not a valid Win32 application - warning. Can't run antivirus apps

[Nehmo]

I think your computer is infected by a unknow infect-virus, all apps
display 'Win322 error ' after you run the app,  probable cause of  the
virus will infect the app when the system prepare to run it by hook
some API. After insert the virus data, it's destroy the original file.
so, you'd better submit the sample's to antivirus vendor online

You're saying I should just submit one of the programs that won't run?
I think the programs are still intact. I just tried to run
MS malicious software removal tool which didn't even finish
extracting. Extraction failed such&such is not a valid Win 32
application.

file show  error dialog, then wait for them reply, after the vendor
can REPAIR the samples, remove the drive, scan it for viruses on
another PC, reinstall it in the original PC unless the antivirus
software detect a lot of viruses.
here are some vendores email address:

(e-mail address removed)
(e-mail address removed)
(e-mail address removed)
(e-mail address removed)
(e-mail address removed)

Posting is getting very slow. The response time from keyboard to
cursor is long. I should be able to find what's eating up the
resources or cpu activity.
~~ Nehmo

 

[Nehmo]

You earlier posted the actual error code.  A google search on that error
code, limited to m$ sites will give you the commands needed to correct it..

There are two types of error messages. One, when I try to install many
programs; and the other, when I try to run many programs. There isn't
any "error code" as such.

The installation error says that the installation failed. Something
failed to write to some file, and I should verify if I have permission
to write to that folder. I've been trying to install anti-virus
programs recently. Most of the time the failure is the failure to
write the definitions.

The run failure is "such and such is not a valid Win32 application".

I've Googled http://xrl.us/notwin32app But I haven't found anybody in
the same exact situation. Most other people with this error can't open
anything. I can open the browsers, and I can open MS Office apps. I
can open lots of programs, actually. It appears the only programs I
can't open are the anti-malware programs. But I did successfully
install and run DriveSentry. I don't know if the program is any good,
though.

In my opinion, you need to format/reinstall, with a valid m$ install cd.

If you don't have an install cd,

I think I don't have the Windows install CD. I'd have to look around.
And yes, that method (reinstall Windows) would solve the problem, but
we wouldn't know what happened. And it would be an inelegant solution.
There's a philosophical surrender to that route.

I still have some options. I could get more help by posting in the web-
based anti-malware forums. I'll do that right away. I could also go to
a restore point with System restore. And I could try to find some
malware scanner that works.

you would be much better off switching
to linux.  

I'd have to make a duel boot machine before I switched, and now is not
the time to experiment making one of those. I need to solve the
immediate problem.

 

[Larry Sabo]

I could also go to
a restore point with System restore.

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

 

[Juan Kerr]

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

I would be tempted to first try to run an AV from CD.
Ultimate BootCD from http://www.ultimatebootcd.com - Has F-Prot, McAfee,
Avast and AVG that you can run without booting a dodgy OS...

 

[David W. Hodgins]

There are two types of error messages. One, when I try to install many
programs; and the other, when I try to run many programs. There isn't
any "error code" as such.

I was referring to your Nov 7th post which contained ...
"Local machine: installation failed
Installation:
Error: Action failed for file avgwdsvc.exe: starting
service....
Error 0x800700c1"

Running a google search on 0x800700c1 leads to
http://www.techsupportforum.com/mic...microsoft-update-error-number-0x800700c1.html

Take note of the regsvr32 and sfc commands in the second item.

Regards, Dave Hodgins

 

[Nehmo]

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

I'm not sure if you are saying system restore will work or not. What
do you mean by not working "directly".
I said one reason I don't feel happy re-installing windows is that it
would be giving up. But actually, I don't have an install disk, so
that's not an immediate option.
I've never used system restore, and so I don't have any confidence in
it. I suppose I should learn about it now.
~~ Nehmo

 

[Larry Sabo]

I could also go to
a restore point with System restore.

[snip] Hwoever, I doubt very much
thay system restore will work directly.

Larry

I'm not sure if you are saying system restore will work or not. What
do you mean by not working "directly".
I said one reason I don't feel happy re-installing windows is that it
would be giving up. But actually, I don't have an install disk, so
that's not an immediate option.
I've never used system restore, and so I don't have any confidence in
it. I suppose I should learn about it now.
~~ Nehmo

Sometimes System Restore will fail (see
http://bertk.mvps.org/html/srfail.html) and it must be done manually.
One method is described in the following link (although I haven't
tried it myself and it is rather complex. I would recommend trying all
the fixes suggested in the previous link first)...

http://www.aade.com/XPhint/XPrecovery.htm

It requires that you are able to boot to the Command Console. Because
you lack a Windows CD, you can download a boot CD from
http://www.bootdisk.com/ and use it instead.

If you had or could borrow a UBCD4Win CD, you could use it to restore
the registry to an earlier date without having to go through the
complex procedure mentioned above. However, restoring just the
registry and not the compromised/missing DLLs won't fix the problem.
Only System Restore and SFC can restore the original DLLs. See the
previous reply on how to run SFC; it requires a Windows CD, but you
could legally use a borrowed one, I believe.

