Bad Image error messages

[souperman]

I'm being besieged by error messages that name a file followed by.exe and the
words " Bad Image". The message states, "The application or DLL
C:\WINDOWS\system32\wowfx.dll is not a valid Windows image. Please check this
against your installation diskette." How can I get rid of these? I'm using
XP Professional.

 

[Leonard Grey]

Malicious software ("malware") is installed on your computer.

Make sure that your anti-malware software is running, then download the
latest signatures and run a full scan.

If you don't have comprehensive anti-malware software, that's like
driving a car without seats belts or air bags. Either way, you're
eventually going to get hammered. Install comprehensive anti-malware
software and learn how to use its features. A 'comprehensive' solution
scans for all types of malicious software in the background, on demand
and on schedule.

For now try scanning your system with /several/ of the better online
scanners, such as:
Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
Panda ActiveScan (http://www.pandasoftware.com/activescan)

Download HijackThis from www.trendsecure.com. Run it, save a log, and
post the log at one of the many sites that support HJT, such as
spywarewarrior.com, bleepingcomputer.com, and temerc.com -- but not
here. Within a day, sometimes within an hour, you'll have one-on-one
step-by-step advice from a security expert on cleaning up any
infestations—or you'll have a clean bill of health from the volunteer
expert.

Even the best detection and removal software can't fix every malware
infection. If none of the above remove the infection, you may want to
show the computer to a professional.

 

[nass]

I'm being besieged by error messages that name a file followed by.exe and the
words " Bad Image". The message states, "The application or DLL
C:\WINDOWS\system32\wowfx.dll is not a valid Windows image. Please check this
against your installation diskette." How can I get rid of these? I'm using
XP Professional.

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/builds/downloading-slim

You can download this tool "AutoRuns for Windows"
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
And remove the entry from here:

Locate this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = look in
the right pane/window and remove the entry for it
" C:\WINDOWS\system32\wowfx.dll"

Run disk cleanup and defrag in safe mode. Then run this command:
sfc /scannow
HTH.
nass

 

[souperman]

Malicious software ("malware") is installed on your computer.

Make sure that your anti-malware software is running, then download the
latest signatures and run a full scan.

If you don't have comprehensive anti-malware software, that's like
driving a car without seats belts or air bags. Either way, you're
eventually going to get hammered. Install comprehensive anti-malware
software and learn how to use its features. A 'comprehensive' solution
scans for all types of malicious software in the background, on demand
and on schedule.

For now try scanning your system with /several/ of the better online
scanners, such as:
Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
Panda ActiveScan (http://www.pandasoftware.com/activescan)

Download HijackThis from www.trendsecure.com. Run it, save a log, and
post the log at one of the many sites that support HJT, such as
spywarewarrior.com, bleepingcomputer.com, and temerc.com -- but not
here. Within a day, sometimes within an hour, you'll have one-on-one
step-by-step advice from a security expert on cleaning up any
infestations—or you'll have a clean bill of health from the volunteer
expert.

Even the best detection and removal software can't fix every malware
infection. If none of the above remove the infection, you may want to
show the computer to a professional.

Thanks for taking the time to respond. I do have Norton Security on my
computer, and it didn't detect a problem when it did a full scan last Friday.
I was going to use the kaspersky scan that you suggested, but they wanted me
to install a java update that I couldn't get to download. I ended up trying
a fix in the post that followed yours, "Autoruns for Windows", and I was able
to get rid of the problem by finding the wowfx.dll folder in system32 and
deleting it. Thanks again for the information.

 

[souperman]

I'm being besieged by error messages that name a file followed by.exe and the
words " Bad Image". The message states, "The application or DLL
C:\WINDOWS\system32\wowfx.dll is not a valid Windows image. Please check this
against your installation diskette." How can I get rid of these? I'm using
XP Professional.

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/builds/downloading-slim

You can download this tool "AutoRuns for Windows"
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
And remove the entry from here:

Locate this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = look in
the right pane/window and remove the entry for it
" C:\WINDOWS\system32\wowfx.dll"

Run disk cleanup and defrag in safe mode. Then run this command:
sfc /scannow
HTH.
nass

Thanks very much for your help. I used your "Autoruns for Windows"
suggestion and was able to delete wowfx.dll. Problem solved. Thanks for
your other suggestions as well. So much good information.

 

[Leonard Grey]

I think you'll find it takes much more than removing a library file to
eradicate malware.

 

[nass]

Thanks very much for your help. I used your "Autoruns for Windows"
suggestion and was able to delete wowfx.dll. Problem solved. Thanks for
your other suggestions as well. So much good information.

Glad to help and the Thanks goes to " Mark Russinovich and Bryce Cogswell "
they the ones created this tool and lots of other useful tools you can find
here:
http://technet.microsoft.com/en-us/sysinternals/default.aspx

I agree with " Leonard " that you need to do some work to make sure your
machine clean from malware and further viral infection may still lurking in
the background!
Don't forget Norton is an Antivirus programs not an Anti-malware program.
Download one of the Anti-maware or both and update their definitions and run
a Full scan on your system.
HTH,
nass