Bad image error messages

By xhollow
Sep 29, 2010
Post New Reply
  1. at login and every time i run a program i get an error message like this one when i run internet explorer...

    iexplorer.exe-Bad Image

    c:\windows\sytem32\irmonq.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your sytem administrator or the software vendor for support.

    once i exit out of the message the program runs fine?? I also have to exit like 10 to 15 of these at login, so annoying. Please Help

    running vista 32 bit
  2. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    This looks like it could be malware...
    There is very little out there on your file: irmonq.dll
    There is a bad site that has irmonq.html as part of the URL.

    Do all of your errors concern the same file?

    If you do not know what this file is, then...
    You might use Windows Explorer and find the file, then right click on it.
    On the version tab, click each option, and write down the information that is available.
    Then report it here. - If we can establish what this file is, that is one thing...
    if we can't I would suggest a trip to the Virus and Malware Removal forum.

    Let me know, and I can offer some pointers before you go there.
    Can't help you with removing malware, but I can help you get started on the right foot with our team.
  3. xhollow

    xhollow TS Rookie Topic Starter

    Here is the file properties as requested.



    Type of file: Application Extension (.DLL)
    Opens With: Unknown Application
    Location: C:\Windows\System32
    Size: 20 bytes (20 bytes)
    Size on disk: 4.00 KB (4,096 bytes)
    Created: Tuesday, June 8th 2010


    Group or Usernames: System,Admins, Users
    Permissions for system:
    - Full controll: Allow
    - Modify: Allow
    - Read and Execute: Allow
    - Read: Allow
    - Write: Allow
    - Special Permissions: None


    File Description: None
    Type: Application Extension
    File Version: None
    Product Name: None
    Product Version: None
    Copyright: None
    Size: 20 bytes
    Date modified: 6/8/10
    Language: None
  4. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    Though I have an idea what it could be, and wish to rule that idea out....
    I am still suspicious of this file,
    • Reporting "size" to be that much smaller than "size on disk" is unusual.
    • And an unsigned & undated driver is always suspicious.
    Please tell me as much as you can about your computer. (I see you are running 32bit Vista.)
    • your hardware (desktop/laptop, drives, memory, ports, etc... and specifically if it has an infrared port.)
    • your running software, especially
      • the software that loads at boot (including any security software) and
      • the software in use when you typically experience the error messages (or is it with any and every program?).
    Have you had any BSOD events? Are you set up to generate minidumps?
    If so, you will find them in C:\windows\minidump
    If you have files there, please zip the FIVE (up to 5) most recent files and attach the zip to your next post. If there is only one, please just attach it, (don't bother zipping just one file).

    Also, (Courtesy rev-Olie)
    Please download VEW and save it to your Desktop:

    Double-click VEW.exe to run.
    • Under Select log to query, select
      • Application
      • System
    • Under Select type to list, select:
      • Critical (Vista only, NOT for XP)
      • Error
    • Click the radio button for Number of events
      • Type 20 in the 1 to 20 box
    • Then click the Run button.
    • Notepad will open with the output log.
    • In Notepad, click Edit -> Select all
    • Then press Edit -> Copy
    • Press Ctrl+V on your keyboard to paste the log as text in your next reply.

    If you wish, you could skip this, and go straight to the Virus and Malware removal forum.
    I think that is where we are headed anyway.
  5. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    I agree that file looks suspicious :suspiciou

    But just an added note: That difference between Size and Size on Disk is both OK and expected.
    > Windows saves files on disk in sectors
    > Each sector is 4,096 bytes
    > So expect any file with actual size less then 4,096 bytes to still require 1 sector for storage = 4,096 bytes on disk

    You should be able to verify that by creating a 1 byte file using Notepad. You should see Size = 1byte, Size on Disk = 4,096bytes

    In any case, you're in good hands with B00kwrym :)
  6. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    Thanks for confirming my suspicions about it.
    And thanks for reminding me... My gut was simply that it was just misreporting itself....
    I was asleep at the switch there! :haha:

    A question - how many drivers have you see that are only 20 bytes?
    Smallest I have on my xp system is 330 bytes.
  7. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    Yep. I was also pretty curious (suspicious?) of that DLL and with a size of only 20 bytes

    1. B00kWyrm and I both think it wise to be cautious. You should visit the experts in the malware forum to get checked out. Start here for Virus/Malware removal Instructions Attach your logs for review in Malware removal forum

    2. And also (just out of curiousity) if you have the chance... I can't help but wonder if C:\WINDOWS\SYSTEM32\IRMONQ.DLL might actually contain an ASCII text command.

    Could you try using Notepad (Programs->Accessories-Notepad) to open it? Does Notepad reveal an intelligible text string?
  8. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    @ LookingAround - Re: Opening with Text Editor
    I was going to suggest the same thing... ;)
    (Or Right Click on it in Explorer and then and "Open With" -> Notepad.)
  9. xhollow

    xhollow TS Rookie Topic Starter

    well i appreciate all the advice, out of frustration with this item i simply opted to remove the irmonq file which seems to have rid me of my problem
  10. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    Removing that one file may have eliminated a symptom,
    But if that file was malware (as LookingAround and I suspect)
    Then it is very likely you are still infected, and you are at risk.

    Some malware today is specifically designed to watch for log-in information and then to "phone home", allowing someone access to your personal information... including banking accounts and the like.

    Please do not ignore the serious nature of this possibility.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...