also @ TechSpot: Adobe Creative Cloud apps now available; Photoshop CC includes new features

"Bad image" dialog box error for multiple EXEs >>

Discussion in 'Virus and Malware Removal' started by tym, Nov 29, 2010.

Page 2 of 2

  1. Broni Malware Annihilator Posts: 40,077   +187

    Good :)

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (including SP3)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
    Broni, Nov 30, 2010
    #21

  2. tym Newcomer, in training Posts: 22

    Should the items found by ESET be deleted/cleaned, or are those false positives?

    OTL restore point made and log below. Working on clean-up now. The problems noted in my first post have recurred, though I do notice occasional "pauses" of a few seconds when using Firefox during which the comp is unresponsive. Not sure if that's a separate issue or just due to my older hardware.

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Tim
    ->Temp folder emptied: 376825 bytes
    ->Temporary Internet Files folder emptied: 77895 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 99311804 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 1925 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 26922 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 203 bytes

    Total Files Cleaned = 95.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    User: Tim
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.17.3 log created on 11302010_195149
    tym, Nov 30, 2010
    #22

  3. Broni Malware Annihilator Posts: 40,077   +187

    You quarantined those files, so you're fine.

    How is computer doing?
    Broni, Nov 30, 2010
    #23

  4. tym Newcomer, in training Posts: 22

    So far, so good. Just the pauses I mentioned.

    Currently installing some of the software you recommended and changing passwords (which was overdue, anyway).
    tym, Nov 30, 2010
    #24

  5. Broni Malware Annihilator Posts: 40,077   +187

    Tell me more about it.
    Broni, Nov 30, 2010
    #25

  6. tym Newcomer, in training Posts: 22

    It's similar to what another user described in another thread. In essence, when browsing the web, I notice that occasionally, the machine will become unresponsive for a few seconds at a time. I can move the mouse, but a click is not registered until the "pause" passes. When playing video (YouTube, for example), the playback will stop and then resume during this pause. I cannot recall immediately if audio stops too. In essence, the machine seems "sluggish" for those times. When running a stress test program for my video card (to check temps), I noticed that the temps would drop for a few seconds and then increase again, as if the program was not taxing the system for those few seconds, much like the "pauses" noticed.

    I'm not sure if this is truly malware or just a result of improper resource management. I've never found any virus/malware in my scans beyond what you helped me fix.


    Thanks for all the help so far! As for the quarantined programs, can they be cleaned or should I nuke them (no big loss if they're gone forever).
    tym, Nov 30, 2010
    #26
     

  7. Broni Malware Annihilator Posts: 40,077   +187

    You can nuke them.

    Does the problem happen in Firefox?

    If so, try this....

    Close Firefox. Go Start>All Programs>Mozilla Firefox, click on Mozilla Firefox (safe mode). Same issue?
    Broni, Dec 1, 2010
    #27

  8. tym Newcomer, in training Posts: 22

    Bad files nuked.

    As for the "pausing" issue, I notice it to a lesser extend when washing Flash video in FF (safe mode). With FF in normal mode, the issue is worse, but resolves with a restart of FF. I notice the issue also occurs when viewing Flash video in Chrome. I wonder if it's related to all the overhead from Flash.

    I currently have the up-to-date version of Flash (verified with Secunia PSI).
    tym, Dec 1, 2010
    #28

  9. Broni Malware Annihilator Posts: 40,077   +187

    Have you installed SP3 yet?
    Broni, Dec 1, 2010
    #29

  10. tym Newcomer, in training Posts: 22

    Not yet. I've been getting everything else ship-shape. I need the computer for work and an upcoming professional exam and so don't want to risk the same issues I had before with inoperative networking.

    What I can do is back up the system drive first and then try applying SP3. That way, I can roll back easily if there are problems.
    tym, Dec 1, 2010
    #30

  11. Broni Malware Annihilator Posts: 40,077   +187

    Please do so, install SP3 and we'll go from there.
    Broni, Dec 1, 2010
    #31

  12. tym Newcomer, in training Posts: 22

    SP3 installed and wireless connective issues returned, as dreaded.

    Windows "View Wireless Networks" shows no available connections. Machine will only connect upon initial startup or after stopping and restarting the Wireless Zero Configuration service. Power cycling the adapter or running NetworkStumbler breaks the connection. Windows repair utility fails to fix the connection.

    Prepped to return to SP2 if this issue cannot be resolved.

    EDIT: Wireless issue resolved by disabling some vendor-provided services.
    tym, Dec 1, 2010
    #32

  13. Broni Malware Annihilator Posts: 40,077   +187

    OK, so we don't have internet connection issue anymore, correct?

    As for the Flash issue.....

    In this forum, we make sure, your computer is free of malware and your computer is clean :)
    Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
    You'll get more attention.

    Good luck and stay safe :)
    Broni, Dec 1, 2010
    #33

  14. tym Newcomer, in training Posts: 22

    ^ Thank you very much for your help! I will monitor the Flash issue a bit more and post in the Windows section if it persists.

    :)
    tym, Dec 1, 2010
    #34

  15. Broni Malware Annihilator Posts: 40,077   +187

    Cool [IMG]
    Broni, Dec 1, 2010
    #35

  16. tym Newcomer, in training Posts: 22

    Now I am recieving some additional errors

    From the Event Viewer log

    The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80029C4A from line 4068 of d:\comxp_sp3\com\com1x\src\events\tier1\agent.cpp. Please contact Microsoft Product Support Services to report this error.

    The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070005 from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

    Plus a number of these

    Volume Shadow Copy Service error: Unexpected error GetVolumeNameForVolumeMountPointW( \\?\Volume{7872a072-3aa5-11dd-8138-0020e0cc5a86}\, ...). hr = 0x80070003.

    I had an issue with Explore.exe crashing, some services giving a "memory could not be 'written'" error, and finally a "mmc.exe failed to initialize" error that prompted me to reboot. No "Bad Image" errors noted.

    Want to rule out that this is viral before pursuing another path (possibly a DLL permissions error). Last Avira scan was clean, and ESET is currently running.

    Thanks!
    tym, Dec 4, 2010
    #36

  17. Broni Malware Annihilator Posts: 40,077   +187

    If your computer is working fine, there is no reason to look at Event Viewer.
    Every computer will have some errors listed there, even mine.
    Broni, Dec 4, 2010
    #37

  18. tym Newcomer, in training Posts: 22

    I checked because I was having some errors similar to those in my very first post in this thread. No "bad image" error, but the "memory can not be 'written'" error. ESET finds nothing, so my thought is that it's not virus-related.

    SP3 continues to hum away without incident, FYI. :)
    tym, Dec 4, 2010
    #38

  19. Broni Malware Annihilator Posts: 40,077   +187

    Your computer is definitely clean, so it must be something else.
    You may try to start new topic in Windows forum.
    Broni, Dec 4, 2010
    #39
Page 2 of 2
Topic Status:
Not open for further replies.

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...

Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.