|
Answer» Hi Have rescently encountered a Bad Image error and on further investigation found some more. Any help would be greatly APPRECIATED.
1. Unable to print from any application through LPT1, tried to print test page in properties and given error message HelpCtr.exe - Bad Image "C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchshell.dll" not valid windows image . When press ok new error box appears "marscore.dll" not found.
2. Attempt to access System Information and given same error messages as in #1
3. Unable to access Help (F1) in any IE type pages, i.e Control Panel, same error messages as in #1. IE7 had same problem but has mysterious resolved itself.
4. Unable to access System Restore given error rstrui.exe - Bad Image "C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchshell.dll"
5. Unable to access Wireless Network Wizard in Control Panel given error message rundll32.exe - Bad Image "C:\WINDOWS\system32\wzcdlg.dll". Only found this one as about to go wireless.
system; AMD Athlon XP 3200+ 2.2 ghz 1gb ram XP Pro v2002 SP3
Logs attached and thanks in advance.....
[attachment deleted by admin]Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.
Link #1 Link #2
**Note: It is important that it is saved directly to your Desktop
Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
Double click combofix.exe & follow the prompts. When finished ComboFix will produce a log for you. Post the ComboFix log in your next reply.
Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.
Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.
If you have problems with ComboFix usage, see How to use ComboFixHi
Thanks for quick response, have d/l Combofox and run, log attached
[attachment deleted by admin] - Click START then RUN
- Now type Combofix /u in the runbox
- Make sure there's a space between Combofix and /u
- Then hit Enter.
- The above procedure will:
- Delete the following:
- ComboFix and its associated files and folders.
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Set a new, clean Restore Point.
----------
Download ATF Cleaner by Atribune to your Desktop.
Alternate download link
Note: Vista users must use Run As Administrator
- Under Main: Select Files to Delete choose: Select All.
- Click the Empty Selected button.
- If you use Firefox browser click Firefox at the top and choose: Select All
- Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
- If you use Opera browser click Opera at the top and choose: Select All
- Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
- Click Exit on the Main menu to close the program.
. Note that your system will run slower for a reboot or two after having used this tool so don't panic.
----------
Use the Kaspersky Lab Online Scanner
In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.
- Click on SCAN NOW
- Click Accept.
- The program will then begin downloading the latest definition files.
- Once the files have been downloaded locate the Scan Settings and have it scan My COMPUTER.
- The scan will take a while, so be patient and let it finish.
When the scan is done, in the Scan is complete window, any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report: Click on: Save Report As- Next, in the Save as prompt, Save in area, select: Desktop.
- In the File name area use KScan, or something similar.
- In Save as type: click the drop arrow and select: Text file [*.TXT]
- Then, click: Save
Copy and paste the Kaspersky Online Scanner Report in your next reply.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is ACCEPTED, reset to 100%.Hi
Have carried out all from last post, here is result and thanks for your time.
-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, March 29, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, March 29, 2009 19:18:29 Records in database: 1984838 --------------------------------------------------------------------------------
Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes
Scan area - My Computer: A:\ C:\ D:\ E:\ J:\
Scan statistics: Files scanned: 113202 Threat name: 2 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 03:50:55
File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B61733D.dllInfected: Trojan-Downloader.Win32.Zlob.atl1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4D63248EInfected: Trojan-Downloader.Win32.Zlob.atp1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54446DDA.dllInfected: Trojan-Downloader.Win32.Zlob.atl1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\57756E58.dllInfected: Trojan-Downloader.Win32.Zlob.atl1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5FBC5F3B.dllInfected: Trojan-Downloader.Win32.Zlob.atl1
The selected area was scanned. Empty ALL Norton/Symantec Quarantine files. GUIDE: Removing files from Norton AntiVirus Quarantine
How is the computer running now?Hi evilfantasy
Could not locate files in Norton Quarantine so removed manually, also rebooted, but problems still there. must admit PC seems to be running a little better after all the scans. I am gratefull for all your help, but unless you have any other ideas I guess a new install would be the only option. Great to know there are guys like you to help us lesser mortals.I don't think it is a malware issue. None of the files listed in the Bad Image error are malicious.
You could try running sfc /scannow.
Place your XP CD ROM drive and follow the instructions below:- Click on Start > Run and type sfc /scannow then press Enter (note the space between scf and /scannow)
- Let this run undisturbed until the window with the blue progress bar goes away
SFC - Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.Hi evilfantasy
Tried your last suggestion and completed scan. Unhappy to say that problems still exist. Would like to thank you for your time and effort in helping to resolve the problem it is most appreciated. I'm not sure what it could be...
|