Runtime Error (at 434:1049). Could not call proc

[mauricev]

I have a 32-bit XP SP3 computer here (yes, they actually still exist) and it’s acting all weird. The WiseCare installer doesn’t run. Window complains falsely that it’s not a valid Win32 application. When I try to run the BIOS updater for this computer (a Dell Optiplex 745), Window claims a “Program Payload Error”. When I try to run the installer for CCleaner, it starts and then quits. Finally, when I try to run Malwarebytes (legacy version), it gives the error in the title, so it’s crossed my mind that the system could be infected. Tweaking.com did, however, run fine.

I’m attaching a FRST scan log.

 

FRST.txt

[AdvancedSetup]

Hello @mauricev

Can we please get the Addition.txt log from Farbar as well?

 

[mauricev]

Sorry, I wasn’t aware there was a second file, attaching now.

Addition.txt

[AdvancedSetup]

I'm not seeing any infection. It could simply be due to age and lack of updated certificates, etc.

Please try the following.

 

Please visit this web page and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

 

Thanks @mauricev

 

[mauricev]

ComboFix.exe extracts itself and just as it's about to run, it says it's expired. It offers to run in "reduced functionality" mode and then promptly quits and deletes itself after I click Yes.

[AdvancedSetup]

Yes, that's what I was afraid of. It is no longer actively being updated anymore.

Please try the following and see if this works out better.

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[mauricev]

Fixlog.txt attached.

Fixlog.txt

[AdvancedSetup]

How is the computer running now?

Did that clean up make any difference?

 

[mauricev]

It made no difference. 

[AdvancedSetup]

Okay. The computer does not show any signs of being infected.

Not sure how to help you at this point as tools, and methods for diagnostic more and more no longer work on that version of Windows.

Maybe an older version of the Microsoft Process Monitor may help you to track it down.

 

[mauricev]

OK, thank you for all your help.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you