Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Pc Looks To Be Infected, Can't Open .exe Files, Internet Dies, "invalid Win32 Application"


  • Please log in to reply
39 replies to this topic

#1 dursman2000

dursman2000

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 08:34 AM

Hi everyone,
My PC looks to be infected. Last night I downloaded a program and since then here's what I've got:

-AVGFree, Zone Alarm, Spybot will no longer load -- I get the NOT A VALID WIN32 APPLICATION error

-I can't even get HyjackThis to load, as I get the same error

-The internet connection hangs after 5 minutes and basically stops

-I can't get Network Sharing to run either

-Safe Mode does not work (blue screen), and System Restore fails each time

PLEASE HELP ME :thumbsup:

BC AdBot (Login to Remove)

 


m

#2 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:06:04 AM

Posted 16 March 2008 - 08:58 AM

Hi and welcomPosted Image

so that we can better assist you can you kindly tell us which windows version you are running, when it was last updated, when did you last update AVG7.5 and fully run it


also , which WAS the program you downloaded that has given your computer a wobbly?


you may wish to try running these FREE programs
asquared
http://www.emsisoft.com/en/software/free/
its exe is
http://download6.emsisoft.com/a2FreeSetup.exe
superanitspyware
http://www.superantispyware.com/superantis...efreevspro.html

its exe is http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

please download these; fully update the definitions , then reboot (unfortunately safe mode is unavailable?) and run each scan on a FULL deep scan; these MAY take some time if you have a lot on your computer so be patient

please let us know how you get on?

#3 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:04 AM

Posted 16 March 2008 - 09:02 AM

If you are unable to load some security programs, try running them directly off a USB drive.

This may not work with programs that require an install. For such programs, try copying the whole folder for its program files into a USB.

#4 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 09:21 AM

If you are unable to load some security programs, try running them directly off a USB drive.

This may not work with programs that require an install. For such programs, try copying the whole folder for its program files into a USB.


Thanks Panda. I have AVGFRee and Spybot installed, I just cannot start them. Which program would you recommend trying first on the USB drive?

#5 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:04 AM

Posted 16 March 2008 - 09:30 AM

I know, almost for sure that HJT would be able to run off the USB. However, I don't want to resort to it just yet. Should you need to post a log later, that method could be used. Please do not post a HJT log until directed by a moderator.

I would first copy the Spy Bot over to the USB and try to run that. Do this by navigating to c:\program files, copying the whole folder for SpyBot onto the USB and trying to run it.

If you are able to run any online scans, that would be good as well. For example, the ESET Scan.

Edited by PropagandaPanda, 16 March 2008 - 09:33 AM.


#6 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 09:34 AM

I just tried putting AVG7 on my USB drive, it still will not start the program from there...get the same Invalid Win32 problem.

Is there another way to run the program from the folder?

What's very odd is that the .exe programs actually "flash" -- as in, if you look at the list, all of them blink every few seconds. Very very strange.

Will try Spybot next.

Edited by dursman2000, 16 March 2008 - 09:34 AM.


#7 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 09:36 AM

My problem with doing an online scan is my internet connection off this PC runs for about 5 minutes and then stops. No rhyme or reason for it, and I know it's not the connection or the router as my laptop is fine (I'm writing from that),

#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:04 AM

Posted 16 March 2008 - 09:41 AM

If the windows are "blinking" the malware could interfering with your video drivers. This is not uncommon.

Do you get the error for all .exe files? That would be curious, as your computer's essential processes would not be running then.

Also try putting the shortcut of one of your anti-malware programs into the Startup folder (Start>All programs>startup. It may be able to load ahead of the malware.

Edited by PropagandaPanda, 16 March 2008 - 09:46 AM.


#9 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 09:54 AM

Yes it does seem to be all .exes...at least anything I've tried downloading whether it's hyjack this, or combofix, will not start.

I notice my Startup folder has been cleaned out of everything except Adobe Gamma and Interact Profile Activator. I'm going to put AVG in there and restart -- would the right .exe be avgemc to place the shortcut?

#10 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:04 AM

Posted 16 March 2008 - 09:55 AM

The startup folder doesn't require the original file. Just putting a shortcut to AVG would be fine.

Then ofcourse, restart your computer. AVG should open at startup, if all goes well.

Edited by PropagandaPanda, 16 March 2008 - 09:56 AM.


#11 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 09:59 AM

The startup folder doesn't require the original file. Just putting a shortcut to AVG would be fine.

Then ofcourse, restart your computer. AVG should open at startup, if all goes well.


A shortcut to the program folder then?

#12 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:06:04 AM

Posted 16 March 2008 - 10:00 AM

it would still be helpful to know which program it was you downloaded that has affected the computer please :thumbsup:

#13 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:04 AM

Posted 16 March 2008 - 10:02 AM

No. I mean drag a desktop shortcut into there. Like one of the shortcuts that you would normally click on to start the program.

#14 dursman2000

dursman2000
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:04 AM

Posted 16 March 2008 - 10:03 AM

it would still be helpful to know which program it was you downloaded that has affected the computer please :thumbsup:


Honestly, it was a basketball simulation manager of all things -- TSOfficepool March Insanity 6.0.0. It's what I get when I try to improve my NCAA hoops program! I tried uninstalling it, obviously, but no help.

#15 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:02:04 AM

Posted 16 March 2008 - 10:05 AM

http://www.avast.com/eng/avast-virus-cleaner.html

If, for example, only the association for .EXE files has been corrupted, you may run the avast! Virus Cleaner by renaming it to a .COM file. The other extensions you may try are .SCR, .BAT, .PIF (on Windows NT/2000/XP/2003, you may try .CMD as well). If none of these extensions works (Windows is still reporting "Cannot find 'xyz.exe'" when you try to start the tool),


Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users