We have a stand alone exe that we use to update Windows 95 machines
with the latest version of a home-grown application. This program has
worked fine for 4 years now on a couple of hundred PCs...but last week
I found one PC that could not launch the program (it was working fine
for years...then all of a sudden stopped).
I have worked with Windows 95 for many years...but I haven't seen a
problem like this before. When you click on the program and hour
glass comes up for about a second and disappears. Checking the
background processes shows that it is not running. I figured the file
was corrupted...so I replaced it with the current version...tried to
launch...same results. Grabbed a file from another user that is
working...same results. I decided to create a debugger version of the
program that logs all of the steps. When I launched it on the PC it
worked perfectly...updated the software and ran. The file that
wouldn't run was called "c2k_update.exe" my debugger was called
"c2k_update_debug.exe". By shear luck I renamed the old file that
didn't work to "c2k_update_old.exe"...launched the file and it worked
perfectly. I found that any executable named "c2k_update.exe" would
not launch on the PC. Name it something else...it worked fine.
I thought it may be a McAfee problem but I could not find a block list
anywhere. I disabled McAfee and tried "c2k_update.exe" and it still
would not launch.
Does anyone have any clue as to what could cause something like this?
One other note is that the very first thing my debugger program does
is splash a message box saying it have launched...when I run as
"c2k_update.exe" the message box doesn't even pop up.
Thanks for any help,
Ryan
Alan Edwards - 07 Mar 2004 00:52 GMT
No real idea but a couple of vague thoughts:
1. While it is certainly not a standard reserved name like CON, PRN
etc. is it possible you have a CD device name of that in Config.sys?
2. Have a look in the Registry in case there is an incorrect entry.
It should be under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
3. Search the Registry for that name and report back.
...Alan

Signature
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html
In microsoft.public.win95.general.discussion, zugzug21us@yahoo.com
>We have a stand alone exe that we use to update Windows 95 machines
>with the latest version of a home-grown application. This program has
[quoted text clipped - 29 lines]
>Thanks for any help,
>Ryan
ZugZug - 08 Mar 2004 23:12 GMT
Thank you both for the suggestions. I had more of a chance to sit
down and look at the issue today. I found it was being caused by a
worm running on the PC. I should have looked at that first...but the
whole renaming of the file and launching sucessfully threw me off.
It was the W32.Beagle.J@mm worm. Why it would attack our
c2k_update.exe application is unknown. I found that it I re-named an
unrelated executable to that name (such as SQLPlus31.exe) it would
attempt to launch the program...and close almost immediately after.
Symantec and McAfee made no meantion of anything like this...so it may
be a different variant of the same worm/virus.
The suggestion to run the program in safemode got me thinking that it
could be another app conflicting in the background. That's when I saw
"irun4" running...killed it...and c2k_update.exe worked fine.
Again...thanks both for the suggestions.
P.S. - I did check the registry for odd programs on Friday...but I
only looked in HKEY_LOCAL_MACHINE...RUN/RUNSERVICES. I was unaware
that Windows 95 allowed someone to launch a program from
HKEY_CURRENT_USER...RUN/etc. using Windows 95.
Learn something new everyday!!!
Jeff Richards - 09 Mar 2004 06:46 GMT
Symantec lists this virus as attacking a very long list of EXE files with
names like update and upgrade, so perhaps it terminates any application that
includes the text 'update' in the filename.

Signature
Jeff Richards
MS MVP W95/W98
> Thank you both for the suggestions. I had more of a chance to sit
> down and look at the issue today. I found it was being caused by a
[quoted text clipped - 19 lines]
> HKEY_CURRENT_USER...RUN/etc. using Windows 95.
> Learn something new everyday!!!
Bart - 07 Mar 2004 15:18 GMT
Op 6 Mar 2004 15:21:01 -0800 schreef zugzug21us@yahoo.com (ZugZug):
[snip]
>The file that
>wouldn't run was called "c2k_update.exe" my debugger was called
>"c2k_update_debug.exe". By shear luck I renamed the old file that
>didn't work to "c2k_update_old.exe"...launched the file and it worked
>perfectly. I found that any executable named "c2k_update.exe" would
>not launch on the PC. Name it something else...it worked fine.
Just curious, does it (c2k_update.exe) run in safe mode ?
Bart

Signature
Bart Broersma
broersma.juda_ANTISPAM_@tiscali.nl
(ff _ANTISPAM_ wegpoetsen uit dit adres natuurlijk)
ZugZug - 11 Mar 2004 04:33 GMT
Sorry Bart...I never tried before removing the worm. My guess is that
it would have because the worm launches from Run in
LOC_USER/Windows/etc... I believe that safe mode doesn't launch that
area of the registry.
I never tried to launch in safe mode because even if it did launch...I
would never know if the program would have completed because one of
the first things it does is to check for a Novell mapping (which
wouldn't have been there). If the mapping doesn't exists it halts the
program and warns the user.
If I see the worm again I'll check (probability of the worm popping up
again is high in our user community...people will be to unbelievable
lengths to click on an E-mail file that they know about...hehe).
> Op 6 Mar 2004 15:21:01 -0800 schreef zugzug21us@yahoo.com (ZugZug):
>
[quoted text clipped - 9 lines]
>
> Bart