dencorso Posted June 19, 2011 Share Posted June 19, 2011 On a sidenote, I found that AVG reported a handful of "corrupted" Win98SE system files, most of them are from 98SSE2ME (Millenium). They are not infected, of course. But AVG recognised that these are not original Win98SE files so put them in quarantine This issue only happens with AVG 10 (aka AVG 2011), AFAIK, which, of course, doesn't run on Win 9x/ME. However, for those of us who multiboot, it's possible to scan the Win 9x/ME boot partition with AVG 2011 when we're running Win XP (or any other NT-family OS), and then AVG 2011 will pop the now familiar message: "D:\WINDOWS\SYSTEM\filename.ext"; "Corrupted executable file"; "Potentially dangerous object"and send the file packing to the Virus Vault. In my case, there were the 10 files it didn't like: BATMETER.DLL; CALC.EXE; HID.DLL; HIDSERV.EXE; POWRPROF.DLL; QCUT.DLL; REGEDIT.EXE; ROUTE.EXE; TWAIN_32.DLL; TWUNK_32.EXE. I was furious, at first, because there is no way to whitelist things AVG considers a "Corrupted executable file"; "Potentially dangerous object", as oposed to "Potentially Unwanted Programs (PUPs), for which AVG has a whitelist. Moreover, Jolaes is right, all those files are from 98SE2ME, but except for REGEDIT.EXE, they're plain vanilla Win ME files, straight from the Win ME installation CD, and signed by MS, so how come AVG 2011 insists they're corrupt? But the fact is AVG 2011 *is right*... well, sort of: it all depends on what one considers to be a corrupt file, and the NT-family OSes do have stricter requirements about PE headers than Win 9x/ME! For more details read this. Furthermore, if one tries to run that CALC.EXE in Win XP, it refuses to run and throws the "<Drive>:\<Path>\<File> is not a valid Win32 application." error message! So, here we have a set of files that really are corrupt when seen by Win XP, but which are OK in Win 9x/ME! Well, one solution to this issue is to downgrade these files back to their Win 98SE conterparts, which aren't detected as corrupt in any OS...But this is not an acceptable solution in my book. So I decided to find a way to keep the updated files...... and here is it: download PE Explorer Free 30-Day Trial version from this page, install it (I did it on XP, but they say it also runs on 9x/ME...), load each one of the problem files, one at a time, and let PE Explorer create corrected versions of them. It'll fail to correct only one file, this being the special REGEDIT.EXE, modified by Tihiy (about which more later). Once you're satisfied that all other files are correct versions working as usual, you may uninstal PE Explorer, as it won't be needed anymore, and substitute the problem files by those files corrected by PE Explorer. Please notice that MDGx offers updated versions of TWAIN_32.DLL and TWUNK_32.EXE, so those two files might just be updated to their newer versions (which aren't detected as corrupt files).Now, the only remaining problem file is the special REGEDIT.EXE, which PE Explorer isn't able to correct. This one I've corrected by hand, and included here as a patch pattern. In order to use the enclosed patch pattern you need to grab the original REGEDIT.EXE v. 188.8.131.5200 from inside WIN_17.CAB from Win ME's original distribution CD, and rename it REGEDIT.ME. Then download the freeware command-line utils.zip, from KanastaCorp, grab inside it just PATCH.EXE and drop it into the \%windir%\command\ folder. Then download the attached file containing REGEDIT.PAT. Now create a temporary folder, say, C:\TEMP\PATCH and put REGEDIT.ME and REGEDIT.PAT in it. Then open a DOS box, go to C:\TEMP\PATCH and, from there run the following command:PATCH -p REGEDIT.ME REGEDIT.PAT REGEDIT.EXEA new REGEDIT.EXE will be created, and it will be v. 184.108.40.20601. This file is a modified version of Tihiy's hybrid REGEDIT.EXE, which isn't detected as a corrupt file.After you're satisfied it's working OK, it's time to substitute the version from 98SE2ME by this one PATCH.EXE has just created. HTH.BTW, the corrected CALC.EXE now runs OK under Win XP, in case you want to test it.regedit_patch_pattern.7z Link to comment Share on other sites More sharing options...
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!Register a new account
Already have an account? Sign in here.Sign In Now