how do I fix error loading image.dll at bootup with win xp

[jeeper912]

I have a windows xp professional version that was just installed a week ago....my browser was hijacked by some spyware and I was able to remove most of the viruses and spyware with adaware 6.0...but,

I keep getting a rundll error when windows first boots up. The error is "cannot load c:\windows\image.dll

I ran adaware 6 numerous times and it doesn't fix the problem.
I ran a reg cleaner a few times and it doesn't fix the problem.
I ran a deep virus scan on my compter and it doesn't fix the problem.

I found the registry entry where this command resides:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunServices]
"Image"="rundll32 C:\\WINDOWS\\image.dll,Install"

I backed up this key first then I removed it from the registry and booted up my computer...same error...i restored the registry entry back to original setting.

System restore doesn't allow me to restore my computer back to any restore point for some reason.

If anyone can please help me

[LeftCoast]

Try Spyware Search and Destroy and also SpywareBlaster(available at the S&D site).

If it were me, I'd wipe the HDD with a utility like Killdisk (writes zeros to the HDD) and then reinstall. Formatting doesn't do it, you need to write zeros to the drive rendering any viruses/corrupted windows files harmless.

[LeftCoast]

Sorry, double post.

[jeeper912]

Thanks for a fast response....I ran s&D scans and removed some spyware that wasn't detected by adaware but I keep getting a rundll error when windows first boots up. The error is "cannot load c:\windows\image.dll.

is there a way to modify the rundll.exe boot sequence and delete the image.dll command from executing?

[Fr4gm4n]

Read this....should help you http://www.computercops.biz/modules....topic&p=130963

Steve

[jeeper912]

Thanks for the info...they told me to run cwshredder and hijackthis...anyway cwshredder didn't find any viruses or spyware in my system....I also ran hijackthis and save its log because I wasn't sure what to delete....can anyone help:

Logfile of HijackThis v1.97.7
Scan saved at 7:22:45 PM, on 4/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\WinFax\WFXSWTCH.exe
C:\WINDOWS\System32\wfxsnt40.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\WinFax\WFXCTL32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\PROGRA~1\VCOM\SYSTEM~1\mxtask.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\ACT\act.exe
C:\Program Files\Ositis Software\WinProxy 5\WinProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Michael\LOCALS~1\Temp\Rar$EX00.213\Hij ackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\VCOM\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\WinFax\WFXSWTCH.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [Launcher] F:\setup.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Controller.LNK = C:\Program Files\WinFax\WFXCTL32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7...ll/xscan53.cab

[kuneru]

That same thing happened to me a long time ago(2yrs. guess).
So far i remember is, i got a copy of that image.dll, copy and paste it to c:\windows and did the trick. You can get lost or deleted dll's from http://www.dll-files.com