Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

"xxx.exe is not a valid Win32 application"

Posted on 2005-01-16
24
Medium Priority
?
74,560 Views
Last Modified: 2012-05-05
I cannot open programs that I download from sites on the web.  I've tried to download  programs from the Cybersitter, Webroot, PCworld and Download.com sites in the past day, and I get the same message:  (xxx).exe is not a valid Win32 application. [ xxx ] is the name of the file I'm trying to open.

I am running XP with the most current version of McAfee.  I've run both Adaware and Spybot in the past day, so I'm pretty comfortable that my system is "clean."  

Can somebody help me with this one?

Thanks,
Bob
0
Comment
Question by:rjsteinm
  • 10
  • 7
  • 3
  • +3
24 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057390
Hello rjsteinm =)

If these are just the programs which you have downloaded from internet... then try deleting your temporary internet filesand history from IE options and then check if same issue still ??
0
 
LVL 41

Expert Comment

by:stevenlewis
ID: 13057395
this is usally caused by a corrupted file
as Shehar said, clear your temp files and then redownload and test
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057404
and just for making sure, you can run this online virus scan for 100% sureity that system is really clean :)
http://housecall.trendmicro.com/ 
And this is the new MS Antispwyare tool which you should try atleast once >> http://www.microsoft.com/athome/security/spyware/software/default.mspx

Post Back the results :)
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 20

Expert Comment

by:Debsyl99
ID: 13057418
Hi
Could be a corrupted file or in which case download again after deleting:
Could be related to a virus:
W32.Sonic.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.sonic.worm.html
Not a valid win32 application
http://www3.telus.net/dandemar/win32.htm
Games: Error Message: Not a Valid Win32 Application
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q315589
0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 13057427
Hi guys - you would really think I'd know by know to refresh the page before posting wouldn't you? - (Slaps self with kipper)
0
 
LVL 41

Expert Comment

by:stevenlewis
ID: 13057461
LOL. we all do it :-)
0
 

Author Comment

by:rjsteinm
ID: 13057543
SheharyaarSaahil, I'm in the midst of using the housecall virus scan you recommended, and it has found a virus called "TROJ_AGEND.JD.  Housecall says it is "non cleanable."  How can I get rid of it?
Bob
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057544
is it telling the file name which is infected with this trojan ??
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057548
if no then we are required to manually clean the system, do this please!
Download HijackThis from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe

Then Post that log at this site >> http://www.hijackthis.de
hit the Analyse button, scroll down to the bottom, hit the Save Analyse link, a new page will open, please post here the address of that page instead of the whole log..... we will check it out that where the corruption lies! :)
0
 

Author Comment

by:rjsteinm
ID: 13057555
I can't tell yet because it is buried about 6 directories deep, and the window for viewing is too small.  I'm assuming that after it is done running, I'll be able to view it.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057561
ok then finish it.... and if still you cannot see it, then use the hijackthis program as i mentioned above :)
0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 13057571
Hi
Many viruses are non-cleanable - ie the av program attempts to clean the virus from the file - when really what we need is the file containing the nasty virus code to be deleted. Be worried if the file can't be deleted - if it can then it should work ok :))
0
 

Author Comment

by:rjsteinm
ID: 13057573
OK.  Now I can see it.  Here's where it is:
c:\Documents and Settings\Rachel\ Local Settings\Temp\lCD2.tmp\WinadX.dll

Rachel is my wife; its in her portion of XP.

Bob
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057587
ok then start your system in safemode, login as Adminsitrator!
Then goto My Computer>Tools>Folder Options>View and turn on the feature of Show Hidden Files
Then goto C:\Documents and Settings\your username\Local Settings\Temp and delete all files present here
Then goto C:\Documents and Settings\your username\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Then goto C:\Windows\Temp and delete all files present here!

Now restart and boot in normal mode.... check if any progress? :)
0
 

Author Comment

by:rjsteinm
ID: 13057680
OK, the virus scan has FINALLY completed.

I found one more instance of the TROJAN.AGENT virus.  This time its in:

C:WINDOWS\Downloaded Program Files\WinadX.dll

HouseCall gives me a "delete" option.  Should I do this or follow your safemode advice above?

Should I do both?

Thanks,
Bob
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13057685
if its giving the delete option, then use it.... and if it will say that cannot delete blah blah, then you can manually delete it via safemode! :)
0
 

Author Comment

by:rjsteinm
ID: 13057760
RATS.  It still doesn't work.  Any more suggestions.
Bob
0
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 2000 total points
ID: 13057773
two suggestions!

use another browser to download some files and check if same error ??
create a new user account, and from there use IE to download some files... check if same error still ??
Post back :)
0
 

Author Comment

by:rjsteinm
ID: 13058458
SheharyaarSaahil, I have both tried another brower and also set up a new user account as an administrator, and still have the same problem.  What's next?
Bob
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13058462
use hijackthis please...... post the link here of saved analysed log! :)
0
 

Author Comment

by:rjsteinm
ID: 13058488
Here it is...

