"xxx.exe is not a valid Win32 application"

I cannot open programs that I download from sites on the web.  I've tried to download  programs from the Cybersitter, Webroot, PCworld and Download.com sites in the past day, and I get the same message:  (xxx).exe is not a valid Win32 application. [ xxx ] is the name of the file I'm trying to open.

I am running XP with the most current version of McAfee.  I've run both Adaware and Spybot in the past day, so I'm pretty comfortable that my system is "clean."  

Can somebody help me with this one?

Thanks,
Bob
rjsteinmAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SheharyaarSaahilCommented:
Hello rjsteinm =)

If these are just the programs which you have downloaded from internet... then try deleting your temporary internet filesand history from IE options and then check if same issue still ??
0
stevenlewisCommented:
this is usally caused by a corrupted file
as Shehar said, clear your temp files and then redownload and test
0
SheharyaarSaahilCommented:
and just for making sure, you can run this online virus scan for 100% sureity that system is really clean :)
http://housecall.trendmicro.com/ 
And this is the new MS Antispwyare tool which you should try atleast once >> http://www.microsoft.com/athome/security/spyware/software/default.mspx

Post Back the results :)
0
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

Debsyl99Commented:
Hi
Could be a corrupted file or in which case download again after deleting:
Could be related to a virus:
W32.Sonic.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.sonic.worm.html
Not a valid win32 application
http://www3.telus.net/dandemar/win32.htm
Games: Error Message: Not a Valid Win32 Application
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q315589
0
Debsyl99Commented:
Hi guys - you would really think I'd know by know to refresh the page before posting wouldn't you? - (Slaps self with kipper)
0
stevenlewisCommented:
LOL. we all do it :-)
0
rjsteinmAuthor Commented:
SheharyaarSaahil, I'm in the midst of using the housecall virus scan you recommended, and it has found a virus called "TROJ_AGEND.JD.  Housecall says it is "non cleanable."  How can I get rid of it?
Bob
0
SheharyaarSaahilCommented:
is it telling the file name which is infected with this trojan ??
0
SheharyaarSaahilCommented:
if no then we are required to manually clean the system, do this please!
Download HijackThis from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe

Then Post that log at this site >> http://www.hijackthis.de
hit the Analyse button, scroll down to the bottom, hit the Save Analyse link, a new page will open, please post here the address of that page instead of the whole log..... we will check it out that where the corruption lies! :)
0
rjsteinmAuthor Commented:
I can't tell yet because it is buried about 6 directories deep, and the window for viewing is too small.  I'm assuming that after it is done running, I'll be able to view it.
0
SheharyaarSaahilCommented:
ok then finish it.... and if still you cannot see it, then use the hijackthis program as i mentioned above :)
0
Debsyl99Commented:
Hi
Many viruses are non-cleanable - ie the av program attempts to clean the virus from the file - when really what we need is the file containing the nasty virus code to be deleted. Be worried if the file can't be deleted - if it can then it should work ok :))
0
rjsteinmAuthor Commented:
OK.  Now I can see it.  Here's where it is:
c:\Documents and Settings\Rachel\ Local Settings\Temp\lCD2.tmp\WinadX.dll

Rachel is my wife; its in her portion of XP.

Bob
0
SheharyaarSaahilCommented:
ok then start your system in safemode, login as Adminsitrator!
Then goto My Computer>Tools>Folder Options>View and turn on the feature of Show Hidden Files
Then goto C:\Documents and Settings\your username\Local Settings\Temp and delete all files present here
Then goto C:\Documents and Settings\your username\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Then goto C:\Windows\Temp and delete all files present here!

Now restart and boot in normal mode.... check if any progress? :)
0
rjsteinmAuthor Commented:
OK, the virus scan has FINALLY completed.

I found one more instance of the TROJAN.AGENT virus.  This time its in:

C:WINDOWS\Downloaded Program Files\WinadX.dll

HouseCall gives me a "delete" option.  Should I do this or follow your safemode advice above?

Should I do both?

Thanks,
Bob
0
SheharyaarSaahilCommented:
if its giving the delete option, then use it.... and if it will say that cannot delete blah blah, then you can manually delete it via safemode! :)
0
rjsteinmAuthor Commented:
RATS.  It still doesn't work.  Any more suggestions.
Bob
0
SheharyaarSaahilCommented:
two suggestions!

use another browser to download some files and check if same error ??
create a new user account, and from there use IE to download some files... check if same error still ??
Post back :)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rjsteinmAuthor Commented:
SheharyaarSaahil, I have both tried another brower and also set up a new user account as an administrator, and still have the same problem.  What's next?
Bob
0
SheharyaarSaahilCommented:
use hijackthis please...... post the link here of saved analysed log! :)
0
rjsteinmAuthor Commented:
Here it is...

