Run my diagnostic tool called whatslivern. That file after a few seconds,
when complete, will generate a log file. That log file will be saved inthe
same directory you ran the program from, using the email link and the bottom
of my page send me a copy of that log file.
http://pcbutts1.com/downloads/tools/tools.htm
"Nehmo" <
[email protected]> wrote in message
I've uninstalled all the antivirus programs. But I can't seem to
install one and get it to work. I get the not valid Win32 message.
I've been trying to get any kind of virus scan. I just tried Kasparski
online scan. It failed with this message:
Update has failed. Program has failed to start. Close the Kaspersky
Online Scanner 7.0 window and open it again to install the program.
You must be online to update the Kaspersky Online Scanner 7 database.
With the latest database updates, you can find new viruses and other
threats. Please go online to use Kaspersky Online Scanner 7. [ERROR:
Scan has failed to start. [0x80004005]]
I can't reinstall windows because I don't have the install disk.
Instead of emailing it, I posted the logfile generated by
runningnow.vbs (which was unpacked from runningnow.exe) below. The
program seemed to to have ran as it should.
After being, so far, unable to install (I still get the same errors
noted in my earlier posts) any other anti-malware scanning app, I was
able to install DriveSentryhttp://
www.drivesentry.com/.
When it scanned, it found two malware items, named something Beagle,
which I then deleted.
DriveSentry is also repeatedly displaying a popup that gives the
option to block winfilse.exe , which DriveSentry says lives in
system32\drivers folder, from writing. I chose to "Keep Blocking".
DriveSentry, however, did not flag winfilse.exe when DriveSentry
scanned. I also can't find winfilse.exe in that folder or anywhere on
my drive.
I'm beginning to wonder about DriveSentry.
The computer is functioning normally except it seems slow and the cpu
usage goes up to 100% a lot. I also, as noted in my earlier posts,
can't run some apps (I'm getting the not a valid Win32 app error), and
I can't completely install many anti-malware apps (something is
preventing writing of the definitions).
More on this later. I thank everybody who is helping.
---------------begin logfile
"running now.vbs", revision 70,
http://www.pcbutts1.com/downloads/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Google Update" = ""C:\Documents and Settings\Owner\Local Settings
\Application Data\Google\Update\GoogleUpdate.exe" /c" [null data]
"SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy
\TeaTimer.exe" ["Safer Networking Limited"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"IgfxTray" = "C:\WINDOWS\system32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\system32\hkcmd.exe" ["Intel Corporation"]
"Persistence" = "C:\WINDOWS\system32\igfxpers.exe" ["Intel
Corporation"]
"CHotkey" = "zHotkey.exe" [empty string]
"ShowWnd" = "ShowWnd.exe" [null data]
"ModPS2" = "ModPS2Key.exe" ["Chicony"]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE"
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD
\PDVDServ.exe"" ["Cyberlink Corp."]
"LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language
\Language.exe"" [null data]
"Google Desktop Search" = ""C:\Program Files\Google\Google Desktop
Search\GoogleDesktop.exe" /startup" ["Google"]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers
\w32x86\3\hpztsb04.exe" ["HP"]
"QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -
atboottime" ["Apple Inc."]
"GrooveMonitor" = ""C:\Program Files\Microsoft Office
\Office12\GrooveMonitor.exe"" [MS]
"Run StartupMonitor" = "StartupMonitor.exe" [null data]
"PWRISOVM.EXE" = "C:\Program Files\PowerISO\PWRISOVM.EXE" ["PowerISO
Computing, Inc."]
"lxcrmon.exe" = ""C:\Program Files\Lexmark 2400 Series
\lxcrmon.exe"" [null data]
"EzPrint" = ""C:\Program Files\Lexmark 2400 Series
\ezprint.exe"" ["Lexmark International Inc."]
"LXCRCATS" = "rundll32 C:\WINDOWS\System32\spool\DRIVERS
\W32X86\3\LXCRtime.dll,_RunDLLEntry@16" [MS]
"CanonSolutionMenu" = "C:\Program Files\Canon\SolutionMenu
\CNSLMAIN.exe /logon" ["CANON INC."]
"CanonMyPrinter" = "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /
logon" ["CANON INC."]
"DriveSentry" = "C:\Program Files\DriveSentry
\DriveSentry.exe" ["DriveSentry Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\(Default) = "WormRadar.com
IESiteBlocker.NavFilter"
-> {HKLM...CLSID} = "AVG Safe Search"
\InProcServer32\(Default) = "C:\Program Files\AVG
\AVG8\avgssie.dll" [file not found]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\Program Files
\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\Program Files
\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
{A057A204-BACC-4D26-9990-79A187E2698E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AVG Security Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\AVG
\AVG8\AVGTOO~1.DLL" [file not found]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google
\googletoolbar1.dll" ["Google Inc."]
{CA6319C0-31B7-401E-A518-A07C3DB8F777}\(Default) = "Browser Address
Error Redirector"
-> {HKLM...CLSID} = "CBrowserHelperObject Object"
\InProcServer32\(Default) = "c:\windows
\system32\BAE.dll" ["Gateway Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions
\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL
Extension"
-> {HKLM...CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not
found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS
\system32\hticons.dll" ["Hilgraeve, Inc."]
---------------end logfile
