Bad Image error in Windows 7 64

Chedmeister · 25 Jul 2011

Hi, having a difficult issue with a customer who gets the following message when opening some but not all .exe files. Soz about the long message but ill list the things i have tried.

"C:\Windows\system32\ajpjDhglj.DLL is either not designed to run on windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or software vendow for support."

The error pops up for the same file name if i run say malwarebytes or explorer but not with Ccleaner. Clicking ok gets rid of the message and the program runs anyway.

I thought the file name looked virus like but nothing gets picked up by malwarebytes or MSE. If i look for the file in System32 it is not there and is not hidden either. I searched drive C for the file and to my surprise it came up but in Windows\sysWOW64 instead but all the letters were in caps this time. If i Scan it with MSE i get nothing but if i scan it or any other single file with malwarebytes the error changes to "C:\Windows\sysWOW64\AJPJDHGLJ.DLL is either not designed to run on windows or... "

Most bad image threads ive read can be fixed by doing a SFC /SCANNOW but it doesnt work for me. Ill try updating him to sp1 in the meantime.

This has me stumped anyone have any ideas?

**cluberti** · 25 Jul 2011

What if you download the offline scanner and scan the machine from a bootable disc or USB key? There are viruses and malware out there that can keep themselves from being found in a running system, but offline (without their programs and hooks protecting themselves) they can be found. That name is most certainly not a "good" .dll name and stinks of virus or malware infection, so scanning offline is always your best option when you suspect malware but can't find it online:

Microsoft Standalone System Sweeper Beta | Microsoft Connect
That tool uses the same engine and definitions as MSE, but runs from a bootable disc or USB key to scan a machine offline, which is usually more effective than an online scan.

Chedmeister · 25 Jul 2011

Thanks for the reply, I will try this but Im supporting him remotely and cant get to him to try fro a week or so.
Because im interested can you explain why a file of the same name is in the sysWOW64 folder?

**cluberti** · 25 Jul 2011

probably both a 32 and 64bit file to get at both.

SlasherIT · 26 Jul 2011

This dll file is almost certainly a virus, I searched this dll on Google, and the only thing that came up in the search was this thread.

Slasher

Chedmeister · 27 Jul 2011

Thats what i did and the same thing happened. At the time I payed no attention to my own experience of such things and thought 'maybe it is a very uninteresting file' but that is obviously a load of ****

. I will try what Cluberti has suggested and get back to you next week.

Chedmeister · 04 Aug 2011

Hi again! i now have the laptop in m posession and last night ran the offline microsoft scanner from a CD. It found and killed one virus called dizzme.b but that did not fix the problem. Ive removed the harddrive and scanned it from my own PC with malwarebytes and now ESET but still no sign of further virus'! Could try combofix i suppose.

Also I'm looking through the Windows folder and there are loads of these things! kniLBY.exe, dQeKimVXN.exe, KsKVrscQr.dll, KeAUhHXj.dll, KhBQD.exe, jvkTFvK.dll all exist amongst MANY others. Some of the .exe's have icons like ticks or flags. There are more but not as many in the SysWOW64 folder but none as far as I can see in the system32 folder. Could these be remnants of a virus that has since been killed?

What the hell is this thing?!?!

Chedmeister · 04 Aug 2011

OK Combofix totally found and killed the files
SysWOW64.dll\AJPJDHGLJ.DLL
programdata\xp\EBLib.dll
programdata\xp\TPwSav.sys

and the folder
programdata\xp

Problem is now gone! Good old combofix!! :)

SlasherIT · 04 Aug 2011

Combofix? What is it, never heard of it before...

Chedmeister · 04 Aug 2011

You've never heard of combo fix?! i'm not even sure if you're joking or not!

Its always my 'last resort' but I cant use it remotely because it kicks me off. I say last resort because it comes with a stack of warnings about its potential to mess up the comuters it scans but thats never happened to me before. Im no expert on it but i think it specialises in rootkits and cleaning infected windows files that are being used at the time of scanning. I've seen it delete infected system files and then automatically download clean ones from wherever it does. I usually find it gets rid of the malware that everything else couldnt, check it!
ComboFix | freeware