Bad image error

[MrHatesVirus]

well ive been getting the terrifying bad image error lately and right before the symptons showed Windows Defender detected a trojan vundo something and supposedly removed it, ive tried many spy wares and still no luck

help would be most appreciated

 

[touch]

Hello

Please run the steps in this guide:

8-step Viruses/Spyware/Malware Preliminary Removal Instructions

Post attached log´s from:

Malwarebyte
Superantispyware
Hijackthis

In your next reply

 

[MrHatesVirus]

here are the logs, windows defender detects Trojan:VundoX32 something like that then the bad image errors about dll pop up then i get LuCallBackProxy.

 

[touch]

I´m not surprised you´ve got infected ->

P2P software/programs are a major contributor to your infections.

We reserve the right to withdraw our support:
If such programs are found in your logs
Should you not agree to their removal.
As they are normally set to bypass your Firewall and Anti-Virus software
Filesharing/P2P Programs serves as a constant threat to your computer

Uninstall:
C:\Program Files\BearShare
C:\Program Files\iMesh
C:\Program Files\Ares

You decide

Ir you remove them. Reboot, attach fresh hijackthis log

 

[MrHatesVirus]

im pretty sure i got all of that bad stuff out heres my logs

 

[touch]

Ok.

You have viewpoint on your computer ->

Viewpoint is considered foistware and is not needed on your computer.


Download and unzip to own folder on Desktop -
http://bellsouthpwp.net/p/r/prprogramsstudios/viewpointkiller.zip

Run ViewpointKiller.exe

Reboot.

Then please download Combofix:
http://subs.geekstogo.com/ComboFix.exe

And save to the desktop.


Open notepad and copy/paste the text in the quotebox below into it:
Name the file as CFScript
and Save it on the desktop

Killall::
Snapshot::
File::
C:\WINDOWS\system32\fahapera.dll
folder::
C:\Program Files\Ares

http://www.fromsej.saknet.dk/billeder/cfscript.gif

Once saved, refering to the picture above, drag CFScript.txt into ComboFix.exe, Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

 

[MrHatesVirus]

well the link to combofix doesnt work, 404 Error and when i try to download somewhere else its the same thing,

 

[touch]

Ok. Rightclick here-> https://www.techspot.com/downloads/5587-combofix.html

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Otherwise, try from safe mode with network

 

[MrHatesVirus]

its not a valid Win32 application =( i named it 456.exe

 

[MrHatesVirus]

oh and i tried running it in safe mode and it game me the choice to protect me from viruses but it can prevent it from working, so i ticked the bx for protection then it sayd an attachment is not working

 

[touch]

Ok. We´ll try this scanner then -

Download DDS and save it to your desktop from here http://download.bleepingcomputer.com/sUBs/dds.scr)
or here (http://www.forospyware.com/sUBs/dds)

And then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Attach DDS.txt back to your topic.

 

[MrHatesVirus]

umm ya, this is the problem, i got rid of bad image (hooray) with a system restore, but now spy sweeper is detecting virtumonde and suppposedly got quarentined and got rid of it but im getting ads for fake spysweeping technology,

it just never ends does it

 

[touch]

Where find Spysweeper virtumonde - Filename and path.

you were supposed to post attach DDS.txt back to your topic.