Logfile of HijackThis v1.99.0
Scan saved at 3:09:54 PM, on 1/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Pop-Up Stopper\dpps2.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\Cyb2k.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iRider\iRider.exe
C:\Documents and Settings\BOB\Local Settings\Temporary Internet Files\Content.IE5\6X4RMHU1\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r5.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;<local>
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO:   - {1D372972-470D-4978-BC17-A4E13D4B8144} - C:\WINDOWS\lbbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Onfolio Helper - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Onfolio - {1fea1109-9f65-4fdc-aec5-033f6cc60641} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [P2P Networking2] C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe /AUTOSTART
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
O4 - HKCU\..\Run: [Desktop Weather 3] C:\PROGRA~1\THEWEA~1\THEWEA~1.EXE
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Capture &Image To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture &Page To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddLinkEntryFromDocument.html
O8 - Extra context menu item: Capture &Snippet To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentSelection.html
O8 - Extra context menu item: Capture &Target To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2fc2f9a4-c43e-42c0-9490-19d6be8b1726} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Onfolio Capture... - {2fc2f9a4-c43e-42c0-9490-19d6be8b1726} - mscoree.dll (file missing)
O9 - Extra button: Onfolio - {30e2a68b-20f5-419d-bbb9-dce92edc4e67} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Onfolio Collection Explorer - {30e2a68b-20f5-419d-bbb9-dce92edc4e67} - mscoree.dll (file missing)
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/18895ac0999e7caa1202/netzip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: McAfee Privacy Service - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel(R) NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 13058879
hmmmmm so you were able to use the hijackthis.exe after downloading it ??
strange that some programs are working and others not :-?

anyways,,,, run hijackthis.exe from a new folder on your detop, move it out of the temp folders.... then close all the explorer and browser windows, hit scan, and then tick the following lines,

O2 - BHO:   - {1D372972-470D-4978-BC17-A4E13D4B8144} - C:\WINDOWS\lbbho.dll
O2 - BHO: Onfolio Helper - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll -> i dont know if you have installed it yourself or not
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: Onfolio - {1fea1109-9f65-4fdc-aec5-033f6cc60641} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [P2P Networking2] C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe /AUTOSTART
O4 - HKCU\..\Run: [Desktop Weather 3] C:\PROGRA~1\THEWEA~1\THEWEA~1.EXE
================

Click on Fix Checked!
uninstall that P2pNetwroking software from your system and restart!
check if same problem,,,,, if yes then this time try to use your internet connection from safemode with networking..... check there if same problem there also ??
0
 
LVL 14

Expert Comment

by:spiderfix
ID: 13058883
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Panda online will kill it. "Scan your PC" and after..."Hard disks".
0
 

Expert Comment

by:hantang
ID: 13521352
This should work.
Go to start -> run and type in regedit and click ok. you will see registry editor program show up. click on HKEY_LOCAL_MACHINE -> system -> currentcontrolset -> control. scroll down to the bottom and check if you can see a key named WOW. if it's missing then that will be the cause of the problem. copy (export) the entire key from a good xp machine and then import to the problem machine. this should fix the problem. or copy the following text to a notepad and then save as any file name with extension .reg. then double click the file from windows explorer to import the key.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW]
"cmdline"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,\
  00,74,00,76,00,64,00,6d,00,2e,00,65,00,78,00,65,00,00,00
"DefaultSeparateVDM"="no"
"KnownDLLs"="comm.drv commdlg.dll ctl3dv2.dll ddeml.dll keyboard.drv lanman.drv mmsystem.dll mouse.drv netapi.dll olecli.dll olesvr.dll pmspl.dll shell.dll sound.drv system.drv toolhelp.dll vga.drv wfwnet.drv win87em.dll winoldap.mod winsock.dll winspool.exe wowdeb.exe timer.drv rasapi16.dll compobj.dll storage.dll ole2.dll ole2disp.dll ole2nls.dll typelib.dll msvideo.dll avifile.dll msacm.dll mciavi.drv mciseq.drv mciwave.drv progman.exe avicap.dll mapi.dll"
"LPT_timeout"="15"
"SharedWowTimeout"=dword:00000e10
"size"="0"
"wowcmdline"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  6e,00,74,00,76,00,64,00,6d,00,2e,00,65,00,78,00,65,00,20,00,2d,00,61,00,20,\
  00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,\
  5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6b,00,72,00,6e,\
  00,6c,00,33,00,38,00,36,00,00,00
"wowsize"="16"
"RomFontPointers"=hex:79,b0,00,c0,4e,59,00,c0,4e,5d,00,c0,4e,71,00,c0,4e,61,00,\
  c0,4f,71,00,c0

0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…
Suggested Courses

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question