I am running Win7/Pro x64.
On 4/16/16 I downloaded the x64 version of IrfanView (4.42) from CNET and began having problems. I engaged in a long dialog with Bhikkhu Pesala.
Today I reinstalled both versions from Bhikkhu's website. I first tried running the uninstall files from Windows Explorer and discovered that the program folders were still in their expected places. I reinstalled again and used Control Panel. The program files were still in their places. For the x64 version when I tried again I got an error message that allowed me to delete the entry in Control Panel and the Programs Folder no longer has a reference to IrfanView. There are no more entries in Control Panel.
The x32 version is still there with all its parts in Windows Explorer. When I try to run the uninstall file I find there it tells me that it is from an 'unknown source.' This sounds suspicious to me. I viewed the file in ZTreeWin and 'gathered and copied' the last few lines of code that have 'identifiable information.' Does this look OK? Should I look elsewhere in the file?
Here is the captured code:
006D44 _úúú_úúú_úúú_úúúúúúúúúúúúúúú_úúúúúúúúúúúúúúúúúúúúú úúp%úúúúúúúú úúúúúúúúúúúúúúúúúúúú(úúúúúúú~%úúúú4úúúVúSú_úVúEúRú SúIúOúNú_úIúNúFúOúúúúúúúúúúúúúúúúú
006DD8 úúúúúúúúúúúú?úúúúúúúúúúúúúúúúúúúúúúúúúúú(úúúúúSútú rúiúnúgúFúiúlúeúIúnúfúoúúúúúúúúú0úcú0ú7ú0ú4úbú0úúú úúúúúúCúoúmúmúeúnútúsúúúRúúúúúCúoúmúpúaúnúyúNúaú
006E6C múeúúúúúIúrúfúaúnú úSúkúiúlújúaúnú,ú úIúrúfúaúnúVúiúeúwúúúúúTúúúúúFúiúlúeúDúeúsúcúrúiúp útúiúoúnúúúúúIúrúfúaúnúVúiúeúwú úUúnúiúnúsútúaúlúlúeúrúúú6úúú
006F00 úúFúiúlúeúVúeúrúsúiúoúnúúúúú1ú,ú ú2ú,ú ú5ú,ú ú0úúúúú:úúúúúIúnútúeúrúnúaúlúNúaúmúeúúúiúvú_úuúnúi únúsútúaúlúlúúúúúzú+úúúLúeúgúaúlúCúoúpúyúrúiúgúhút úúú
006F94 Cúoúpúyúrúiúgúhútú úúú ú2ú0ú1ú5ú úbúyú úIúrúfúaúnú úSúkúiúlújúaúnú,ú úAúuúsútúrúiúaúúúúú(úúúúúLúeúgúaúlúTúrúaúdúeúmúaúr úkúsúúúúúJúúúúúOúrúiúgúiúnúaú
007028 lúFúiúlúeúnúaúmúeúúúiúvú_úuúnúiúnúsútúaúlúlú.úeúxú eúúúúú úúúúúPúrúiúvúaútúeúBúuúiúlúdúúúLúúúúúPúrúoúdúuúcút úNúaúmúeúúúúúIúrúfúaúnúVúiúeúwú úUúnúiúnú
0070BC sútúaúlúlúeúrúúú:úúúúúPúrúoúdúuúcútúVúeúrúsúiúoúnú úú1ú,ú ú2ú,ú ú5ú,ú ú0úúúúú úúúúúSúpúeúcúiúaúlúBúuúiúlúdúúúDúúúúúVúaúrúFúiúlúe úIúnúfúoúúúúú$úúúúúTú
007150 rúaúnúsúlúaútúiúoúnúúúúúúúúú`)úú<?xml version="1.0" encoding="UTF-8" standalone="yes"?>úú<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifest
0071E4 Version="1.0">úú<assemblyIdentityúú version="1.0.0.0"úú processorArchitecture="*"úú name="IrfanView"úú type="win32"úú/>úú<description>Ir
007278 fanView - Universal picture viewer</description>úú<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">úú <security>úú <requestedPrivileges>úú
00730C <requestedExecutionLevel level="highestAvailable"/>úú </requestedPrivileges>úú </security>úú</trustInfo>úú<dependency>úú <depend
0073A0 entAssembly>úú <assemblyIdentityúú type="win32"úú name="Microsoft.Windows.Common-Controls"úú version="6.0.0.
