Unsupported 16-bit Application error

Snow.bros

Hi all,

I keep getting the following error in my windows 7 enterprise 64-bit system:

"The program or feature "\??\C:\System\system.exe cannot start or run due to incompatibility with 64-bit versions of windows. Please contact vendor to ask if a 64-bit windows compatible version is available".

I cant tell where the location of this file so that I can remove it, I also tried to search this error but had no success.

have anyone came across this error, or can anyone point me into how I can get this resolved.

I appreciate any advice!

jaywalker

My first guess is malware. Run a hijackthis or malwarebytes scan to see if anything comes up.

Good luck.

Snow.bros

Thanks for the advice I will run a scan and see what happens.

Asif Dasl

Mmm something seriously wrong... Do a "sfc /scannow" and see what happens.

Snow.bros

I ran a threat scan with MalwareBytes, It never picked up any malware, however, during the scan I noticed that it scanned this path: C:\Windows\Temp\lpksetup for more than an hour, so I did a search on lpksetup.exe file, its default location is in -C:\Windows\System32\lpksetup but it appears in a TEMP folder, do you guys have any ideas?

@Asif Dasl the scan is still running I will let you know when it's done.

Asif Dasl

LPKSetup is the language pack files, do you have a lot of languages installed from Windows Update?

Snow.bros

I don't specifically manage my machine's windows updates, our windows update are managed by our monitoring software and I am not the one administering it but I think there's a lot of languages though.

jofas88

Is there a specific piece of software you are trying to run that's throwing this error, or is it presenting itself during bootup?

Snow.bros

The programs that I have recently installed were CCleaner and MalwareBytes both installed from legit websites, the error pops up once in a while when the machine is on through out the day.

Shdwmage

Check the reliability monitor. It may give you more information. Or at least present it in an easy enough fashion.

Snow.bros

Asif Dasl wrote: »

Do a "sfc /scannow" and see what happens.

I ran the scan and it never picked any errors. These scans take almost the whole day, I had forgotten it was still running when I ran the first one and shut down my machine when was knocking so had to run another one yesterday which took the whole day to complete.

@Shdwmage I checked the reliability monitor and I am getting some clues, an agent application service keeps stopping but I still need to verify if that might be the problem.

Asif Dasl

A "sfc /scannow" is usually very quick, so I am surprised it took all day. Any reason why the machine can't be wiped and reloaded?

EDIT - I say that because I think it's a compromised machine. Another alternative would be to start up RegEdit.exe and search the registry for System.exe which doesn't sound like a Windows system file and delete the registry key. It's a bit risky though. That's why I would wipe and reload just to be sure it's a safe machine.

jofas88

Asif Dasl wrote: »

"Any reason why the machine can't be wiped and reloaded?

My thoughts exactly. This could just be an issue with a bad image or install, might be more economical to just wipe and reload then spending hours to find root cause. I would recommend a clean install to rule out a bad image, maybe run some diags on the hd, ram etc to rule out faulty hardware before reloading OS.

Snow.bros

You have a point there but this is a desktop computer it's the main help-desk PC so if it's down we going to have down time on our services.

I am under the impression that it's a virus infection(it's funny malwarebybtes never picked up or my AV) because I am unable to start task manager, I have tried all the tricks Ctrl-Shft-Esc, started it normally from the windows start menu, also started it from the command line interface but it still won't start. Do you guys have any idea.

jofas88

I see you're in a tough situation, but if you are thinking this machine is infected it needs to be removed from your network asap as it is exploitable or currently being exploited and giving hackers possible access to other resources on your network. I would highly recommend removing and replacing with another machine asap. Creating some sort of contingency plan for this situation in the future would be a good idea. Trying to troubleshoot this issue while it is connected to the net is not a good idea when you suspect the machine is infected.

Snow.bros

I have found a solution to this, the error was produced by virus. This virus disguised itself as one of the windows system files.

Please follow instruction on this blog: Remove System.exe Virus, System.exe Virus Detail and Latest Instruction (I don't know if its just me but the commands in these instruction are not working or typed incorrectly)

The file was located in C:\System\system.exe, this location is hidden so you will have to go control panel to view hidden files.

Asif Dasl

Wipe and reload. No point taking a chance on it, if they remoted in they could do anything to the machine/network.

Snow.bros

I will format reload it when it's less busier.

10Linefigure

Do you mind my asking what AV software you are using? And what one you resolved it with?

Snow.bros

We use Bit defender and I use MalwareBytes for malware removal but non of the two picked anything up the virus so I had to remove it manually, there is link I posted above, I followed the instructions there.