Jump to content

Bad Image DLL not designed for Windows or contains error, AFTER running MBAM


Recommended Posts

 

Please help!

 

After running MBAM on a Win7 32-bit workstation suspected of having malware, I'm now getting the following attached dialog box before almost every program I run for the first time.  Clicking OK runs the app and it appears to be just fine, but I've scoured the internet and can't get rid of this no matter what I try.

 

For those that can't see the attachment, the titlebar is:

[program name] - Bad Image

c:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}\umpo.dll is either not designed to run on Windows or it contains an error.  Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.

 

I've tried the following:

MalwareBytes Anti-Malware

ADWCleaner

HiJackThis!

NOD32

 

Thanks in advance for your prompt support!

post-185081-0-92814400-1426632575_thumb.

FRST.txt

Addition.txt

Link to post
Share on other sites

  • Staff

Hello,


 


Do you have MalwareBytes subscription, or you just installed MalwareBytes to scan this PC? This seems to be business/company PC? This forum is mostly run by volunteers who spend their time free of charge, so if you're making profit by using this PC, then you should contact company IT department or simply hire someone to repair it.


Link to post
Share on other sites

Making profit?  Ha!  More of a financial black hole - but thanks for the help???

 

I ended up solving it on my own.  UMPO.DLL is a legitimate Windows dll, but its home is C:\Windows\System32 - NOT in C:\ProgramData.  I zipped up the D9E629DC... folder for backup purposes, then deleted it.  I then went into RegEdit and searched for that key.  Sure enough, it belonged to a parent key InProc32.  I exported that key (for backup purposes), and then deleted it.

 

My guess is that was part of a rootkit that got left behind after running MBAM or some other malware removal program.  I came back here to post the answer in case it helps someone down the line.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.