MPC Invasion - how to kill it

[Gary Labowitz]

I have my first virus!! After many years I got MPC all over wife's laptop. Was running Norton provided by Comcast, but started getting ads, block screen, etc. I went through uninstalls as best I could and got rid of a number of "programs" listed in system. Others I disabled by various means, mostly changing exe's found in folders that were used by bad actors to "exex" so they won't load or run. I figure I can always put them back if I was wrong about them.
Machine is now back to basic running ... but MPC Cleaner (?) and and Ad version are still there and won't go away.
Symptoms are: Browsers won't load saying the Built In Administrator can't load them, "try another user account." If I get a phony message that "mynightqueen.com" cannot be found it leaves a window open that a URL can be typed in and it runs okay from then on.
IE 11 seems to load, but eventually it loads a "blocking" screen with an ad (for purchase of Flash Player Pro) which doesn't respond to any clicks and won't close in any normal way (Alt-F4, etc.) It is a nuisance.
Trying Edge led to the "can't open Built-in Administer account" message and attempt to go to g.live.com/Smeen _us/221 which "can't beactivated by the Built-in Administrator." What the heck is this?
I switched to Safe Mode with Networking but couldn't get networks to ... well ... work. I couldn't create new network, and my two networks (one on router, one on wireless router) never showed up. o network activity cold be run.
My wife's e-mail is running (Live Mail, local only) and she can get to Facebook. This is about all she uses, but when interference occurs she doesn't know what to do. She wants to use Skype, but I am not sure if it is working or not, not using it myself and not having tested it. The sound check from Skype works, so it is getting through to the network.

How can I eliminate this MPC stuff? I really don't want to get involved with the registry, but will if that's the only way. I tried to install Bitdefender on laptop, but got message that it isn't supported in Win10. I think this is bogus. I don't know what virus killers are real and which are just other viruses, so advice is needed here. Norton scans and says no problems. I have found reference to Spy Killer, and I would buy anything that lets me try it and gets rid of MCP so we can get back to "normal."
Since Bitdefender hasn't responded to my inquiries yet, and Norton doesn't do the job, I'm open to anything. I've used Avast, Defender, and others in the past (AdAware, CCleaner, etc.) but don't have any of them install now. I wish I could get Bitdefender on the laptop; I've used it for a couple of years on the desktop and am happy with it.
Oh, her iPhone can get all her emails, so she is covered there, but when she uses the laptop she gets all the messages again and has to delete them. Another nuisance. What motivates these nuts to create nasty viruses? Vain glory?

Thanks Trouble, you've been of help before, and I hope you have some ideas on this.
Gary

 

[Tim Locke]

I believe Malwarebytes will do the trick. Get the free trial and try it.

 

[Regedit32]

Gary,

I assume you receive Windows Updates.

Have you considered running the Microsoft Windows Malicious Software Removal Tool that is sent every month during the Windows Update?

It is designed to remove any active malicious software. Antivirus programs on the other hand remove inactive infections.

You appear to be in the Active infection stage so its worth a shot:

• Press WinKey + R to open your run dialog
• Type MRT
• Click OK
• When prompted click yes
• Click Next
• Select Full Scan
• Click Next

Regards,

Regedit32

 

[ram1220]

Download the free version of Malwarebytes and run it. Norton may not pick up malware and only viruses. There is a difference. Malwarebytes should help you.

 

[Tony Norton]

I have my first virus!! After many years I got MPC all over wife's laptop. Was running Norton provided by Comcast, but started getting ads, block screen, etc. I went through uninstalls as best I could and got rid of a number of "programs" listed in system. Others I disabled by various means, mostly changing exe's found in folders that were used by bad actors to "exex" so they won't load or run. I figure I can always put them back if I was wrong about them.
Machine is now back to basic running ... but MPC Cleaner (?) and and Ad version are still there and won't go away.
Thanks Trouble, you've been of help before, and I hope you have some ideas on this.
Gary

Hi Gary,

I've had the same problem with MPC, can't delete it, can't move it, it refuses to recognize that I am an administrator. Have tried Avast shredder, Malwarebytes, Eraser & File Shredder with no luck. Also ran MRT as recommended by "Regedit32".
5 hours and 2 million files later it reported no infections. I did manage to remove most of the references to MPC from the registry, but not all, and also to delete some of the files in the MPC folder, also uninstalled it via Control Panel, but as for removing all record of it - not a hope in hell! Even created a new partition, tried moving MPC to it, so I could format that partition, but it still left copies on my C: drive.