007434 0"úú processorArchitecture="*"úú publicKeyToken="6595b64144ccf1df"úú language="*"úú />úú </dependentAssem
0074C8 bly>úú</dependency>úú<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">úú <asmv3:windowsSettingsúú xmlns="http://schemas.
00755C microsoft.com/SMI/2005/WindowsSettings">úú <dpiAware>true</dpiAware>úú </asmv3:windowsSettings>úú </asmv3:application>úú</assembly>úúúúúúúú
0075F0 úúúúúúúúú^úúd^úúúúúúúúúúúúúúú^úú_^úúúúúúúúúúúúúúú^ úú^^úúúúúúúúúúúúúúú^úú_^úúúúúúúúúúúúúúú^úú~^úúúúúú úúúúúúúúúúúúúúúúú^úúú^úúú^úúú_úúú_úú$_úúúúúú2_úú
007684 úúúú@_úúúúúúN_úúúúúú\_úúúúúúKERNEL32.DLLúADVAPI32. dllúole32.dllúSHELL32.dllúUSER32.dllúúLoadLibraryA úúGetProcAddressúúVirtualProtectúúVirtualAllocúú
007718 VirtualFreeúúúExitProcessúúúRegCloseKeyúúúCoInitia lizeúúSHGetMallocúúúMessageBoxAúúúúúúúúúúúúúúúúúúú úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú
0077AC úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú
I've attached a Screen Dump of my History limited to 'irfan' and relevant dates. I believe all the links are what they purport to be. Could I have gotten something unwanted from CNET? I don't find anything bad with malwarebytes and/or Avast scans.
What should I do next?
thanks,
baumgrenze
On 4/16/16 I downloaded the x64 version of IrfanView (4.42) from CNET and began having problems. I engaged in a long dialog with Bhikkhu Pesala.
Today I reinstalled both versions from Bhikkhu's website. I first tried running the uninstall files from Windows Explorer and discovered that the program folders were still in their expected places. I reinstalled again and used Control Panel. The program files were still in their places. For the x64 version when I tried again I got an error message that allowed me to delete the entry in Control Panel and the Programs Folder no longer has a reference to IrfanView. There are no more entries in Control Panel.
The x32 version is still there with all its parts in Windows Explorer. When I try to run the uninstall file I find there it tells me that it is from an 'unknown source.' This sounds suspicious to me. I viewed the file in ZTreeWin and 'gathered and copied' the last few lines of code that have 'identifiable information.' Does this look OK? Should I look elsewhere in the file?
