by the PEKRIZ_4050 as defined by PC-LLIN
> > 2000. It infects all my *.EXE's and hopefully all were
> > Cleaned, but two files [ Kernel32.dll & Mprexe.exe ] were not
> > able to clean by my antivirus although i updated my AVP
> > software Virus pattern files. Thesame with I used my AVP as
> > infected and within itself it could not be cleaned. I did to
> > visit the antivirus.com where TREND Micro have an updated
> > virii pattern and I consult this virus by searching, the
> > results was just a description of the virii. I attempt to
> > scan my PC to their Housecall Remote Scan but I did not
> > access the page for it, although my bandwith ranging in a
> > higher dial-up speed. I need badly to how my Problem should
> > be resolve. Another possible solution I tried is to Download
> > PC-Cillin DOS bootup disk ( 6 diskettes :( just t!
> > o clean my PC in a DOS mode, badly the PC-CILLIN.EXE to scan
> > my PC dont work, in behalf that my disk works ok. This virii
> > infects all my *.EXE's when I'm trying to load windows for
> > its a memory resident (TSR). Do I need to reset my memory? Do
> > I need to re-enstall my Windows 98?
> >
> > What should I do? Anyone can Help will be appreciated =).
> >
> > [EMAIL PROTECTED]
> >
> >
> >
> >
> > __________________________________
> > www.edsamail.com
> >
>
> #########################################################
> The information contained in this e-mail and subsequent
> attachments may be privileged,
> confidential and protected from disclosure. This
> transmission is intended for the sole
> use of the individual and entity to whom it is addressed. If
> you are not the intended
> recipient, any dissemination, distribution or copying is
> strictly prohibited. If you
> think that you have received this message in error, please
> e-mail the sender at the above
> e-mail address.
> #########################################################
>
