After running avast 4 for some while, now it has stopped working. When I try to launch it manually I get the above error plus 'Splash cannot execute the following program: \ashSimpl.exe
If I launch ashSimpl.exe by double-clicking in explorer it appears to work OK.
I’ve manually downlaoded and installed the latest version and rebooted, makes no difference.
Running ashSimpl.exe reports no viruses.
Any ideas what’s wrong?
Cheers
Brian Abbott
I’m not sure but, maybe, the error could be on Microsoft Jet Drivers. You may try to download and install the latest MDAC (http://www.microsoft.com/downloads/details.aspx?FamilyID=6c050fe3-c795-4b7d-b037-185d0506396c&DisplayLang=en).
Hope this help.
I hate numbered error messages! >:(
Hmm, strange… sounds more like a registry problem.
Didn’t you e.g. move the avast! installation folder from the original location?
What operating system do you use?
Brian, just a thought here, if you have a firewall on your computer , and with new avast instaled, and wit hany good firewall it would have noticed that the version has changed and ask for user rights again. In my firewall it would be the component has changed, and has the user re authorize it again before it connects. This was the case with my outpost firewall… Maybe it might be your situation also…
Good Luck
Well, the error message means that ashAvast.exe wasn’t able to launch ashSimple.exe, nothing else.
The error code, however, is “ERROR_BAD_EXE_FORMAT - The file is not a valid Win32 application”… which is rather strange (especially when you say you can run ashSimple.exe without any troubles).
If you start regedit and navigate to
HKEY_CURRENT_USER\Software\ALWIL Software\Avast\4.0, what is the value of the “StartUpApp” item?
I have the latest MDAC etc installed …
Hi
No, still in the original location. Running under XP Pro, latest SPs installed.
No, I have a router between me and the world and no firewall on the PC
The value is ‘simple’.
Actually, this rings a bell, I also can’t open a *.txt file if I double-click in explorer, gives me a ‘not a valid Win32 application’ . Sounds like there might be a registry problem …
Cheers
Brian Abbott
.txt files cannot be opened? Interesting… can you check some more values in regedit?
Specifically,
HKEY_CLASSES_ROOT\txtfile\shell\open\command
and maybe also
HKEY_CLASSES_ROOT\exefile\shell\open\command
exefile = “%1” %*
txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1
As it should be?
Cheers
Yes, it’s correct… and now, when you click on a .txt file in Explorer, you get “Not a valid Win32 application” message?
Were you infected by any file-infecting virus recently?
Yes
Were you infected by any file-infecting virus recently?
Not to my knowledge and Avast gives my PC a clean sheet :o
it couldn’t be something like:
QAZ-Trojan
?
Maybe a hijackthis log might help:
www.lurkhere.com → nicefiles
install, then click scan, then save log; post the lofgfile contents here 
No, its not QAZ, no trace of it.
Thanks for the suggestion about hijackthis, I’ll run it and let you know …
OK it’s attached
Cheers
Wow,
that IS a lot of stuff in your startup …!
too much for a first glance
→
Install/Update/scan and fix with
ad-aware & spybot
Run Onlinescanners from www.trendmicro.com and www.ravantivirus.com (use IE with ActiveX enabled; pause avast’s shield(s) for this)
remove found malware according to the respective virusinfos or via VGREP (see below)
then make a new hijackthis-log
if there’s anything malicious or useless in there
→ Remove/fix those
example:
C:\windows\system32\msurl32.exe
F1 - win.ini: run=c:\windows\system32\msurl32.exe
O4 - HKLM..\Run: [Msurl32] c:\windows\system32\msurl32.exe
O4 - HKCU..\Run: [Msurl32] c:\windows\system32\msurl32.exe
http://www.f-secure.com/v-descs/syscenter.shtml
btw have your tried a repair of avast ?
Also suspicious/needs checking, if you don’t know what it is/does:
O16 - DPF: {0FF3E97F-433D-11D2-B31A-00A0C9B135DB} (CoDetectDigitalRiver Class) - h**p://ebot.digitalriver.com/v2.0-doc/dlwizard/wizard3.0.4.3.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - h**p://www.tynebridgewebcam.co.uk/camimages/AxisCamControl.ocx
O16 - DPF: {95844941-7934-4693-92D9-8202EA7B20ED} - h**p://www.stumbleupon.com/stumble.cab
O16 - DPF: {A0F0D762-D1DE-43AF-B70E-D87864743EB3} (NSLiteUpdateCtrl Class) - hp://217.145.76.16/nslite/nslite.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - hp://66.230.143.209/loader/dploader.cab
O16 - DPF: {FFFF0021-0002-101A-A3C9-08002B2F49FB} - h**p://www.7adpower.com/dialer/A091AEM.exe
KAV says:
nslite.cab infected by “TrojanDownloader.Win32.Agent.p” Virus.
dploader.cab infected by “TrojanDownloader.Win32.Small.dg” Virus.
Found It!
No virus (though going through the hijack log was interesting, I run AdAware and Spybot regularly but the nslite and dploader downloaders - now removed -seem to have been missed by them).
Anyway, the answer, found after a bit of googling, was (…drum roll …) a file named PROGRAM in the root of my D drive. Renamed it and rebooted and magically all is now OK again. txt files can be opened normally and Avast runs normally.
I’d love to know what dropped that in there though …
Thanks to everyone who helped.