Bad image error messages

[xhollow]

at login and every time i run a program i get an error message like this one when i run internet explorer...

iexplorer.exe-Bad Image

c:\windows\sytem32\irmonq.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your sytem administrator or the software vendor for support.

once i exit out of the message the program runs fine?? I also have to exit like 10 to 15 of these at login, so annoying. Please Help

running vista 32 bit

 

[B00kWyrm]

This looks like it could be malware...
There is very little out there on your file: irmonq.dll
There is a bad site that has irmonq.html as part of the URL.

Do all of your errors concern the same file?

If you do not know what this file is, then...
You might use Windows Explorer and find the file, then right click on it.
On the version tab, click each option, and write down the information that is available.
Then report it here. - If we can establish what this file is, that is one thing...
if we can't I would suggest a trip to the Virus and Malware Removal forum.

Let me know, and I can offer some pointers before you go there.
Can't help you with removing malware, but I can help you get started on the right foot with our team.

 

[xhollow]

Here is the file properties as requested.





IRMONQ.DLL

General

Type of file: Application Extension (.DLL)
Opens With: Unknown Application
Location: C:\Windows\System32
Size: 20 bytes (20 bytes)
Size on disk: 4.00 KB (4,096 bytes)
Created: Tuesday, June 8th 2010

Security

Group or Usernames: System,Admins, Users
Permissions for system:
- Full controll: Allow
- Modify: Allow
- Read and Execute: Allow
- Read: Allow
- Write: Allow
- Special Permissions: None

Details

File Description: None
Type: Application Extension
File Version: None
Product Name: None
Product Version: None
Copyright: None
Size: 20 bytes
Date modified: 6/8/10
Language: None

 

[B00kWyrm]

Though I have an idea what it could be, and wish to rule that idea out....
I am still suspicious of this file,

• Reporting "size" to be that much smaller than "size on disk" is unusual.
• And an unsigned & undated driver is always suspicious.

Please tell me as much as you can about your computer. (I see you are running 32bit Vista.)

• your hardware (desktop/laptop, drives, memory, ports, etc... and specifically if it has an infrared port.)
• your running software, especially
  • the software that loads at boot (including any security software) and
  • the software in use when you typically experience the error messages (or is it with any and every program?).

Have you had any BSOD events? Are you set up to generate minidumps?
If so, you will find them in C:\windows\minidump
If you have files there, please zip the FIVE (up to 5) most recent files and attach the zip to your next post. If there is only one, please just attach it, (don't bother zipping just one file).

Also, (Courtesy rev-Olie)
Please download VEW and save it to your Desktop:

Double-click VEW.exe to run.

• Under Select log to query, select
  • Application
  • System
• Under Select type to list, select:
  • Critical (Vista only, NOT for XP)
  • Error
• Click the radio button for Number of events
  • Type 20 in the 1 to 20 box
• Then click the Run button.
• Notepad will open with the output log.
• In Notepad, click Edit -> Select all
• Then press Edit -> Copy
• Press Ctrl+V on your keyboard to paste the log as text in your next reply.

If you wish, you could skip this, and go straight to the Virus and Malware removal forum.
I think that is where we are headed anyway.

 

[LookinAround]

I am still suspicious of this file,

• Reporting "size" to be that much smaller than "size on disk" is unusual.
• And an unsigned & undated driver is always suspicious.

I agree that file looks suspicious :suspiciou

But just an added note: That difference between Size and Size on Disk is both OK and expected.
> Windows saves files on disk in sectors
> Each sector is 4,096 bytes
> So expect any file with actual size less then 4,096 bytes to still require 1 sector for storage = 4,096 bytes on disk

You should be able to verify that by creating a 1 byte file using Notepad. You should see Size = 1byte, Size on Disk = 4,096bytes

In any case, you're in good hands with B00kwrym

 

[B00kWyrm]

@LookinAround
Thanks for confirming my suspicions about it.
And thanks for reminding me... My gut was simply that it was just misreporting itself....
I was asleep at the switch there! :haha:

A question - how many drivers have you see that are only 20 bytes?
Smallest I have on my xp system is 330 bytes.

 

[LookinAround]

<snip>
A question - how many drivers have you see that are only 20 bytes?
Smallest I have on my xp system is 330 bytes.

Yep. I was also pretty curious (suspicious?) of that DLL and with a size of only 20 bytes

@xhollow
1. B00kWyrm and I both think it wise to be cautious. You should visit the experts in the malware forum to get checked out. Start here for Virus/Malware removal Instructions Attach your logs for review in Malware removal forum

2. And also (just out of curiousity) if you have the chance... I can't help but wonder if C:\WINDOWS\SYSTEM32\IRMONQ.DLL might actually contain an ASCII text command.

Could you try using Notepad (Programs->Accessories-Notepad) to open it? Does Notepad reveal an intelligible text string?

 

[B00kWyrm]

@ LookingAround - Re: Opening with Text Editor
I was going to suggest the same thing...
(Or Right Click on it in Explorer and then and "Open With" -> Notepad.)

 

[xhollow]

well i appreciate all the advice, out of frustration with this item i simply opted to remove the irmonq file which seems to have rid me of my problem

 

[B00kWyrm]

Removing that one file may have eliminated a symptom,
But if that file was malware (as LookingAround and I suspect)
Then it is very likely you are still infected, and you are at risk.

Some malware today is specifically designed to watch for log-in information and then to "phone home", allowing someone access to your personal information... including banking accounts and the like.

Please do not ignore the serious nature of this possibility.