deharvey2002

Hi

I am having some problems witha PC on a small network of 20 PC's. Some of the applications (mainly educational) will not run and give the error ###.exe is not a valid win 32 application. Other PCs on the network run the software fine
All the PC's have the same hardware and software build and are on XP SP1

I have tried copying the autoexec.nt and and config.nt from the windows/repair folder into windows/system32. I have also copied these files from one of the PC's that works ok into the system32 folder on the problem machine.

I have tried the applications in compatibility mode for 98 and 95. Still get the same error.

Can anyone help a frustrated technician

I have also tried the Peper fix as detailed in a previous post and have run Hijack this. Here is the log file:

Logfile of HijackThis v1.99.1
Scan saved at 12:54:56, on 14/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\RANGER~1\client32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Net Nanny\nnsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Ranger Remote Control\Runplugin.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\Net Nanny\nntray.exe
C:\WINDOWS\system32\spoolsv.exe
\finney\shared\PFS\Dom IT\apps n exe\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.stonecomputers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.stonecomputers.com
F2 - REG:system.ini: UserInit=Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat Reader 5\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CheckMedi8or] C:\Program Files\Mediator6\CheckNewUser.exe
O4 - HKLM\..\Run: [NetSupport Plugin] "C:\Program Files\Ranger Remote Control\Runplugin.exe"
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\System32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.stonecomputers.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PFS.PNEFC
O17 - HKLM\Software\..\Telephony: DomainName = PFS.PNEFC
O17 - HKLM\System\CCS\Services\Tcpip\..\{3583CE05-4BB6-4824-AF4D-FFD9C4E951FA}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PFS.PNEFC
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Client32 - NetSupport Ltd - C:\PROGRA~1\RANGER~1\client32.exe
O23 - Service: NNSvc - BioNet Systems, LLC - C:\Program Files\Net Nanny\nnsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
O23 - Service: Sophos Anti-Virus Update (SweepUpdate) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE

Wont you Please please please help meeeee

Bobrocks

Hello

Have you tried re-installing one of the broken applications since the removal of viri/tojans?

Sometime viruses infect the EXE files and once cleared out the exe will no longer function and may need to be re-installed.

deharvey2002

Hi

The peper removal tool told me there was no peper infection, I just tried it in case. I hadnt mentioned this but I had removed the rider trojan from the pc as well.

I removed one of the applications and then tried to reinstall it. But I got the same error with the setup exe (which is on a cdrom) so it wont even let me reinstall the app. I cannot remember whether this was before or after I removed the rider trojan. ( I am only at that location on mondays)

Unfortunately One of the other applications that wont work is a big one called 'SiR Discovery' and it is a big suite which needs people from SiR to come in and configure, so my boss would want to avoid having to uninstall that unless there is absolutly no other way.

If it is only the exe that is corrupt, then could I copy and paste the exe from a neighbouring/working pc, to overwrite the corrupted one?

Thanks for your time

Bobrocks

The error message "is not a valid win 32 application" is inductive of a few things mainly:

1. If it was a download something went wrong and the file is incomplete.
2. A virus type infection, sadly the errors can keep happening even after removal.

I would suggest running a couple of online scans, but first I would take your log over to the HijackThis forum, down there in the security center, and giving a little description of your problem and one of us will check it over for you.

You could as one of the last things to try, but keep a back up copy of the original before overwritting it.

deharvey2002

Thanks,

Ive posted in the security forum now.

I can only assume then that it is virus related as the apps are not downloaded. I ran our virus scan at the time and as I said it found that rider trojan.

Thanks for your help