Here is the captured code:
006D44 _úúú_úúú_úúú_úúúúúúúúúúúúúúú_úúúúúúúúúúúúúúúúúúúúú úúp%úúúúúúúú úúúúúúúúúúúúúúúúúúúú(úúúúúúú~%úúúú4úúúVúSú_úVúEúRú SúIúOúNú_úIúNúFúOúúúúúúúúúúúúúúúúú
006DD8 úúúúúúúúúúúú?úúúúúúúúúúúúúúúúúúúúúúúúúúú(úúúúúSútú rúiúnúgúFúiúlúeúIúnúfúoúúúúúúúúú0úcú0ú7ú0ú4úbú0úúú úúúúúúCúoúmúmúeúnútúsúúúRúúúúúCúoúmúpúaúnúyúNúaú
006E6C múeúúúúúIúrúfúaúnú úSúkúiúlújúaúnú,ú úIúrúfúaúnúVúiúeúwúúúúúTúúúúúFúiúlúeúDúeúsúcúrúiúp útúiúoúnúúúúúIúrúfúaúnúVúiúeúwú úUúnúiúnúsútúaúlúlúeúrúúú6úúú
006F00 úúFúiúlúeúVúeúrúsúiúoúnúúúúú1ú,ú ú2ú,ú ú5ú,ú ú0úúúúú:úúúúúIúnútúeúrúnúaúlúNúaúmúeúúúiúvú_úuúnúi únúsútúaúlúlúúúúúzú+úúúLúeúgúaúlúCúoúpúyúrúiúgúhút úúú
006F94 Cúoúpúyúrúiúgúhútú úúú ú2ú0ú1ú5ú úbúyú úIúrúfúaúnú úSúkúiúlújúaúnú,ú úAúuúsútúrúiúaúúúúú(úúúúúLúeúgúaúlúTúrúaúdúeúmúaúr úkúsúúúúúJúúúúúOúrúiúgúiúnúaú
007028 lúFúiúlúeúnúaúmúeúúúiúvú_úuúnúiúnúsútúaúlúlú.úeúxú eúúúúú úúúúúPúrúiúvúaútúeúBúuúiúlúdúúúLúúúúúPúrúoúdúuúcút úNúaúmúeúúúúúIúrúfúaúnúVúiúeúwú úUúnúiúnú
0070BC sútúaúlúlúeúrúúú:úúúúúPúrúoúdúuúcútúVúeúrúsúiúoúnú úú1ú,ú ú2ú,ú ú5ú,ú ú0úúúúú úúúúúSúpúeúcúiúaúlúBúuúiúlúdúúúDúúúúúVúaúrúFúiúlúe úIúnúfúoúúúúú$úúúúúTú
007150 rúaúnúsúlúaútúiúoúnúúúúúúúúú`)úú<?xml version="1.0" encoding="UTF-8" standalone="yes"?>úú<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifest
0071E4 Version="1.0">úú<assemblyIdentityúú version="1.0.0.0"úú processorArchitecture="*"úú name="IrfanView"úú type="win32"úú/>úú<description>Ir
007278 fanView - Universal picture viewer</description>úú<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">úú <security>úú <requestedPrivileges>úú
00730C <requestedExecutionLevel level="highestAvailable"/>úú </requestedPrivileges>úú </security>úú</trustInfo>úú<dependency>úú <depend
0073A0 entAssembly>úú <assemblyIdentityúú type="win32"úú name="Microsoft.Windows.Common-Controls"úú version="6.0.0.
007434 0"úú processorArchitecture="*"úú publicKeyToken="6595b64144ccf1df"úú language="*"úú />úú </dependentAssem
0074C8 bly>úú</dependency>úú<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">úú <asmv3:windowsSettingsúú xmlns="http://schemas.
00755C microsoft.com/SMI/2005/WindowsSettings">úú <dpiAware>true</dpiAware>úú </asmv3:windowsSettings>úú </asmv3:application>úú</assembly>úúúúúúúú
0075F0 úúúúúúúúú^úúd^úúúúúúúúúúúúúúú^úú_^úúúúúúúúúúúúúúú^ úú^^úúúúúúúúúúúúúúú^úú_^úúúúúúúúúúúúúúú^úú~^úúúúúú úúúúúúúúúúúúúúúúú^úúú^úúú^úúú_úúú_úú$_úúúúúú2_úú
007684 úúúú@_úúúúúúN_úúúúúú\_úúúúúúKERNEL32.DLLúADVAPI32. dllúole32.dllúSHELL32.dllúUSER32.dllúúLoadLibraryA úúGetProcAddressúúVirtualProtectúúVirtualAllocúú
007718 VirtualFreeúúúExitProcessúúúRegCloseKeyúúúCoInitia lizeúúSHGetMallocúúúMessageBoxAúúúúúúúúúúúúúúúúúúú úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú
0077AC úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú úúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúúú
I've attached a Screen Dump of my History limited to 'irfan' and relevant dates. I believe all the links are what they purport to be. Could I have gotten something unwanted from CNET? I don't find anything bad with malwarebytes and/or Avast scans.
What should I do next?
thanks,
baumgrenze
Comment