(E-Mail Removed) wrote:
> Hi,
>
> A buddy's PC is infected with various malware. I ran the latest
> SpyBot which removed a lot of the infections, however '(file name) "Bad
> Image"
>
> (c:\winnt\system32\gehesusu.dll is not a valid Windows image. Please
> check
> this against your installation)'
>
> is still there. What should I do to finish cleaning up the infections?
>
> Thanks,
> Bob
It's possible some malware was deleted by your a/v software, but the
reference to the file was not removed from the registry. The following
explains one way to remove the reference in the registry, but it won't
help with any other malware still lingering.
Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file into the search pane. Click "Find Next", and
when located, delete the reference to the file. Press F3 to continue
the search.
You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.
You could click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.
--
Joe =o)
Similar Threads
