I suddenly get this problem with fltlib.dll tonight,which I never had....
Every program I try to open,it says the process name followed by BAD IMAGE
and fltlib.dll is either not designed to run on Windows or it contains an error.I can open all the programs normally,but this tab is so boring.
Please anyone tell me what to do.pls.
thank you
Are you running Ad-aware? Also, what version of Windows7 Ultimate are you running? (RC or RTM)
Since this is a Microsoft file, from what I see on the Internet, running scf /scannow from a command prompt should bring it back.
As Jacee indicates, it appears that Ad-Aware does something to the file or may remove it. If you are using that, I'd recommend uninstalling it before running scf
This could also be a malware infection ... downloading bad codecs or using someone else's infected file(s) from an infected USB flash device.
We've seen a lot of [process name followed by BAD IMAGE] in the malware forums. I would suspect a TDSS infection.
Hi there,first of all I would like to thank you for your responses.
I do not have Ad-Aware installed in my pc,but if it is an infection,then can you please tell me what to do?
I also forgot to mention that I tried sfc/ scannow but in the end it said that some of the drivers could not be fixed.
Waiting for your answers,Donald.
Download Malwarebytes' Anti-Malware to your desktop
|MG| Malwarebytes Anti-Malware 1.41 Download
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location (desktop). Copy and Paste that log into your next reply.
Malwarebytes' Anti-Malware 1.41
Database version: 2905
Windows 6.1.7600
10/4/2009 9:32:33 PM
mbam-log-2009-10-04 (21-32-29).txt
Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 226038
Time elapsed: 46 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117972.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117974.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117975.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117976.exe (Trojan.Dropper) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP223\A0123563.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP186\A0102670.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP191\A0106936.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP201\A0109316.exe (Trojan.Agent) -> No action taken.
C:\Users\El Mariachi\Documents\KONAMI\Pro Evolution Soccer 6\save\folder2\folder2.exe (Worm.Sohanad) -> No action taken.
F:\System Volume Information\_restore{0747B80E-069B-4F60-9144-20CDDAAA6949}\RP192\A0064750.exe (Adware.EShoper) -> No action taken.
Click on MBam, then click update ....
Run it again, but this time make sure that everything is checked, and click Remove Selected.
Save the log again and post it in your next reply
BTW ...Worm.Sohanad is a worm that spreads itself by sending links to your contacts in messengers like Yahoo, AOL and Windows Live messengers. It changes the Internet Explorer (IE) home page and doesn't let you change the homepage address. It also disables Registry Editor, Task Manager and the Run option in Start-menu. Bugs in Internet explorer is the cause of such virus attacks.
Last edited by Jacee; 04 Oct 2009 at 23:19. Reason: to add more
Malwarebytes' Anti-Malware 1.41
Database version: 2905
Windows 6.1.7600
10/4/2009 9:32:47 PM
mbam-log-2009-10-04 (21-32-47).txt
Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 226038
Time elapsed: 46 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117972.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117974.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117975.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP217\A0117976.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP223\A0123563.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP186\A0102670.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP191\A0106936.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0A0BC115-79E4-4FBC-9317-D843A6246D39}\RP201\A0109316.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\El Mariachi\Documents\KONAMI\Pro Evolution Soccer 6\save\folder2\folder2.exe (Worm.Sohanad) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{0747B80E-069B-4F60-9144-20CDDAAA6949}\RP192\A0064750.exe (Adware.EShoper) -> Quarantined and deleted successfully.
Sorry that was the log before the removing last night.I did remove them but the problems keep poping out anyway.Waiting for your response Jaycee.
Looks like your restore points are all infected... delete all of these, and rescan ( may have to turn "OFF" system restore !!! ) once the scan comes up 'clean', turn "ON" restore, and make a new restore point... then rescan, and make sure you are 'clean' again.... DeepFreeze would have prevented any infection, and you would NOT have had to go through the mill like this, but if you use DeepFreeze, you need to make sure all is 'clean and green...'
Quote