Windows Error on every application load

Discussion in 'Software' started by IkeRay, Dec 12, 2008.

  1. IkeRay

    IkeRay Private E-2

    so I'm having an error that apparently nobody else has had when it comes to .dll's and "not valid windows image". 2 dll's pop up errors when any process starts to load:

    "The application or DLL C:/WINDOWS/system32/nmnngj.dll is not a valid Windows image. Please check this against your installation diskette."

    I hit ok. its followed by:

    "The app.....c:/WINDOWS/system32/rgoenh.dll is not a valid......"

    where "..."=same as first. I hit ok and the application opens. it happens before the log in screen for windows as well, and after the login screen as well for explorer.exe.

    I don't have an install disk nor repair disks for XP.


    btw, this all started after badly infected computer recovered with malwarebytes followed by spybot s&d and finally SUPERAnti-spyware.

    I also have 2 files in the startup directory, "winlogin" and "winlogun" both located in temp folder C:/DOCUME~1/NATA~1/temp but when I open that folder there are no files by those names and thats including hidden files. this folders also didn't show up as hidden, I had to type their address to get to them.

    the computer seems to be cured of the infection, although I get those errors when loading programs and random system sounds (like the loud error, not the small error sound) when nothing is going on...computer is idle.

    i have attached the mbam logs, there are 3 of them, notice the last is a quick scan.
     

    Attached Files:

  2. Senlis

    Senlis Staff Sergeant

    have you ran chkdsk?
     
  3. IkeRay

    IkeRay Private E-2

    just finished, problem is still present.

    do you happen to know what those 2 dll's are for or a place where I can download replacements for them?
     
  4. sach2

    sach2 Major Geek Extraordinaire

    They are malware! The random string of letters points to this as the cause. Go to the Malware section and do the Read and Run Me first to completely remove the infection.

    *******

    You can check msconfig and you will see a couple of startup items that match these .dlls If you don't want to do the Full malware removal process you can uncheck the boxes in msconfig to disable them or use CCleaner>Tools>Startup to disable/delete them. I would disable and test before deleting.
     
  5. IkeRay

    IkeRay Private E-2

    I tried this, the only things in startup in msconfig that could possibly be would be the 2 files in the docume~1/nata~1/temp folder that are logun and login. both of those are already unchecked.

    what would happen if I simply open the system32 folder and deleted these 2 items?

    I did the read and run directions, minus CF and MGtools, computer kept restarting (which has been an ongoing thing of 2 years, suspect power supply going out...couldn't tell you whats wrong). I'm running CF now, let you know if the last 2 steps help.
     
  6. sach2

    sach2 Major Geek Extraordinaire

    The malware forum is really the place to go. I was going on the name of the .dlls that were running the rounds several months ago. In that case they were listed in msconfig as their random name like "...System32/knjkiou.dll". Simply unchecking the box and then using selective start-up eliminated them running. Because they are not valid .dlls renaming/deleting should not be a problem. Again, I prefer to rename and restart before permanently deleting.
     
  7. IkeRay

    IkeRay Private E-2

    BSOD at 32a while running CF.

    any suggestions?


    couldn't tell you how, but after rebooting from the BSOD, errors are gone. checking for malware with all 4 (ad-aware, malwarebytes, spybot S&D, and SaS). I'll let you know if anything comes back...
     
    Last edited: Dec 12, 2008
  8. Senlis

    Senlis Staff Sergeant

    I assume CF is combofix?
     
  9. IkeRay

    IkeRay Private E-2


    yes, sorry. as I said, the errors somehow went away, perhaps combofix DID fix it. I'm running SaS (superanti-spyware) right now and it has found 7 threats in the form of adware tracking cookies. its 45 minutes into it right now, I'm going to get food and I'll be back. I'm going to run Spybot S&D and Malwarebytes, debating on ad-aware. should I bother trying combofix again or MGtools?
     
  10. IkeRay

    IkeRay Private E-2



    Ran all 3, took 1 1/2 to 2 hours for each...decided to skip the ad-aware and uninstalled it even :).

    computer is running better than ever. thanks guys.


    now about the restarting issue, should I take it to a local shop and have them test components and the PSU to see which is the culprit? I know its not the best machine in the world, but I planned on putting it in the kids room to play some games on (and disconnect it from the internet).
     
  11. Senlis

    Senlis Staff Sergeant

    at least sending it into the shop to get the components tested should not be expensive. At my shop, it would cost about 27$ to figure out if there are any hardware causes on it and what those problems may be. I wouldn't pay much more than that.
     
  12. Lev

    Lev MajorGeek

    @ IkeRay - as already stated by Sach2, if you wish to receive help on malware removal or any questions related to Majorgeeks.com cleaning procedures, you need to post in the Malware Forum, where our Authorized Malware Fighters are waiting to assist you.

    If you prefer I could just move your thread to the Malware Forum, but you will still need to complete the READ & RUN ME and attach the logs as requested.

    Thanks :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds