The application or DLL C:\WINDOWS\system32\msible.dll is not a valid Windows image.

[neilrr]

"The application or DLL C:\WINDOWS\system32\msible.dll is not a valid Windows image. Please check this against your installation diskette."

Windows XP, Firefox.

This showed up on my pc a couple of days ago & pops up again & again, sometimes followed by what appears to be an AVG window.

I've updated & run AVG 2011, Malwarebytes Anti-Malware, SUPERAntiSpyware Free edition, portable SAS & cannot get rid of the bloody thing. I've also restored the pc to a couple of days before when I think this appeared. No change.

Anyone know what it is & how to kill it?

TIA.

 

[artyman]

This may be helpful
msible.dll | msible.dll Virus File Removal

 

[neilrr]

"2. Locate msible.dll virus files and uninstall msible.dll files program. Follow the screen step-by-step screen instructions to complete uninstallation of msible.dll."

How does one do that?

Is it easier to just run this thing?
3. Reboot computer in SafeMode. Clean/delete all msible.dllinfected file(s):msible.dll and related,or rename msible.dll virus files,if the file refused to be deleted,use the tool http://killbox.net/downloads/KillBox.exe

 

[Noodle-Pulp]

Trouble is if it's messing with stuff in the registry, every time you delete it - it will come back..unless you correct the registry.

 

[neilrr]

I've run countless scans & downloaded all kinds of malware & de-bugging things but I cannot get rid of this bloody thing.

It's driving me crazy, can anyone please help?

 

[neilrr]

Sigh..... the latest thing tried is something called STOPzilla, which doesn't work either.

Is the only solution to get the thing wiped & reloaded?

 

[John]

Do any of the products you've tried say they've found something or nothing?

My thoughts:

Before you do anything further, ensure you have a copy of all your important data such as documents, pictures, music etc. You should have this anyway but now is the time to update it if not or it is out of date!

It may not be a nasty - you can have this issue if a DLL is corrupted (regardless of cause). In which case, you can normally rename the DLL (literally rename the file to msible.dll.old) and without refreshing Windows Explorer, scroll to the bottom to see if another one appears (it will be copied from C:\WINDOWS\system32\dllcache). If the DLL is locked (you cannot rename it), you can reboot in Safe Mode and rename it, then reboot in normal mode. It is not a core Windows DLL as I don't have it so it should not affect startup. See if this file is there.

Regardless of whether the issue re-occurs, next I would go here:

Avira Downloads

Download:

Avira AntiVir Removal Tool

...and run it to see what you get.

As said, you do need to remove the problem, and as you posted (how do does one do that?), you need to know exactly what to remove from where. Removing affected DLL(s) will probably not clear the problem - just the symptom(s).

After that, I would consider removing AVG and switching to Avira Personal (www.free-av.com), installing that, updating it and running a FULL SCAN as well. AVG is reasonable but in my experience, not as good as Avira.

As you have run a FULL SCAN within an updated Malwarebytes, if both the above Avira products do not reveal any issues, I wouldn't necessarily be thinking it was a nasty but rather an underlying issue caused by something else (software is corrupting it, you might have disk corruption etc.).

Next I would be right clicking C: within Windows Explorer, choosing PROPERTIES > TOOLS > ERROR CHECKING > CHECK NOW and tick the 2 tick boxes, and then START. Agree to the prompt to schedule when Windows can have exclusive access to the disk and reboot.

See what that reveals. Any bad blocks, I would be thinking about replacing the hard disk. You can run on a disk with bad blocks but I don't recommend it - especially with the price of hard disks these days! You will need to rebuild if this is the case.

If not, and you still have the issue after all that, and given you have tried a restore to prior the issue starting (this would rule out a software update etc. causing it) - I would consider rebuilding from scratch myself.

PS: As a general rule of thumb, be very careful about installing tools and other software which 'can fix the problem'. You could end up installing duff software which gives you problems. A mainstream set of tools, like Avira and Malwarebytes, should be able to remove pretty much anything. Even zero-day problems are usually picked up by the heuristic abilities of Avira. Worse-case, find tools from trusted sources like Avira, Sophos etc.