I wish that someone could come up with an answer.

Tony N

 

[davehc]

Try Spy hunter
http://www.enigmasoftware.com/products/spyhunter/
It allegedly has a specific function to remove MPC

 

[Tony Norton]

Try Spy hunter
http://www.enigmasoftware.com/products/spyhunter/
It allegedly has a specific function to remove MPC

Have just tried this Dave, and running the installation program in Win10, as well as Win7 and XP compatibility I get the following: -

in all three cases. I must say though, that I tried the "Download Free Scanner" option. Reluctant to buy the full package until I know for certain that it works.

 

[davehc]

Just did a bit of googling for you. Looks like spyhunter can be "#iffy". It is just as hard to uninstall as MPC!
square one on this thread
It is seen by Defender and one or two others, as malware, so, back to square one on this thread - bummer.

 

[Trouble]

Give it a thorough cleaning and see what the end results might be.....

These are the programs I use to generally delouse a computer with virus and or malware issues.
ADWcleaner from here http://www.bleepingcomputer.com/download/adwcleaner/dl/125/
JRT (Junkware Removal Tool) from here http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/
RogueKiller from here http://www.bleepingcomputer.com/download/roguekiller/
Norton Power Eraser from here https://security.symantec.com/nbrt/npe.aspx
Malwarebytes from here http://www.malwarebytes.org/mwb-download/confirm/
SuperAntiSpyware from here http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
Ccleaner from here http://www.piriform.com/ccleaner/download/standard
TFC.exe (Temporary Files Cleaner) from here http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/
ESET Online Scanner from here http://www.eset.com/us/online-scanner/

Eset online scanner is a bit different than the others in that you need to either use
IE or download and run their smart installer if you're using another browser. Then tick
the radio button that says "Enable detection of potentiall unwanted application"
Then click the link that says "Advanced settings", then check all the boxes except the
one that mentions "Use custom proxy settings", unless of course you're using a Proxy
Server. Then just click "Start", it will do a thorough system scan so it takes a long
time.

I don't check the links above everyday, so if you have any problem with any one of them then just Google for the program name but use the site names that I have recommended since I'm relatively certain they are free of extraneous garbage.

I usually start with Ccleaner followed with TFC.....
Then JRT followed by ADWcleaner, then the rest saving Eset Offline Scanner till last to bat cleanup.

 

[Regedit32]

It seems the problem here is the assumption you are dealing with a Virus.

Technically, this MPC (More Powerful Cleaner) is better described as an 'Misleading Program'. That is, it posts alerts and/or popup advertising to make you believe your Registry is corrupted or there is an infection that needs dealing with; when in reality there is no threat at all.

This type of application will come via two methods:

1. Bundled with a download from a third party website so as to install when you install something else you downloaded.
2. User found the actual website promoting the program and voluntarily chose to download and install it.

Given the two people here posting about their issues with the Program, it seems there are a number of things that will need to be repaired to resolve the issue:

• POPUP ADDS suggest an Add-on or extension has been introduced to the Browser they are using. That means the User will need to go into their browser settings and remove this Add-on / extension, and most likely need to reset their browser to default settings to ensure Proxy settings are correct. Also, they may need to update their homepage settings to ensure the browser opens to the normal site they prefer.
• Windows host file may well be affected by this intrusion. Microsoft in the past had a Fix-it tool which would set the Windows Host file to default settings. I'd recommend visiting Microsoft's website and getting that tool, or if not available for Windows 10, seeking advice on how to manually edit this file.
• Registry issues - clearly this program will have introduced new entries into the Registry. One can of course edit this manually, but before doing this the User needs to clearly identify the problem program(s). It seems to me the User is not dealing with just one Misleading Program, but rather a multitude of programs. Through the Programs and Features, or all APPS display the User will need to review all installed applications and decide whether they are the Misleading Program or suspicious, or simply not known. These ideally will be uninstalled, but before doing this you need to go to the Programs install location and check there what files are present ( in particular .sys and .dll files, and also check whether there is an uninstall.exe ). Note down what files are present as this will help in cleaning the Registry later. Some of the likely affected folders in the registry will be Run and RunOnce, located at:
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• However there will no doubt be other keys affected and also added.
• The StartUp service for windows will more than likely be affected so that too needs to be checked to make sure none of these programs are able to restart on a reboot of computer, or that some other rogue tool is not loading that will silently download and re-install these programs.
• On earlier Windows editions a common need was to disable System Restore, as a removed threat could occasionally be reintroduced when System Restore was affected. I've not got round to checking this feature in Windows 10, but it may be worth exploring that too.

