Startup:MPCT is??

[Guest]

In msconfig startup, an item called cleaned, with command cleaned (no exe),
is in HKLM...run. In HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion\Run it
appears as: MPCT with data:cleaned. Does anyone know what this is and whether
I should ignore it. No one seems to know MPCT. I saw it in someone's hijack
this report, but no comments were made. Searching startup lists were
fruitless.

Thanks so much to the person(s) who can define this and advise.

 

[cquirke (MVP Win9x)]

In msconfig startup, an item called cleaned, with command cleaned (no exe),
is in HKLM...run. In HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion\Run it
appears as: MPCT with data:cleaned.

Quote back that *exact* line, please. If that "data:cleaned" is a
file name, then the syntax suggests an ADS infector.

You can think of ADS (Alternate Data Streams) as hidden co-files that
are a feature of NTFS. Malware running from there is hard to find, as
few OSs other than NT can "see" there, and will appear as the parent
file when viewed as a running Task.

Antivirus and anti-malware scanners aren't great at ADS either - plus,
because the ADS content is left behind when copying off NTFS, it's
harder to submit as a sample to av vendors or on-line scanner sites.

Let us know what happens next, hmm?

--------------- ----- ---- --- -- - - -

Tech Support: The guys who follow the
'Parade of New Products' with a shovel.