Bad Image Errors with everything

[ajconte0718]

I have never seen these type of errors before, and as soon as I noticed them on my friends computer I had told him to allow me to troubleshoot it. So here I am a day later confused to the point of giving up. I have ran so many scans of his computer files and registry using a slew of software I trust and use at work (Best Buy). Although the first round of scans found spyware/malware and two viruses and his computer is preforming better it still recieves two bad image errors with every process. ANY process, NO exceptions. So I ran a HJT scan and attached the file.

Edit: By the way, it's a Vista OS and I have already tried to sfc /scannow and repair windows. The exact error is,

Title Bar: "process - Bad Image"
Error Message: globalroot\systemroot\system32\UACjmowvbqvcisxsod.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.

The error is always the same.

 

[touch]

Hello

It´s a rootkit you´ve got there,

I´ll therefore suggest you run the steps in this guide:
8-step Viruses/Spyware/Malware Preliminary Removal Instructions

Post attached log´s from:

Malwarebyte
Superantispyware
Hijackthis

In your next reply

 

[ajconte0718]

I did everything I could in the 8 step thread and two of the programs "stopped working" before they even fully loaded so I can't get logs for them. I tried uninstalling, reinstalling and restarting atleast five times.

Attached is a recent HJT log. It's the only log I can get.

 

[touch]

Ok. We´ll try combofix -

Please download combofix here ->
ComboFix
Before Saving it to Desktop, please rename it to 123.com to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.
Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall.
It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after
scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post

 

[ajconte0718]

I tried doing as you said in the previous post and it failed. As soon as I double clicked on the app (renamed 123.com) I recieved error after error. It went on for three mins before I decided to restart to stop it. The program didn't run because of the errors.

 

[touch]

Ok.

Please download DDS: http://download.bleepingcomputer.com/sUBs/dds.scr
to your Desktop and doubleclick on DDs.scr to run it. If your security software includes script blocking features, please disable these before you run this utility. When the scan has finished, two logs will open.
Copy and paste both reports in this topic.
The logs will be reasonably large so you may have to divide them into sections and make several posts to post them.

 

[ajconte0718]

Before I tried your new solution I went back to combo fix. I sat through all of the errors, closing them as the popped up. After about a hundred or so errors a cmd came up and began running the application. I sat through all of it and at the end it gave me a log file. It seems the errors are gone because of restart I got none.

 

[touch]

Sounds good

Open notepad and copy/paste the text in the quotebox below into it:
Name the file as CFScript
and Save it on the desktop

Killall::
Snapshot::
File::
c:\windows\SBD3474F4.tmp
Folder::
C:\temp
C:\123.com
c:\program files\LimeWire
c:\program files\BearShare Applications
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc7koj0eats}]

CFScriptB.gif
Once saved, refering to the picture above, drag CFScript.txt into ComboFix.exe.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall