Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Bad Image Errors


  • Please log in to reply

#1
Lantic

Lantic

    New Member

  • Member
  • Pip
  • 5 posts
Hello,
recently i've been trying to fix my mothers computers and everytime i try to do open an application i.e. FireFox, Taskmanager i get " Bad Image Error". this also happens when windows starts up.. I've read other topics about " Bad Image Error" and everything else has been about one file thats corrupt but cant really find anything about Everything being corrupted. my mother doesnt have her XP disc anymore because she didnt think it was useful anymore.. :) So.. i'm trying to fix this myself instead of running out to the store to get another copy.

I downloaded Hijack this and did a scan..

Hijackthis File :

Logfile of HijackThis v1.99.1
Scan saved at 10:40:49 AM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\BICKLE~1\APPLIC~1\RACLE~1\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.c...a...sa=N&tab=wn
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [gczegwpA] C:\WINDOWS\gczegwpA.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Hboc] "C:\DOCUME~1\BICKLE~1\APPLIC~1\RACLE~1\dllhost.exe" -vt yazb
O4 - HKCU\..\Run: [Upy] C:\WINDOWS\system32\??stem32\s?ool32.exe
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadc...FreeInstall.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.driveclea...leanerstart.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} - http://apps.deskwizz.../ax/adwerkz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122914736056
O17 - HKLM\System\CCS\Services\Tcpip\..\{33941228-768A-4996-8E1F-94F51921D4EE}: NameServer = 208.67.222.222,208.67.220.220,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{33941228-768A-4996-8E1F-94F51921D4EE}: NameServer = 208.67.222.222,208.67.220.220,192.168.1.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O21 - SSODL: E404Helper - {0e44fb54-3430-49e2-a4bf-ab1b9dc62c0b} - e404d.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Qmlja2xlcg\command.exe (file missing)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\gczegwp.exe


Hope this helps.. I'll start running other programs you guys have talked about..

- thanks
  • 0

Advertisements


#2
krmooo

krmooo

    Member

  • Member
  • PipPipPip
  • 472 posts
so theres no file or any other info related to this messagewhen this message appears?try this for now....Go to Start/Run, and type:

SFC /SCANNOW ( you may have to hit "r" hindreds of times to complete this
  • 0

#3
Lantic

Lantic

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hello,
Thanks for replying :)

When typed SFC /SCANNOW i get "BAD IMAGE ERROR" wowfx.dll is not a valid Windows Image. Also the Command Prompt opens and closes immediately.
  • 0

#4
krmooo

krmooo

    Member

  • Member
  • PipPipPip
  • 472 posts
well wowfx.dll is part of a malware package :) but all may not be lost. try this first before the potential wiping the hard drive.I would start your search by looking in"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

It's probably registered itself there. If so, boot into Safe Mode, remove the key, then delete the file.

Also look in the usual registry places, plus:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

where such an bogus file would give Windows this type of error. If you don't want to wipe or work excessively manually then boot to a Recovery Console (any XP disk will do), delete the file, restart Windows and download your favorite AV program...and let it pick up any stray pieces.
  • 0

#5
Lantic

Lantic

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
As of right now im searching the registry for wowfx.dll in safemode and it appears that i file isnt in there.. when the "Bad Image Error " appears it gives the directory to Windows> System32>wowfx.dll.

* btw* i also get the error in safe mode when starting windows*
  • 0

#6
krmooo

krmooo

    Member

  • Member
  • PipPipPip
  • 472 posts
still researching :)
  • 0

#7
krmooo

krmooo

    Member

  • Member
  • PipPipPip
  • 472 posts
have you found this file? perhaps someone with alot more know how can help you here.if i were you and the amount of time i just spent looking for an answer. the answer would be, wipe the whole thing out and start over. im saying a fresh instalation. sorry i couldnt be of much help

Edited by krmooo, 23 January 2008 - 04:51 PM.

  • 0

#8
Lantic

Lantic

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Im still looking for it.. it only comes up in the System 32 folder.. not sure if i want to delete that.. thank you so much for your help. Its appericated. Im still going to give it a try before i reinstall. maybe i can get some more help from others.
  • 0

#9
Lantic

Lantic

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Soo.. from looking at the hijackthis log.. i decided to play russian roulette and delete the wowfx.dll file in the System 32 folder and everything seems to be fixed at the moment.. *Cross fingers*
  • 0

#10
Ztruker

Ztruker

    Member 5k

  • Technician
  • 7,065 posts
You have definately got some malware infections on that computer. Deleting wowfix.dll is only the tip of the iceberg. Read through this area:

Cleanup Your System.

This takes care of the many of the problems without further action by the Malware Gurus on this site.

If this doesn't do it, post a HijackThis log here:

Malware Removal Forum.

Make sure you read the You Must Read This Before Posting A Hijackthis Log article before posting.

Please be patient, this is a very active anti-malware site and the malware removal experts are extremely busy. It can take 1 to 3 days for them to get to you.

If you do not get a response in 3 days, Please post in the Waiting room.

Follow the directions in the pinned post called Has it been 3 days. That should get you some attention soon.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP