E47250 Incorrect MPEG Data Format

Becoming more common, but information is sparce. URLs addressing the problem include:

http://ktp.e-isa.com/av/Viruses/Gpix.htm

The information is pretty much identical to:

http://hq.mcafeeasap.com/dispTrojan.asp?virus_k=100247

http://www.z-virus.com/Eng-virus-HTM/gpix.htm

http://vil.nai.com/vil/content/Print100247.htm

A fix is available at the URL below. Save it to your desktop and then run it (thanks to Doug Knox):

http://www.dougknox.com/utility/scripts/9x_gpixfix.vbs

If you cannot start your machine, even in safe mode, do the following (again from Doug Knox) to remove Gpix:

Doug has created two files, called novirus.reg and novirus.bat that can be used to clean a machine from DOS.

A predone BAT and REG file can be found at:
http://www.dougknox.com/utility/scripts/gpixfix_dos.zip

Instructions for use are at:
http://www.dougknox.com/utility/scripts_desc/9x_gpixfix.htm

If you have a file called explorer.exe at c:\explorer.exe, rename it. There have been examples of that file being implicated. Important note. Do not touch the file with the same name at c:\windows\explorer.exe. That file is part of Windows.

The gpix problem *might* be related to martfinder.com but more evidence is required before a conclusion can be reached. Its purely guilt by association at the moment. I would appreciate an email from anybody who has shellexpl.exe on their system. I would like to know if they, also, have hndldt.ini or winhndl.ini on their systems, and if their search engine has been hijacked by martfinder.com.

Note: some people have shellexpl.exe, some have shellexpi.exe. Please keep feedback coming in (thanks to all who have emailed). Doug is updating the script to catch new/unsolved problems as often as he can :o)