Some things that may help those Googling or Binging this issue would be if the two Users with the issue could post any specific information they know of their issue, such as:

• What Registry keys did they edit
• What specific value did the registry have (i.e. full name of Uninstaller, or other file pointed to in the registry)
• What is the full name of the Program believed to be causing the issue?
• If downloaded voluntarily, where did you download it from?
• What websites are you being redirected to?
• What information is displaying in the Pop-ups? e.g. a website address, a specific alert message?
• Re the MPC and Ad Version mentioned is there a specific release value? e.g. MPC_3.0.1.1.14

Regarding the claims SpyHunter will remove this issue.

• Theoretically it may discover some .PUP issues in registry related to MPC, however if you want them removed or edited you will need to purchase the Program as the free download is not capable of removing or editing the Registry.
• Personally I'd not use this program. It seems rather convenient any website discussing MPC promising a fix all point to the one Registry Utility (i.e. SpyHunter). There are numerous free tools for doing what SpyHunter claims to be able to do.

One of the Users mentioned an issue with running Safe mode with Networking. It would help if they go into more detail as to what that issue was precisely.

One of the Users also mentioned an issue with Administrative Privileges. Some more details on that would also be helpful. i.e. What were they doing when issue arose, and what alert did they get. We need to verify is this an actual Windows issue, or is this just MPC posting a false message.

I'm happy to post specific instructions on manual correction of the above points listed, but first I want to see some more information from those affected by MPC as there is no point filling this thread with suggestions that may not be required, or ultimately will not work.

The reality is you may simply need to use the built in RESET PC options to repair your system, then make sure you have good security software installed and updated.


Regedit32

 

[Tony Norton]

It seems the problem here is the assumption you are dealing with a Virus.

Technically, this MPC (More Powerful Cleaner) is better described as an 'Misleading Program'. That is, it posts alerts and/or popup advertising to make you believe your Registry is corrupted or there is an infection that needs dealing with; when in reality there is no threat at all.

Regedit32

Update: -

None of the programs suggested seem to be able to touch MPC. I did uninstall it via control panel but, as previously stated, have been unable to remove the MPC files.

Good news: -

I have found a program that is capable of removing the individual files but doesn't seem to be able to remove the empty folders after removal of all files therein. The program I used with partial success is: -

"IObit unlocker". (Note that is "India Oscar" not "one zero")

 

[luckyLisa]

Several days ago I also encountered MPC Cleaner on my PC and I didn't know how it got installed. I tried to uninstall it from Control Panel but nothing happened. Then I googled the web and found a post which shows how to uninstall it did the trick:
Click on Start button in the left bottom corner of the screen and click on Settings in the menu.
Click on System in the Settings screen.
Click on Apps &Features on the left side and all the installed programs will appear on the right side.
Select MPC Cleaner and click on Uninstall button.
Click on Uninstall button in the pop-up to confirm it.
When the following pop-up shows up, select Uninstall.

Continue to choose Uninstall.

Select reasons why you want to remove and click on Uninstall.

Perhaps I chose the Quick uninstall option during the software uninstallation process and this is why the uninstall failed. Anyway, the steps above work. My browser homepage also got changed to a site related to MPC Cleaner and I reset it myself. Hope this helps.

 

[Sarmad]

After years of efforts i was finally able to free myself from this curse that had tormented me for so long...Here' What i Did ..
Download IObit Unlocker and then install it
Unlock the MPC program files folder ..just right click on it..and delete it..after the MPC core protect service is gone ... It is vulnerable now .. just do a quick scan with an antivirus of the mpc folder in my case i used avast. . . . If it still doesnt work then first use advanced uninstaller pro and delete all programs flagged with a cross it may be in or use adwcleaner ..and after that repeat everything exactly in the same way i explained from the beginning... Hope this works for you too