Solved [Active] Bad image errors

[gonzy3]

Hello everyone im new here, I know that this is a common thread. actually I read a few posts regarding bad image errors and followed some of there 8 step removal instructions. I followed a specific techspot personnel(extechspot) kimsland. here is his thread https://www.techspot.com/vb/topic123842.html
I also managed to attached these logs. I still keep getting these errors. I dont really know what to do.
thank you for your kind consideration if you can provide any kind of assisstance.

 

[Broni]

Welcome aboard

Please, complete ALL steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

 

[gonzy3]

So far upon doing the steps, I encountered a little problem regarding the gmer program, I executed it in safe mode. I also used dds in safe mode. I don't know if it causes any problems with regards to the removal process.
remarkably, I haven't encountered any bad image pop-ups yet. yet.

 

[gonzy3]

by the way, thank you for helping me. it is of my utmost happiness for your participation on solving my problem

(pardon me for any wrong grammars)

 

[Broni]

Good news, but strange, because MBAM didn't find anything and both other tools are just scanners. They don't make any changes.

However, I'd like to see both DDS logs from normal mode.

Additionally...

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[Broni]

by the way, thank you for helping me. it is of my utmost happiness for your participation on solving my problem

You're very welcome

 

[gonzy3]

about combofix's instruction, is it ok to use in safe mode. my avast antivirus realtime protection logo at the taskbar is no more to be seen. i don't know how to disable its script blocking and antimalware properties.

a little update, up until now i still haven't encountered any pop ups. because one of the instructions was not to do any changes to the computer.

additional, i will try to disable the antivirus through the control panel.

 

[Broni]

Yes, you can use it in safe mode.

 

[gonzy3]

my bad. i dont know how to disable the antivirus even through the control panel.

 

[Broni]

Run Combofix from safe mode. Your AV program won't be active there.

 

[gonzy3]

that's odd. even though it is on safe mode. combofix still detects avg real time scanner. but i still continued combofix. just waiting for the logs.
im using my cousins computer.

 

[Broni]

That's fine. Don't worry about it.

I'm getting ready for bed, so I'll check on you tomorrow

 

[gonzy3]

The results are here. I hope it gives you a little clue of my computer's problem

 

[Broni]

I can see, you ran Combofix couple of times.
Navigate to C:\Qoobox folder and post ComboFix2.txt and ComboFix3.txt logs.

 

[gonzy3]

Here it is.

I hope a question, my windows explorer is having a few errors. like when I right click disk c. or some other things.

damn!!! I cant attach combofix2. it kept getting errors saying that I already posted it. what do I do?

 

[Broni]

my windows explorer is having a few errors. like when i right click disk c. or some other things.

When your computer is declared clean and you still have issues, let me know.

Rename combofix2.txt to combofix2a.txt

 

[gonzy3]

Upload Errors
ComboFix2a.txt:
You have already attached this file in thread : [Active] Bad image errors

I still keep getting errors. I tried almost any names.

I hope that this converted file will still be of use to you.

 

[Broni]

OK. We have to sort out couple of issues...
You're running AVG 7.5 as your AV program, which is not functional anymore.
While I'm checking your Combofix log...

1. Uninstall AVG, using AVG Remover: http://www.avg.com/us-en/download-tools
2. Download and install ONE of these:
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
After installation, run full scan.
3. Post full "bad image" error message, you're getting and let me know, when it happens.

 

[Broni]

I'm sorry. Scratch #2. I can see, you have Avast installed.

I still need you to do #1 and #3.

 

[Broni]

When done...

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

================================================================

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:



netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs



* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[gonzy3]

Here's the log for avg remover. I'm downloading my avast free.

 

[Broni]

You have Avast already installed. Unless you want to upgrade it from ver. 4 to ver. 5

 

[gonzy3]

is it ok to uninstall a few programs?

 

[Broni]

You sure can, but you may want to wait with that.

I still need:
1.

3. Post full "bad image" error message, you're getting and let me know, when it happens.

2. OTL logs.

 

[gonzy3]

what do you mean by bad image errors? you mean the pop ups? i encounter it once in a while but not very often?
and about the full scan, i am using avast pro full scan. but not boot scan? which is much better?
OTL logs? what does it mean? where do i get that?