The AUMHA site http://aumha.net/viewforum.php?f=54 mentioned in the
above link is also very helpful, but requires a lot of digging and
often just points back to http://bertk.mvps.org/html/srfail.html in
the advice given. Be sure to create a Restore Point before trying
System Restore.

Good luck.

Larry

 

[Nehmo]

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

I opened System Restore. The only restore point is one created on the
9th, after the onset of the problem. When I opened it previously,
there were other points. I must have, or something must have, deleted
the other points. I don't recall doing anything to delete restore
points, however. I did twice do a Disk Cleanup, but that doesn't (I
just looked) delete restore points.

And don't worry about being "harsh". Say anything you want to say as
long as it tends toward a solution.
~~ Nehmo

 

[The Real Truth MVP]

Nehmo, You have a rootkit. I have just received a list of infected file
names and I am putting together a package that will clean your system. Give
me a few hours to finish it and test it. You will have to email me to get it
until I put it up on my site.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

I opened System Restore. The only restore point is one created on the
9th, after the onset of the problem. When I opened it previously,
there were other points. I must have, or something must have, deleted
the other points. I don't recall doing anything to delete restore
points, however. I did twice do a Disk Cleanup, but that doesn't (I
just looked) delete restore points.

And don't worry about being "harsh". Say anything you want to say as
long as it tends toward a solution.
~~ Nehmo

 

[Larry Sabo]

I opened System Restore. The only restore point is one created on the
9th, after the onset of the problem. When I opened it previously,
there were other points. I must have, or something must have, deleted
the other points. I don't recall doing anything to delete restore
points, however. I did twice do a Disk Cleanup, but that doesn't (I
just looked) delete restore points.

OK, thanks for the feedback. I would suggest going to another
computer, downloading and running the Antivir Rescue System from...
http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html
....which burns a bootable CD you can use to scan and remove viruses
from your PC.

If it fails to start up after that, I'd borrow a Windows CD and do a
reapir install and change the Product Number to your own after the
repair, if it asks for one while using the borrowed CD, as often is
the case.

If the repair install fails, as it might, given how badly bruised your
system seems, I'd do a fresh install without formatting the drive,
just re-installing Windows into the current Windows directory. You
will have to re-install all your programs and restore it from backup.

I assume you have backed up your data already?

Good luck!

Larry

 

[Nehmo]

I was referring to your Nov 7th post which contained ...
"Local machine: installation failed
    Installation:
        Error: Action failed for file avgwdsvc.exe: starting
service....
            Error 0x800700c1"

Running a google search on 0x800700c1 leads tohttp://www.techsupportforum..com/microsoft-support/windows-xp-support/...

Take note of the regsvr32 and sfc commands in the second item.

Regards, Dave Hodgins

I tried re-registering the dll's as suggested on that xp-support
forum. Nothing improved. That error was from when I tried to install
AVG free.
After every attempt at fixing, I try to run HijackThis to see if the
problem is resolved. I have HijackThis renamed and moved to the
desktop. It never runs. I just get the Win32 error.
~~ Nehmo

 

[David W. Hodgins]

I tried re-registering the dll's as suggested on that xp-support
forum. Nothing improved. That error was from when I tried to install

Might be a good time to consider switching to linux. It's free, and you
don't have to worry about viruses (unless you really try to mess things
up).

Regards, Dave Hodgins

 

[The Real Truth MVP]

Disclaimer: Modifying the registry can cause serious problems that may
require you to reinstall your operating system. I cannot guarantee that
problems resulting from modifications to the registry can be solved. Use the
information provided at your own risk.

On the Tools menu in Windows Explorer, click Folder Options.
Click the View tab.
Under the Hidden files and folders heading select Show hidden files and
folders.
Uncheck the Hide protected operating system files (recommended) option
Click ok.

Click start run, type in the box regedit, then press enter.
Navigate to this key in your registry and delete the value for AppInit_DLLs
by right clicking on it and choosing modify, if you see that karna.dat,
delete it.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows\AppInit_DLLs.

Navigate to this key in your registry and delete them if they are there.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
HKEY_LOCAL_MACHINE\SOFTWARE\tdss

Download my trojan.tdss fix tools (beta) from here unzip it then double
click on it to run it.
http://pcbutts1.com/downloads/TDSS.zip
Reboot your computer.

Download MBAM from this link and install it
http://majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html you should be
able to run it now and be able to update your AV definitions, ran a full
scan with both.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/

Not to be too harsh, but a lot of people have spent time trying to
help you, and you haven't even tried System Restore yet? If you were
an advanced user, I could understand trying to suss out the underlying
problem, but it seems like a lot of wasted effort, in my view. I'd
just run System Restore and be done with it. Hoever, I doubt very much
thay system restore will work directly.

Larry

I opened System Restore. The only restore point is one created on the
9th, after the onset of the problem. When I opened it previously,
there were other points. I must have, or something must have, deleted
the other points. I don't recall doing anything to delete restore
points, however. I did twice do a Disk Cleanup, but that doesn't (I
just looked) delete restore points.

