Bad Image Sensapi.dll and can't reboot Windows logon ui

waverly911waverly911
edited April 2009 in Spyware & Virus Removal
I have a host of error messages on my problem computer. March 31st was the last time the computer worked properly. I can't reboot properly -- meaning that I hit restart the computer and it reboots. I have to turn power off manually before hitting power button on. I see a Windows logon ui error box when i select restart.

Windows installer pops up as well like it will get something from the cd, but it eventually goes away.

Now when I power down, power up manually I see winlogon.exe bad image error box, followed by logonui.exe - application error boxes ( I hit cancel 10 times), then I see a Log on to windows box with my username populated. Please note that before I used to see two users (without a log on to windows page) that I could choose from and go from there.

I hit okay without typing a password and then I see my desktop.

You can see what I experience at youtube http://www.youtube.com/watch?v=ej99StIat1k

Some of the bad image errors I see
retroexpress.exe - bad image
waol.exe = bad image
{E56116FE-E8AE-47bd-8E6D-96AA82C27....}: PortAOL.exe - Bad Image (i removed some of the digits since I wasn't sure if this was a security issue)
GameDrvr.exe - Bad Image
ArcCon.ac - Bad Image


All of these have The application or DLL C:\WINDOWS|system32\SensApi.dll is not a valid Windows image. Please check this against your installation diskette.

Some of my programs work, but others don't like quickbooks. When I click it, it goes through the process as if it were going to open, but it gives me a qbw32.exe - bad image error with the dll info.

I ran Spybot Search and Destroy a few times. Once it found several issues. It said I had to restart now, but when I tried the Windows Logon Ui error page pops up and I haven't been able to restart the traditional manner. When I ran spybot again it did not find those issues, but i know something is wrong here.

Any help is appreciated. Thank you

Comments

  • waverly911waverly911
    edited April 2009
    I ran spybot again and it found many problems. It could not resolve two though -- both under Wild Tangent:
    (SBl $34D9CFFA) Class ID
    HKEY_LOCAL_MACHINE\SOFTWARE\ClassES\CLSID\{65E7DB1D-0101-4100-BD66-C5C78C917F93}

    (SBl $AA4B3C71) Class ID
    HKEY_LOCAL_MACHINE\SOFTWARE\ClassES\CLSID\{3A7FE611-1994-4ef1-A09F-99456752289D}
  • waverly911waverly911
    edited April 2009
    It read that it would run spybot on restart which it ran. It found 7 issues: 1 entry each for bluestreak, burst media, casalemedia, doubleclick & right media. It found two issues for mediaplex (tracking cookies). For WildTaNGENT IT FOUND (SBl $DD0C3EA6) Settings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Java VM\ClassPath=...:C:\WINDOWS\wt\webdriver\wtdmmpi.jar...

    The ... is what I saw in the entry and it would not show the entire entry. It read that all 8 problems were fixed.

    It still shows windows logon ui and the never ending bad image errors
  • KatanaKatana
    edited April 2009
    Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.
    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe




    Malwarebytes' Anti-Malware

    Please download Malwarebytes' Anti-Malware to your desktop.

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If requested, please reboot
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt





    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.
Sign In or Register to comment.