TechSpot

Help Bad Image Error

By Invisablegeek
Nov 20, 2006
  1. Symptoms- Every time a program is opened an error prompts me reading
    The application or DLL C:\system32\nopdb.dll is not a valid windows image. "Bad Image"

    Also my pc is freezing after I am inactive on it for 10+ minutes.

    I have attatched the hjt log and AGV Log.

    Thanks in advance.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    Your system is riddled with nasties and you`re not running any antivirus or firewall software.

    Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


    Regards Howard :wave: :wave:


    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Ok I have followed all the steps at Trojan Pakes and other nasties preliminary removal instructions.

    I ran a new hjtlog which i have attached and an AGV Anti-Spyware Log.

    Symptoms- Computer has yet to freeze up, but I will update that tomorrow morning after it is on for a few hours inactive. And the Bad Image error is still active when opening any program.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Download the Pocket killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    PartyGaming
    PartyPoker
    MyWebSearch
    Symantec
    LiveUpdate

    Close control panel.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Automatic LiveUpdate Scheduler

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ALCXMNTR.EXE
    mfcoice.exe
    mwsoemon.exe
    RunApp.exe
    pcs_0006.exe
    ALUSchedulerSvc.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - [SABInprocServer32] (file missing)

    O2 - BHO: (no name) - {070B19EA-D60F-FC8C-2CF7-D2F88BE19F9B} - blank (file missing)

    O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - blank (file missing)

    O2 - BHO: (no name) - {42339945-01DD-0257-83A6-72B59EBCD89F} - (no file)

    O2 - BHO: (no name) - {497979E6-EA08-CE8C-2D44-ECEBAA3482CB} - blank (file missing)

    O2 - BHO: (no name) - {CE8ACDAF-513B-00B9-6EE5-26807D305398} - (no file)

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

    O4 - HKLM\..\Run: [5F4f39P] mfcoice.exe

    O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S

    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBIniti alSetup1.0.0.15.cab

    O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia.com/install/pcs_0006.exe

    O20 - AppInit_DLLs: c:\windows\system32\nopdb.dll c:\windows\system32\nopdb.dll ntvdm.dll

    O20 - Winlogon Notify: gebcc - C:\WINDOWS\

    O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Symantec<Delete the entire folder.
    C:\Program Files\PartyGaming<Delete the entire folder.
    C:\PROGRA~1\MYWEBS~1<Delete the entire folder.
    mfcoice.exe<Search your system for this file and delete all instances of it.
    ALCXMNTR.EXE<Search your system for this file and delete all instances of it.

    Delete all files in AVG Antispyware quarantine.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    These are the filepaths you need to enter into killbox.

    c:\windows\system32\nopdb.dll
    c:\windows\system32\ntvdm.dll

    Once your system has rebooted, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :)

    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Symptoms- None, running like a dream.

    I have attatched the HJT Log to this reply. There was only one thing I was unable to do when following the above instructions and it was to locate this file C:\PROGRA~1\MYWEBS~1

    I also would like to ask you what I need to do to prevent this from occurring again. I now have Zonealarm as a firewall. I have AGV Spyware and Virus Protection, I have Spysweeper.

    Thank you so much for your help.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    mdt2_32.exe
    PowerReg Scheduler V3.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>;microweb

    R3 - URLSearchHook: (no name) - {A99F5DEA-C479-9FAB-7C0C-B8896C55329F} - (no file)

    O4 - HKCU\..\Run: [KovpRVj2V] mdt2_32.exe

    O4 - Startup: PowerReg Scheduler V3.exe

    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk972DTUS

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    PowerReg Scheduler V3.exe<Search your system for this file and delete all instances of it.
    mdt2_32.exe<Search your system for this file and delete all instances of it.

    C:\program files\Mywebsearch<delete the entire folder(if there).

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Ok I followed the above directions to the t. But I was unable to locate mdt2_32.exe and C:\program files\Mywebsearch.

    Symptoms-None what so ever. Running perfectly.

    I attached the newest hjt log file.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    From normal mode, do the following.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Viewpoint
    Viewpoint Manager

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ViewMgr.exe

    Close task manager.


    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://as.starware.com/dp/search?x=wKX1ILEOi UdWpSlz2q9Dzn13Emww/YwIjsqjZBnROHb4 skP/prj56OeIKxNsqvbmzcJX5BX1VFYoUm1Y9OidIuDHOU/pAL+2dNLFrEo2XhVOj00hRZj5VWoz64T7 jI/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    R3 - URLSearchHook: (no name) - {42339945-01DD-0257-83A6-72B59EBCD89F} - (no file)

    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)

    O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Viewpoint<Delete the entire folder.

    Reboot your computer and post what should hopefully be a final HJT log.

    Regards Howard:)

    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Ok, attached new hjt log file.

    Symptoms- None.
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Very well done. Your HJT log is now clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    Edit: the only programme you need besides you antivirus and firewall are the following.

    Ad-Aware se personal/SS&D/Spyware Blaster/SpySweeper/Ccleaner.

    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Thanks Howard, and is it best to run them everyday, every week....
     
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    I`d say about once every week or two, or if you become suspicious.

    A lot depends on how paranoid you are :p

    Regards Howard :)

    This thread is for the use of Invisablegeek only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. Invisablegeek

    Invisablegeek TS Rookie Topic Starter

    Ok...haha.


    Thanks again. I was about to restore everything, and that was looking fun...
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.