And don't worry about being "harsh". Say anything you want to say as
long as it tends toward a solution.
~~ Nehmo

 

[Nehmo]

Disclaimer: Modifying the registry can cause serious problems that may
require you to reinstall your operating system. I cannot guarantee that
problems resulting from modifications to the registry can be solved. Use the
information provided at your own risk.

On the Tools menu in Windows Explorer, click Folder Options.
Click the View tab.
Under the Hidden files and folders heading select Show hidden files and
folders.
Uncheck the Hide protected operating system files (recommended) option
Click ok.

Click start run, type in the box regedit, then press enter.
Navigate to this key in your registry and delete the value for AppInit_DLLs
by right clicking on it and choosing modify, if you see that karna.dat,
delete it.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows\AppInit_DLLs.

This is the only key similar to the one above:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows
\LoadAppInit_DLLs


The other keys aren't there.

Navigate to this key in your registry and delete them if they are there.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
HKEY_LOCAL_MACHINE\SOFTWARE\tdss

Download my trojan.tdss fix tools (beta) from here unzip it then double
click on it to run it.http://pcbutts1.com/downloads/TDSS.zip
Reboot your computer.

Download MBAM from this link and install ithttp://majorgeeks.com/Malwarebytes_Anti-Malware_d5756.htmlyou should be
able to run it now and be able to update your AV definitions, ran a full
scan with both.

I haven't tried that anti-malware app yet (since the problem). I'll
see if it installs.


~~ Nehmo

 

[The Real Truth MVP]

What part of beta don't you understand dickwad? It's work in progress. At
lease with that he should be able to update his antivirus and malware apps.
What help have you given him......... oh yea Format and re-install GREAT JOB
David you are some kind of tech.

 

[Buffalo]

What part of beta don't you understand dickwad? It's work in
progress. At lease with that he should be able to update his
antivirus and malware apps. What help have you given him......... oh
yea Format and re-install GREAT JOB David you are some kind of tech.

Yeah David,
What have you got to say for yourself?

 

[Nehmo]

This is the only key similar to the one above:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows
\LoadAppInit_DLLs

The other keys aren't there.




I haven't tried that anti-malware app yet (since the problem). I'll
see if it installs.

As I previously said, the keys aren't present, so there was nothing to
delete. But now there is significant progress. I was able to install
and run Malwarebytes_Anti-Malware. It found 300-some bad files. I then
ran Drive Sentry which found 4 more. I'm running Malwarebytes again.
But...yes, but I still can't install and run Hijack This or some other
programs. I still get the not a valid Win32 error.
~~ Nehmo

 

[Buffalo]

From: "Buffalo" <[email protected]>





I stick by my orginal response. I am not one for indicating a wipe
and reload too easily. However I do understand what is going on and
what he has is too far involved. In this situation a wipe and reload
is the best solution.

I was just being facetious.
I think you always give excellent advice.

 

[The Real Truth MVP]

That's good now update your antivirus you may need to re-download it. Any
old exe that did not work before will still not work.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/

This is the only key similar to the one above:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows
\LoadAppInit_DLLs

The other keys aren't there.




I haven't tried that anti-malware app yet (since the problem). I'll
see if it installs.

As I previously said, the keys aren't present, so there was nothing to
delete. But now there is significant progress. I was able to install
and run Malwarebytes_Anti-Malware. It found 300-some bad files. I then
ran Drive Sentry which found 4 more. I'm running Malwarebytes again.
But...yes, but I still can't install and run Hijack This or some other
programs. I still get the not a valid Win32 error.
~~ Nehmo

 

[Nehmo]

That's good now update your antivirus you may need to re-download it. Any
old exe that did not work before will still not work.

There's a peculiarity that might mean something: I'm running Drive
Sentry http://www.drivesentry.com/ . The program is supposed to alert
the user to writes to the hard drive. Then the user can approve or
disapprove. I continually get (separate) warnings that winfilse.exe
(this is the correct spelling; it's not winfiles) and wintems.exe are
trying to write, and Drive Sentry suggests a rule that I should
disapprove. I do disapprove. But later I get the same warnings. Drive
Sentry, in its log section, says that winfilse.exe is in c:\windows
\system32\drivers . But when I look there using Explorer, I don't see
it.

Right now there's nothing in Drive Sentry's log about winterms.exe . I
think the log only goes so far back.

Another peculiarity: Using Firefox, I can't open messages in Hotmail.
But if I use IE, I can.

I also found this thread: http://forums.majorgeeks.com/showthread.php?t=172675
.. R4nd seems as though he or she has a similar problem. R4nd has the
two executables I mentioned above, he or she gets the not a valid
Win32 error, he or she seems only to scan with Malwarebytes. But R4nd
doesn't say anything beyond the first post. I don't know if
bjgarrick's solution was successful.

I'm currently in the midst of a after-update scan with Malwarebytes.

Scan finished. 44 more items. Need to reboot to delete.

~~ Nehmo








~~ Nehmo