Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion GroupsWindows VistaWindows XPWindows MeWindows 98Windows 95Virtual PCInternet ExplorerOutlook ExpressWindows MediaSecurity
Related Topics
MS Server ProductsMS OfficePC HardwareMore Topics ...

Windows Forum / Windows 95 / March 2004

Tip: Looking for answers? Try searching our database.

Program will not run unless I change the name

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
ZugZug - 06 Mar 2004 23:21 GMT
We have a stand alone exe that we use to update Windows 95 machines
with the latest version of a home-grown application.  This program has
worked fine for 4 years now on a couple of hundred PCs...but last week
I found one PC that could not launch the program (it was working fine
for years...then all of a sudden stopped).

I have worked with Windows 95 for many years...but I haven't seen a
problem like this before.  When you click on the program and hour
glass comes up for about a second and disappears.  Checking the
background processes shows that it is not running.  I figured the file
was corrupted...so I replaced it with the current version...tried to
launch...same results.  Grabbed a file from another user that is
working...same results.  I decided to create a debugger version of the
program that logs all of the steps.  When I launched it on the PC it
worked perfectly...updated the software and ran.  The file that
wouldn't run was called "c2k_update.exe" my debugger was called
"c2k_update_debug.exe".  By shear luck I renamed the old file that
didn't work to "c2k_update_old.exe"...launched the file and it worked
perfectly.  I found that any executable named "c2k_update.exe" would
not launch on the PC.  Name it something else...it worked fine.

I thought it may be a McAfee problem but I could not find a block list
anywhere.  I disabled McAfee and tried "c2k_update.exe" and it still
would not launch.

Does anyone have any clue as to what could cause something like this?

One other note is that the very first thing my debugger program does
is splash a message box saying it have launched...when I run as
"c2k_update.exe" the message box doesn't even pop up.

Thanks for any help,
Ryan
Alan Edwards - 07 Mar 2004 00:52 GMT
No real idea but a couple of vague thoughts:

1. While it is certainly not a standard reserved name like CON, PRN
etc. is it  possible you have a CD device name of that in Config.sys?

2. Have a look in the Registry in case there is an incorrect entry.
It should be under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

3. Search the Registry for that name and report back.

...Alan

Signature

Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.win95.general.discussion, zugzug21us@yahoo.com


>We have a stand alone exe that we use to update Windows 95 machines
>with the latest version of a home-grown application.  This program has
[quoted text clipped - 29 lines]
>Thanks for any help,
>Ryan
ZugZug - 08 Mar 2004 23:12 GMT
Thank you both for the suggestions.  I had more of a chance to sit
down and look at the issue today.  I found it was being caused by a
worm running on the PC.  I should have looked at that first...but the
whole renaming of the file and launching sucessfully threw me off.

It was the W32.Beagle.J@mm worm.  Why it would attack our
c2k_update.exe application is unknown.  I found that it I re-named an
unrelated executable to that name (such as SQLPlus31.exe) it would
attempt to launch the program...and close almost immediately after.
Symantec and McAfee made no meantion of anything like this...so it may
be a different variant of the same worm/virus.

The suggestion to run the program in safemode got me thinking that it
could be another app conflicting in the background.  That's when I saw
"irun4" running...killed it...and c2k_update.exe worked fine.

Again...thanks both for the suggestions.

P.S. - I did check the registry for odd programs on Friday...but I
only looked in HKEY_LOCAL_MACHINE...RUN/RUNSERVICES.  I was unaware
that Windows 95 allowed someone to launch a program from
HKEY_CURRENT_USER...RUN/etc. using Windows 95.
Learn something new everyday!!!
Jeff Richards - 09 Mar 2004 06:46 GMT
Symantec lists this virus as attacking a very long list of EXE files with
names like update and upgrade, so perhaps it terminates any application that
includes the text 'update' in the filename.
Signature

Jeff Richards
MS MVP W95/W98

> Thank you both for the suggestions.  I had more of a chance to sit
> down and look at the issue today.  I found it was being caused by a
[quoted text clipped - 19 lines]
> HKEY_CURRENT_USER...RUN/etc. using Windows 95.
> Learn something new everyday!!!
Bart - 07 Mar 2004 15:18 GMT
Op 6 Mar 2004 15:21:01 -0800 schreef zugzug21us@yahoo.com (ZugZug):

[snip]
>The file that
>wouldn't run was called "c2k_update.exe" my debugger was called
>"c2k_update_debug.exe".  By shear luck I renamed the old file that
>didn't work to "c2k_update_old.exe"...launched the file and it worked
>perfectly.  I found that any executable named "c2k_update.exe" would
>not launch on the PC.  Name it something else...it worked fine.

Just curious, does it (c2k_update.exe) run in safe mode ?

Bart

Signature

Bart Broersma
broersma.juda_ANTISPAM_@tiscali.nl
(ff _ANTISPAM_ wegpoetsen uit dit adres natuurlijk)

ZugZug - 11 Mar 2004 04:33 GMT
Sorry Bart...I never tried before removing the worm.  My guess is that
it would have because the worm launches from Run in
LOC_USER/Windows/etc...  I believe that safe mode doesn't launch that
area of the registry.

I never tried to launch in safe mode because even if it did launch...I
would never know if the program would have completed because one of
the first things it does is to check for a Novell mapping (which
wouldn't have been there).  If the mapping doesn't exists it halts the
program and warns the user.

If I see the worm again I'll check (probability of the worm popping up
again is high in our user community...people will be to unbelievable
lengths to click on an E-mail file that they know about...hehe).

> Op 6 Mar 2004 15:21:01 -0800 schreef zugzug21us@yahoo.com (ZugZug):
>
[quoted text clipped - 9 lines]
>
> Bart
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.