prpen.exe

  • Thread starter Thread starter jim
  • Start date Start date
J

jim

I am having trouble with a adware virus that keeps
reinstalling components I have tried numerous programs to
get rid of it. It reinstalls program files\etea\rpen.exe
and no matter what I do with the registry or spyware
programs I can't get rid of it. Any suggestions?
 
Have you tried running MSAS in SAFE mode? Notice the file involved is
rpen.exe not prpen.exe

If installed directly from purityscan.com or virtuescope.com there may be a
corresponding entry in the Control Panel's Add/Remove Software list which
can be used to remove the software.

If neither of those work, there are more complex fixes available. Let us
know how you make out.
 
This is Purityscan related and can be a pain to remove,
Last time I helped someone with this all the main
scanners were missing the system32 part and it would
return rpen.exe on reboot, it was saved into Program
Files and into system32 but the folder in system32 is set
as hidden so we had to enable hidden files and operating
system files to find it.

Here was the entries from the user's Hijack This log :

O4 - HKCU\..\Run: [Usrr] C:\Program Files\etea\rpen.exe
O4 - HKCU\..\Run: [Ckusrau] C:\WINDOWS\system32\??
sks\services.exe

C:\Program Files\etea\rpen.exe could be removed without
problems but would regenerate everytime the user
restarted the system.

C:\WINDOWS\system32\??sks\services.exe was in a folder
called "tasks" in system32 but the folder appeared to be
empty untill the user enabled hidden files and folder's
including operating system files then it became visable
and it was then possible to remove it (We can use Killbox
for that once we know the names of other files and
folders)

*Note services.exe is an essential Windows file if found
in these locations

"C:\WINDOWS\$NtServicePackUninstall$"
"C:\WINDOWS\system32"
"C:\WINDOWS\ServicePackFiles\i386"

But its not genuine if found in system32 in another
folder called Tasks,

First check your add/remove screen for any reference to
Purityscan or Clickspring

Go with Dave's suggestion of scanning in safe mode as it
may be able to remove this if it detects all the files,
If you need more help "Hijack This" would be a good
option to show if you have similar entries on your system
as there is afew variants of this that use different
filenames in various locations,

Download Hijack This :

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Save to desktop or c:drive, extract and run Hijack This
and choose to do a system scan and save the logfile, when
its finished scanning it will open the results in
notepad, copy & paste that to my email address and I will
check the log out and reply to you. (Most of what Hijack
This lists will be Harmless or even Essential files so
dont fix anything at this stage)

Andy
 
Back
Top