Logfile of HijackThis v1.99.0
Scan saved at 3:09:54 PM, on 1/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Pop-Up Stopper\dpps2.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\Cyb2k.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iRider\iRider.exe
C:\Documents and Settings\BOB\Local Settings\Temporary Internet Files\Content.IE5\6X4RMHU1\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r5.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;<local>
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO:   - {1D372972-470D-4978-BC17-A4E13D4B8144} - C:\WINDOWS\lbbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Onfolio Helper - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Onfolio - {1fea1109-9f65-4fdc-aec5-033f6cc60641} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [P2P Networking2] C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe /AUTOSTART
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
O4 - HKCU\..\Run: [Desktop Weather 3] C:\PROGRA~1\THEWEA~1\THEWEA~1.EXE
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Capture &Image To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture &Page To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddLinkEntryFromDocument.html
O8 - Extra context menu item: Capture &Snippet To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentSelection.html
O8 - Extra context menu item: Capture &Target To Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2fc2f9a4-c43e-42c0-9490-19d6be8b1726} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Onfolio Capture... - {2fc2f9a4-c43e-42c0-9490-19d6be8b1726} - mscoree.dll (file missing)
O9 - Extra button: Onfolio - {30e2a68b-20f5-419d-bbb9-dce92edc4e67} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Onfolio Collection Explorer - {30e2a68b-20f5-419d-bbb9-dce92edc4e67} - mscoree.dll (file missing)
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/18895ac0999e7caa1202/netzip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: McAfee Privacy Service - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel(R) NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

0
SheharyaarSaahilCommented:
hmmmmm so you were able to use the hijackthis.exe after downloading it ??
strange that some programs are working and others not :-?

anyways,,,, run hijackthis.exe from a new folder on your detop, move it out of the temp folders.... then close all the explorer and browser windows, hit scan, and then tick the following lines,

O2 - BHO:   - {1D372972-470D-4978-BC17-A4E13D4B8144} - C:\WINDOWS\lbbho.dll
O2 - BHO: Onfolio Helper - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll -> i dont know if you have installed it yourself or not
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: Onfolio - {1fea1109-9f65-4fdc-aec5-033f6cc60641} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [P2P Networking2] C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe /AUTOSTART
O4 - HKCU\..\Run: [Desktop Weather 3] C:\PROGRA~1\THEWEA~1\THEWEA~1.EXE
================

Click on Fix Checked!
uninstall that P2pNetwroking software from your system and restart!
check if same problem,,,,, if yes then this time try to use your internet connection from safemode with networking..... check there if same problem there also ??
0
spiderfixCommented:
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Panda online will kill it. "Scan your PC" and after..."Hard disks".
0
hantangCommented:
This should work.
Go to start -> run and type in regedit and click ok. you will see registry editor program show up. click on HKEY_LOCAL_MACHINE -> system -> currentcontrolset -> control. scroll down to the bottom and check if you can see a key named WOW. if it's missing then that will be the cause of the problem. copy (export) the entire key from a good xp machine and then import to the problem machine. this should fix the problem. or copy the following text to a notepad and then save as any file name with extension .reg. then double click the file from windows explorer to import the key.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW]
"cmdline"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,\
  00,74,00,76,00,64,00,6d,00,2e,00,65,00,78,00,65,00,00,00
"DefaultSeparateVDM"="no"
"KnownDLLs"="comm.drv commdlg.dll ctl3dv2.dll ddeml.dll keyboard.drv lanman.drv mmsystem.dll mouse.drv netapi.dll olecli.dll olesvr.dll pmspl.dll shell.dll sound.drv system.drv toolhelp.dll vga.drv wfwnet.drv win87em.dll winoldap.mod winsock.dll winspool.exe wowdeb.exe timer.drv rasapi16.dll compobj.dll storage.dll ole2.dll ole2disp.dll ole2nls.dll typelib.dll msvideo.dll avifile.dll msacm.dll mciavi.drv mciseq.drv mciwave.drv progman.exe avicap.dll mapi.dll"
"LPT_timeout"="15"
"SharedWowTimeout"=dword:00000e10
"size"="0"
"wowcmdline"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  6e,00,74,00,76,00,64,00,6d,00,2e,00,65,00,78,00,65,00,20,00,2d,00,61,00,20,\
  00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,\
  5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6b,00,72,00,6e,\
  00,6c,00,33,00,38,00,36,00,00,00
"wowsize"="16"
"RomFontPointers"=hex:79,b0,00,c0,4e,59,00,c0,4e,5d,00,c0,4e,71,00,c0,4e,61,00,\
  c0,4f,71,00,c0

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.