Prev: Installing RAID drives
Next: BSOD Vista 64
From: Kevin on 8 Dec 2006 15:57
When I logon to Win Server 2003 Enterprise (64 bit) using an account in the
local administrators group I get the following error: The program or feature
"\??\C:\DOCUME~1\user~1\LOCALS~1\Temp\~RomDmp1\RomDump.com" cannot start or
run due to incompatibility with 64-bit versions of Windows. Please contact
the software vendor to ask if a 64-bit Windows compatible version is
available. I click OK to the message and I get virtually the same error
again, but the path is "...\Temp\R_4194B\RomDump.com." While the error msg
is displayed, I can browse to the path listed and the file is there, but its
properties leave nothing identifiable. As soon as I clear the msgbox the
file goes away. Once the messages are cleared the machine behaves normally.

Hardware is HP DL385 Packaged Cluster. Google search only yields info about
a game called Act of War, but that definitely does not exist in my
environment!

Any ideas on where this file is coming from or how to get it to go away?

Thanks...
From: NuTCrAcKeR on 8 Dec 2006 17:11

"Kevin" <Kevin(a)discussions.microsoft.com> wrote in message
news:FF7540AB-8515-4B3A-A218-F3C3D0D97A0D(a)microsoft.com...
> When I logon to Win Server 2003 Enterprise (64 bit) using an account in
> the
> local administrators group I get the following error: The program or
> feature
> "\??\C:\DOCUME~1\user~1\LOCALS~1\Temp\~RomDmp1\RomDump.com" cannot start
> or
> run due to incompatibility with 64-bit versions of Windows. Please
> contact
> the software vendor to ask if a 64-bit Windows compatible version is
> available. I click OK to the message and I get virtually the same error
> again, but the path is "...\Temp\R_4194B\RomDump.com." While the error
> msg
> is displayed, I can browse to the path listed and the file is there, but
> its
> properties leave nothing identifiable. As soon as I clear the msgbox the
> file goes away. Once the messages are cleared the machine behaves
> normally.
>
> Hardware is HP DL385 Packaged Cluster. Google search only yields info
> about
> a game called Act of War, but that definitely does not exist in my
> environment!
>
> Any ideas on where this file is coming from or how to get it to go away?
>
> Thanks...

sounds like it could be a virus, or other nasty to me.

from what i can tell reading the AoW posts, its a 16 bit program, so yah ...
it wouldnt run on your box anyway.

But still, you didnt install the game on the server, but if you are logging
into a domain, it sounds like its actually digging that file reference out
of your profile information.

try digging through the registry to see if its called out anywhere, and try
to determine where it could be coming from.

- NuTs


From: Tony Sperling on 8 Dec 2006 20:32
Try and google for 'romdump.com' - to me, this looks like a nasty relative
to something called NewDotNet - that one is searchable too - the only
indication of a way to get rid of it was an uninstall utility they provided
(no way I was trusting them with anything) in the end I had to wipe the
partition and re-install.

My AV didn't catch it - Windows Defender found it but couldn't remove it -
be carefull how you treat this!

For the longest time it was just sitting there but then my Internet
connection started being really weird and I plowed through every location on
the disk and the registry and deleted every trace of it by hand, but it kept
coming back and eventually closed the connection completely.

Apart from that it seemed harmless, the pain is getting rid of it!


Tony. . .



 | 
Pages: 1
Prev: Installing RAID drives
Next: BSOD Vista 64