Remove %PROGRAM FILES%\MEIRENLI\MRL.EXE malware
%PROGRAM FILES%\MEIRENLI\MRL.EXE Malware Removal Guide
Manual removal instructions:
Antivirus Report of %PROGRAM FILES%\MEIRENLI\MRL.EXE:
%program files%\meirenli\mrl.exe
Full path on a computer: %PROGRAM FILES%\MEIRENLI\MRL.EXE
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\mrl.exe
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MRL.EXE\: "%PROGRAM FILES%\MEIRENLI\MRL.EXE"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MRL.EXE\PATH: "%PROGRAM FILES%\MEIRENLI"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\RLBRUNBYWINDOWSSTART: ""%PROGRAM FILES%\MEIRENLI\MRL.EXE" RUNDATEBYSTARTAUTO"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e65177f1_0\: "{0.0.0.00000000}.{88060322-703b-4c55-90b4-e23ab1093bf1}|\Device\HarddiskVolume1\Program Files\meirenli\mrl.exe%b{00000000-0000-0000-0000-000000000000}"
HKLM\Software\Microsoft\DirectDraw\MostRecentApplication\Name: "mrl.exe"
Related Files:
%PROGRAM FILES%\MEIRENLI\DATA\USERNOTETEXT.XML
%PROGRAM FILES%\MEIRENLI\DATA\VIRUSSHARE_C022A3C77591619BA47DB6C2BB608487INDEX.HTML
%PROGRAM FILES%\MEIRENLI\MRL.EXE
%PROGRAM FILES%\MEIRENLI\ONLINE_C.HTML
%PROGRAM FILES%\MEIRENLI\POWER.EXE
The file MRL.EXE is malware related.
You must delete the file MRL.EXE immediately!
MRL.EXE is related to: W32.HfsAdware.1E9C, MRL.EXE.
Virustotal = 11/56
MD5 = 752DBDC3E27840623E74DDEB22FD2EEE
File Size: 3422312
File information:
OriginalFilename: mrl.exe
FileDescription: ???
FileVersion: 1, 2, 3, 0
LegalCopyright: (C) ???????
| %PROGRAM FILES%\MEIRENLI\MRL.EXE | Malware |
| %PROGRAM FILES%\MEIRENLI\MRL.EXE | Dangerous |
| %PROGRAM FILES%\MEIRENLI\MRL.EXE | High Risk |
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\mrl.exe
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MRL.EXE\: "%PROGRAM FILES%\MEIRENLI\MRL.EXE"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MRL.EXE\PATH: "%PROGRAM FILES%\MEIRENLI"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\RLBRUNBYWINDOWSSTART: ""%PROGRAM FILES%\MEIRENLI\MRL.EXE" RUNDATEBYSTARTAUTO"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e65177f1_0\: "{0.0.0.00000000}.{88060322-703b-4c55-90b4-e23ab1093bf1}|\Device\HarddiskVolume1\Program Files\meirenli\mrl.exe%b{00000000-0000-0000-0000-000000000000}"
HKLM\Software\Microsoft\DirectDraw\MostRecentApplication\Name: "mrl.exe"
Related Files:
%PROGRAM FILES%\MEIRENLI\DATA\USERNOTETEXT.XML
%PROGRAM FILES%\MEIRENLI\DATA\VIRUSSHARE_C022A3C77591619BA47DB6C2BB608487INDEX.HTML
%PROGRAM FILES%\MEIRENLI\MRL.EXE
%PROGRAM FILES%\MEIRENLI\ONLINE_C.HTML
%PROGRAM FILES%\MEIRENLI\POWER.EXE
The file MRL.EXE is malware related.
You must delete the file MRL.EXE immediately!
- Uninstall MRL.EXE using Windows uninstallation applet (use Add/Remove Programs or Uninstall Program or Apps & features).
- Open Task Manager and terminate "MRL.EXE" processes.
- Use Windows search to find and remove "MRL.EXE" files and folders.
- Run services.msc and disable a "MRL.EXE" Windows service.
- Execute taskschd.msc to get rid of "MRL.EXE" scheduled tasks.
- Open regedit.exe and delete MRL.EXE registry keys and values.
- Inspect the properties of your desktop and Start menu shortcuts for MRL.EXE presence and "http://" links.
- Open your browser and disable MRL.EXE plugins. Disable all unknown plugins. Reset the browser settings.
- Clean your Recycle bin and temporary files.
- Restart your computer and check results.
MRL.EXE is related to: W32.HfsAdware.1E9C, MRL.EXE.
Virustotal = 11/56
MD5 = 752DBDC3E27840623E74DDEB22FD2EEE
File Size: 3422312
File information:
OriginalFilename: mrl.exe
FileDescription: ???
FileVersion: 1, 2, 3, 0
LegalCopyright: (C) ???????
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.