Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

[file].exe is not a valid win32 operations NEW VIRUS


  • Please log in to reply
1 reply to this topic

#1 mrpockets

mrpockets

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:28 AM

Posted 23 October 2009 - 10:56 PM

I recieved a Dell Inspiron E1505 in my shop in my shop early this week. User said she was on it, got a number of "virus" warnings (similar to the rouge anti-spyware virus's that're common now), and anything she clicked would come up and say "[program].exe is not a valid win32 applicaton". When i got it, it wouldn't boot at all. would come up only to the - in the upper left corner of the screen. no safe mode, no nothing. I ran a repair install, which ran into a ton of errors, and promtped me for regional / time settings, and the License Key (which a repair shouldn't do...) BUT it eventually finished and allowed me to boot. I then ran into the same file.exe is not a valid win32 application error. Worked on this PC for hours, checked hardware, pulled HDD and scanned it in a 3rd party system, everything looked clean. Finally came across a nutty file (created roughly the same time she started having the issues) called pump.exe . I've searched all over the web for a fix to this issue, and although the error is common amoung many different senerios, nothign seemed to fix. Below is how i found a resolution.

**If the PC no longer boots**

Run a repair install. Be prepaired to enter a CD key. hit ignore for any errors that may come up, and DONT deficate yourself when it reboots and looks like you just installed clean, youll find that after hitting next > next> on the welcome screen, it goes back into your origional install, settings, files and all.

THEN

-Boot to safe mode



-Start > run > Command.com

-in the prompt enter regedit
*note: In my case, simply start>run>regedit would also return a "regedit is not a valid win32 application"


-Browse to HKCR > .exe >

-verify the default value is exefile

-Browse to HKCR > exefile > shell > open > command

-In the Default Value, the entry SHOULD be "%1" %*

In my case, the default value was c:\WINDOWS\System32\pump.exe "%1" %*

RESOLUTION: Remove the C:\WINDOWS\System32\pump.exe and verify the entry is ONLY "%1" %*

note: Changes should take effect imemdiatly after changnig the registry key.

THEN

-Reboot, run all your favorite anti-malware scans. Smile as they actually OPEN when you click them.


Disclaimer:

This article was written quickely, and was not edited. This article was published ONLY so that anyone in a similar senerio will hopfully stumble upon it and have hope for resolving what seems to be a relitivly new virus.


have a good night,

-Mrpockets

( Thanks to \malex\ for the pointers )


EDIT: Moved to more appropriate forum

Edited by garmanma, 24 October 2009 - 11:18 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,252 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 AM

Posted 24 October 2009 - 09:33 AM

FWIW: Any install, repair or clean, should prompt for the license key...by my experiences with my systems.

I will only add a cautionary note to anyone who is considering any registry edit procedure. The first step in doing such such alwys be to make a backup of the registry...in case you make a mistake or something inadvertently goes wrong.

An excellent tool for doing such is ERUNT Registry Backup Tool - http://www.snapfiles.com/get/erunt.html.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users