[Lantic]

Hello,
recently i've been trying to fix my mothers computers and everytime i try to do open an application i.e. FireFox, Taskmanager i get " Bad Image Error". this also happens when windows starts up.. I've read other topics about " Bad Image Error" and everything else has been about one file thats corrupt but cant really find anything about Everything being corrupted. my mother doesnt have her XP disc anymore because she didnt think it was useful anymore.. So.. i'm trying to fix this myself instead of running out to the store to get another copy.

I downloaded Hijack this and did a scan..

Hijackthis File :

Logfile of HijackThis v1.99.1
Scan saved at 10:40:49 AM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\BICKLE~1\APPLIC~1\RACLE~1\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.c...a...sa=N&tab=wn
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [gczegwpA] C:\WINDOWS\gczegwpA.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Hboc] "C:\DOCUME~1\BICKLE~1\APPLIC~1\RACLE~1\dllhost.exe" -vt yazb
O4 - HKCU\..\Run: [Upy] C:\WINDOWS\system32\??stem32\s?ool32.exe
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadc...FreeInstall.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.driveclea...leanerstart.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} - http://apps.deskwizz.../ax/adwerkz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122914736056
O17 - HKLM\System\CCS\Services\Tcpip\..\{33941228-768A-4996-8E1F-94F51921D4EE}: NameServer = 208.67.222.222,208.67.220.220,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{33941228-768A-4996-8E1F-94F51921D4EE}: NameServer = 208.67.222.222,208.67.220.220,192.168.1.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O21 - SSODL: E404Helper - {0e44fb54-3430-49e2-a4bf-ab1b9dc62c0b} - e404d.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Qmlja2xlcg\command.exe (file missing)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\gczegwp.exe


Hope this helps.. I'll start running other programs you guys have talked about..

- thanks

[Advertisements]

so theres no file or any other info related to this messagewhen this message appears?try this for now....Go to Start/Run, and type:

SFC /SCANNOW ( you may have to hit "r" hindreds of times to complete this

[krmooo]

so theres no file or any other info related to this messagewhen this message appears?try this for now....Go to Start/Run, and type:

SFC /SCANNOW ( you may have to hit "r" hindreds of times to complete this

[Lantic]

Hello,
Thanks for replying

When typed SFC /SCANNOW i get "BAD IMAGE ERROR" wowfx.dll is not a valid Windows Image. Also the Command Prompt opens and closes immediately.

[krmooo]

well wowfx.dll is part of a malware package but all may not be lost. try this first before the potential wiping the hard drive.I would start your search by looking in"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

It's probably registered itself there. If so, boot into Safe Mode, remove the key, then delete the file.

Also look in the usual registry places, plus:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

where such an bogus file would give Windows this type of error. If you don't want to wipe or work excessively manually then boot to a Recovery Console (any XP disk will do), delete the file, restart Windows and download your favorite AV program...and let it pick up any stray pieces.

[Lantic]

As of right now im searching the registry for wowfx.dll in safemode and it appears that i file isnt in there.. when the "Bad Image Error " appears it gives the directory to Windows> System32>wowfx.dll.

* btw* i also get the error in safe mode when starting windows*

[krmooo]

still researching

[krmooo]

have you found this file? perhaps someone with alot more know how can help you here.if i were you and the amount of time i just spent looking for an answer. the answer would be, wipe the whole thing out and start over. im saying a fresh instalation. sorry i couldnt be of much help

Edited by krmooo, 23 January 2008 - 04:51 PM.

[Lantic]

Im still looking for it.. it only comes up in the System 32 folder.. not sure if i want to delete that.. thank you so much for your help. Its appericated. Im still going to give it a try before i reinstall. maybe i can get some more help from others.

[Lantic]

Soo.. from looking at the hijackthis log.. i decided to play russian roulette and delete the wowfx.dll file in the System 32 folder and everything seems to be fixed at the moment.. *Cross fingers*

[Ztruker]

You have definately got some malware infections on that computer. Deleting wowfix.dll is only the tip of the iceberg. Read through this area:

Cleanup Your System.

This takes care of the many of the problems without further action by the Malware Gurus on this site.

If this doesn't do it, post a HijackThis log here:

Malware Removal Forum.

Make sure you read the You Must Read This Before Posting A Hijackthis Log article before posting.

Please be patient, this is a very active anti-malware site and the malware removal experts are extremely busy. It can take 1 to 3 days for them to get to you.

If you do not get a response in 3 days, Please post in the Waiting room.

Follow the directions in the pinned post called Has it been 3 days. That should get you some attention soon.