Bad Image Error Message

[bop_01]

Hi,

a buddy's PC is infected with various trojans and malware. I ran the
latest
SpyBot which removed a lot of the infections however (file name) "Bad
Image"

(c:\winnt\system32\gehesusu.dll is not a valid Windows image. Please
check
this against your installation)

is still there. What should i do to finish cleaning up the infections?

Thanks,
Bob

 

[Randem]

You never stated what file had this error. Complete information would help
to answer the question correctly...

--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
http://www.rndem.com/installerproblems.html
http://www.randem.com/vistainstalls.html
http://www.financialtrainingservices.org

 

[Elmo]

Hi,

A buddy's PC is infected with various malware. I ran the latest
SpyBot which removed a lot of the infections, however '(file name) "Bad
Image"

(c:\winnt\system32\gehesusu.dll is not a valid Windows image. Please
check
this against your installation)'

is still there. What should I do to finish cleaning up the infections?

Thanks,
Bob

It's possible some malware was deleted by your a/v software, but the
reference to the file was not removed from the registry. The following
explains one way to remove the reference in the registry, but it won't
help with any other malware still lingering.

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file into the search pane. Click "Find Next", and
when located, delete the reference to the file. Press F3 to continue
the search.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

You could click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.

 

[Pennywise]

(c:\winnt\system32\gehesusu.dll is not a valid Windows image. Please
check
this against your installation)

gehesusu.dll shows nothing on google, consider it malware, move it,
rename it, delete it....

 

[chuckcar]

You never stated what file had this error. Complete information would
help to answer the question correctly...

He sure did:

SpyBot which removed a lot of the infections however (file name) "Bad

Image"

(c:\winnt\system32\gehesusu.dll is not a valid Windows image. Please
check
this against your installation)

It's always the top-posters...

 

[bop_01]

gehesusu.dll shows nothing on google, consider it malware, move it,
rename it, delete it....

I can't find it anywhere.

 

[bop_01]

He sure did:

 SpyBot which removed a lot of the infections however (file name) "Bad

Yes, I believe most, if not all, are valid Windows executables. I'll
verify it this week.

 

[Pennywise]

I can't find it anywhere.

Yes, it's fairly safe to say the file doesn't belong on your computer
if there is no mention of it with google.