Fixed . . . "Error. the program is corrupted. . "

Discussion in 'SpywareBlaster & Other Forum' started by JForge, May 26, 2004.

Thread Status:
Not open for further replies.
  1. JForge

    JForge Registered Member

    Joined:
    May 26, 2004
    Posts:
    5
    I'm no real expert but thanks to this forum, SpyWare3.1 is now working again. Here's what I did (mostly follow the great instructions here!).

    Followed the instructions contained in thread from LowWaterMark re cleaning with adware, spyware and hijack. After following those instructions for adware and spybot and installing hijack (contained in this thread: https://www.wilderssecurity.com/showthread.php?t=15913 ), I removed the following entries:

    O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\WMPLAYER.EXE
    O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\WMPLAYER.EXE
    O16 - DPF: {B94B4225-E02E-4D3F-BADB-026F1E2F3AD7} (HttpDownloader Control) - file://C:\WINDOWS\SexDownloader.cab
    O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
    O16 - DPF: {DA28C54E-D95C-11D3-9A01-005004677EF4} - http://download.mcafee.com/molbin/clinic/CDM/McCDM.cab
    O16 - DPF: {0C98419E-324F-11D3-9A23-00C04FF40D52} (McAfee Clinic AV Installer Control) - http://download.mcafee.com/molbin/clinic/virusscan/mgavinst.cab
    16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cab

    After doing this, SW3.1 works perfectly. :D

    More info:
    It appears that WMPLAYER.EXE was the main culprit since, as I read here, scripts can be made to control the IE making pages appear and change settings as if somebody else was at the keyboard.

    A directory was created (C:\windows\system\services) that contained the file "wmplayer.exe". No expert here but it's not supposed to be there!!! So it looks like it was used as the vehicle to "hijack" the IE browser and SW3.1.

    I deleted the "services" directory and all files in it, then things calmed down. But SW3.1 still wouldn't work. Deleting the above entries did the trick. Hope this may help somebody else.
     
    Last edited: May 26, 2004
  2. JForge

    JForge Registered Member

    Joined:
    May 26, 2004
    Posts:
    5
    My OS is Windows 98SE with updates. Run IE 5.5 with SP2 and all 'MS fixes'.

    Forgot about Windows INI files. Had to remove two entries.

    Win.INI: contained "run= C:\WINDOWS\SYSTEM\SERVICES\WMPLAYER.EXE" in the [WINDOWS] portion.

    System.INI: contained "load= same as above" in the [WINDOWS] section.

    Both entries were deleted in addition to the what was done in the previous post. My reasoning was that anything that is not currently being 'used' or installed on my computer shouldn't be there.
     
Thread Status:
Not open for further replies.