Bad Image alert

[makerfamily42]

Can someone help me? I get a "Bad Image" alert when I try to open most programs. I cannot run anti -virus. I tried to run chamelon, it won't work. I believe I have some serious malware, but I can't find a way to clean my system.

[TwinHeadedEagle]

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

---

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.

Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.

  

• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[makerfamily42]

Ok.  When I tried to download the scan tool, it was blocked... as all downloads have been since this issue started.  So, I used another computer and downloaded it to a flash drive.  I was able to copy it off of the flash drive and onto the desktop of the infected computer.  However, the program still won't start.  The bad image warning comes up every time.  I even tried to run it as administrator.  

[TwinHeadedEagle]

Can you make a picture how it looks like?

[makerfamily42]

A message just like this comes up with a lot of the program's I try to open.

[TwinHeadedEagle]

Can you run FRST from Safe Mode?

[makerfamily42]

No, I tried that. But, the same error is displayed.

[TwinHeadedEagle]

What is your operating system?

[makerfamily42]

Win 8.1

[TwinHeadedEagle]

Let me know if you can boot to Advanced recovery options.

 

http://www.eightforums.com/tutorials/2269-system-recovery-options-boot-windows-8-a.html

[makerfamily42]

When I try booting to advanced options, by holding shift while restarting, it looks like this, giving me only the options to continue with normal boot or to power down.

[makerfamily42]

Here is the pic

[TwinHeadedEagle]

Do you have USB Flash device at hand?

[makerfamily42]

Yes

[TwinHeadedEagle]

Ok, we will burn required tools on your USB.
 
 
Please download the following tools on your Desktop:

• Farbar Recovery Scan Tool x64
• Rufus
• Win81RE_x64

• Insert your USB and then start Rufus
• Select the ISO file Win81RE_x64.iso on the desktop via the ISO icon.

• Under the Device select your USB Flash.
• Press Start
• When the process is complete, copy Farbar Recovery Scan Tool x64 on this USB

• Insert USB into infected computer and power on the computer. Now you need to set your computer to boot from USB. In order to do that, follow this guide.
• When you boot from USB, you will see image like this:

• Click Troubleshoot

In the next window, click Advanced options and select Command Prompt.

• In the command window type in notepad and press Enter.
• When notepad opens, click File and select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run. When the tool opens click Yes to disclaimer.
• Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

[makerfamily42]

Ok, after jumping through hoops in the bios settings, I finally succeeded.  Here it is.  FRST.txt

[TwinHeadedEagle]

I don't see sings of malware here. Enter Command Prompt again and type this command:
 

chkdsk C: /R

 

Wait for it to finish and then try to boot normally.

[makerfamily42]

Ok. I did. I'm still encountering the same problem.

[TwinHeadedEagle]

Can you try System File checker?

 

http://www.eightforums.com/tutorials/3047-sfc-scannow-command-run-windows-8-a.html

[makerfamily42]

Unfortunately, system file checker is not helping me. Here is what happens: It will not run when windows is booted. I have to run it from recovery options. When I do run it, it says, "There is a system repair pending which requires reboot to complete. Restart..." I do this over and over again, but still no help.

[TwinHeadedEagle]

When this started to happen?

[makerfamily42]

About a month ago.

[makerfamily42]

It actually started after a supposed "Windows update." So I thought I would just uninstall that update. But, when I open the updates, it does not show that this computer has been updated

About a month before this happened, someone who was using this computer fell for one of those scams. An alert came on the screen saying the computer was infected. It gave an 800 numbere to call. When they called the number, they gave the person remote access. The person then said it would cost hundreds of dollars to fix it. That's when we realized it was a scan. We got off the phone, and they made a giant laughing face come on the screen.

I ran a virus scan and malware bytes on it after that. Everything seemed to be fine for a month. Then this happened. I can't do anything with the computer now.

[TwinHeadedEagle]

It doesn't need to be malware related. I've read some discussions and it could be that Windows Update is messing things up. You can enter recovery again and try to perform System Restore.

[makerfamily42]

If I proceed with system restore will it delete my files?