Inactive Google redirect & .exe file bad image pop-ups

[sunday972]

Bad Image

Whenever I log into the system the "Bad Image Pop-up" begins to pop-up as an example below:

Services.exe - Bad Image
The application or DLL C:\WINDOWS\system32\napipsec32.dll is not a valid Windows image. Please check this against your installation diskette.

After allowing the system to load the bad image begins to pop-up continuously one after the other after closing each message with the same message except different .exe .

Here's some of what I've wrote down -

lsass.exe
bcmwltry.exe
userininit.exe
Explorer.exe
wltray.exe
clistart.exe
vptray.exe
nerocheck.exe
pdvdserv.exe
readersc.exe
AdobeARM.exe

etc...

However, all have the same error message of "The application or DLL C:\WINDOWS\system32\napipsec32.dll is not a valid Windows image. Please check this against your installation diskette. "

(Also, if I didn't exit or close the message nothing loads).

---------------------------------
The time I logged on was 7:10pm on Saturday July 16, 2011.
---------------------------------

Here is the MBAM Full Scan for both drives [C:\] & [D:\]

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7060

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

7/16/2011 8:10:57 PM
mbam-log-2011-07-16 (20-10-57).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 218864
Time elapsed: 32 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Qoobox\quarantine\C\WINDOWS\system32\fe9bb8e90c5a2cb441a11d3379094fbf\b\binm1.vir (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\system32\fe9bb8e90c5a2cb441a11d3379094fbf\b\bint1.vir (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{75d9072c-a095-49c6-bdcc-0473088235de}\RP1\A0003055.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{75d9072c-a095-49c6-bdcc-0473088235de}\RP3\A0004207.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.

 

[Bobbye]

"The application or DLL C:\WINDOWS\system32\napipsec32.dll is not a valid Windows image.

The 'bad image' part of the is First: it's should be napipsec.dll without the 32 and Second: It is located in the Windows System folder, not in the System 32 folder.

This file is part of Microsoft® Windows® Operating System. . It’s a system and hidden file. Napipsec.dll is usually located in the %SYSTEM% folder and its usual size is 30,208 bytes. The particulars:

Microsoft CorporationProcess: NAP IPSec Enforcement Client
Part Of: Microsoft® Windows® Operating System
Common path(s): %SYSTEM%subfolder in %WINDOWS%Keywords(s): systemFilesize(s): 30,208 bytes, 38,912 bytes, 34,304 bytes

I tried replacing it be it didn't fix the problem. If you have the Windows CD, it would be wise to run the System File Checker and let it replace the file causing the bad image. There are good direction to run this tool in Vista here: http://vistasupport.mvps.org/system_file_checker.htm
Note: Do no click on the Repair Now option at the top. Do it manually. It is not difficult and hopefully, when the correct image is restores, the Services will run correctly.