2 replies to this topic

[ddbtkd456]

I get this C:\Windows\system32\wowfx.dll error

I get a message that states:

Error Boxs, reads:

rundll31.exe - Bad Image

"The Application or DLL C:\WINDOWS\system32\wowfx.dll is not a valid Windows image. Please check it against the installation diskette."

I get this error when I start up windows, or I start any program. Every now and then it will just pop up, can somebody please help me.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:35:55 PM, on 9/18/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bestyourmeds.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [\YUR111.exe] C:\Windows\system32\YUR111.exe
O4 - HKLM\..\Run: [\YUR112.exe] C:\Windows\system32\YUR112.exe
O4 - HKLM\..\Run: [\YUR113.exe] C:\Windows\system32\YUR113.exe
O4 - HKLM\..\Run: [\YUR114.exe] C:\Windows\system32\YUR114.exe
O4 - HKLM\..\Run: [\YUR118.exe] C:\Windows\system32\YUR118.exe
O4 - HKLM\..\Run: [c4947d9a] rundll32.exe "C:\WINDOWS\System32\pvvukjmn.dll",b
O4 - HKLM\..\RunServices: [Windows Helper] wsctnfy.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [\YUR111.exe] C:\Windows\system32\YUR111.exe
O4 - HKCU\..\Run: [\YUR112.exe] C:\Windows\system32\YUR112.exe
O4 - HKCU\..\Run: [\YUR113.exe] C:\Windows\system32\YUR113.exe
O4 - HKCU\..\Run: [\YUR114.exe] C:\Windows\system32\YUR114.exe
O4 - HKCU\..\Run: [\YUR118.exe] C:\Windows\system32\YUR118.exe
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP Premium\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP Premium\dapextie2.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll qxakuj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: getPlus® Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: WindowsService - Unknown owner - C:\WINDOWS\b0.exe (file missing)

--
End of file - 3354 bytes

Edited by ddbtkd456, 18 September 2008 - 06:53 PM.

[Tomk]

Hi ddbtkd456,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Yep. You have some serious carp** on there. You are also way behind on windows updates. As soon as we have you cleaned up, you need to take care of that. You have some infections that can sometimes be a little dicey. Please try to respond back as quickly as possible because I will be offline on Saturday but I will make every effort to get you going by then.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

[Tomk]

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log