 

[neilrr]

JohnEBoy,

Thanks for the reply & apologies for not coming back to you sooner.

I was trying various geek & AV / spyware forums without success but have now at least identified the problem as a trojan called Alureon.A.

I ran Avira AntiVir Removal Tool but it found nothing at all wrong. I tried to uninstall AVG but have only been able to get rid of some of it. Avira Personal is installed, updated & run but hasn't found anything.

I ran Microsoft Security Essentials about 10 times. It finds it but cannot delete it, I think because the ******* thing changes constantly.

Any idea how to remove Alureon.A?

 

[EDZ649]

Would a system restore to a point just before this started to happen solve the problem? I have tried this before with malware and it's been sucessful.

 

[momomo]

You need a specific tool created to remove that Trojan. Ive emailed you Neil.

 

[neilrr]

Would a system restore to a point just before this started to happen solve the problem? I have tried this before with malware and it's been sucessful.

Tried that right at the get-go to no avail. This thing is a complete B*ST*RD to kill.

 

[neilrr]

Well, after ****ing about with this for too long I took it into the local computer shop. It had gotten progressively worse until it wouldn't allow me to open Firefox or IE. I couldn't update any of the umpteen anti-spyware or AV programs I had installed to try to kill it & it wouldn't even allow me to open the computer in safe mode.

Incidentally, after running AVG & or Avira every single day (as well as MSE, SAS, Antimalware & a couple of others) the shop's Bulldog AV discovered 820 infections!

Now, the shop saved the stuff I wanted & wiped the computer clean, giving me back my bookmarks in something called a JSON file on my desk top.

Does anyone know how I would import those bookmarks back into Firefox?

TIA.

 

[John]

JohnEBoy,

Thanks for the reply & apologies for not coming back to you sooner.

I was trying various geek & AV / spyware forums without success but have now at least identified the problem as a trojan called Alureon.A.

I ran Avira AntiVir Removal Tool but it found nothing at all wrong. I tried to uninstall AVG but have only been able to get rid of some of it. Avira Personal is installed, updated & run but hasn't found anything.

I ran Microsoft Security Essentials about 10 times. It finds it but cannot delete it, I think because the ******* thing changes constantly.

Any idea how to remove Alureon.A?

Oops - must have missed the update to this...

I would have said the next best thing would be to wipe and start again personally as it gets to the point where you are p***ing in the wind in the dark. If something is that hard to remove, you want rid.

Interesting how many infections they found - although it could be that it counts a particular infection as anything it finds that is wrong - so might only boil down to a handful of nasties. Like Malwarebytes will list everything it finds as an individual thing - but lots are associated with one thing.

Moving forward, you need to ensure you run antivirus and keep it up to date, as well as anti-malware.

Given Bulldog was so successful (assuming it is an antivirus and antimalware tool), it might well be worth using this and leave Malwarebytes on as a secondary. Bullguard did well in the tests done by avtest.org...

I've studied results over a good 4 years now and in a nutshell, not one product is always top and understandably so.

All you can do is pick the best one at a given time and switch should it become really crap (which I found with certain 'top' end products).

Sometimes it is worth opting for the paid for version which can have more proactive protection.

You don't want something to get on your machine in the first place ideally. Scraping it off after is a last resort.

 

[John]

Duplicate

 

[neilrr]

Yes, I think I'll probably get a paid for AV protection. I liked Kaspersky for the year I tried that but the shop guy swears by Bulldog.

Any idea how to do this? - the shop saved the stuff I wanted & wiped the computer clean, giving me back my bookmarks in something called a JSON file on my desk top.

Does anyone know how I would import those bookmarks back into Firefox?

 

[John]

I would imagine you need to import or restore them within Firefox?

Is there a button or menu for Bookmarks with the option to do either (have a good look around in there)?

I don't know Firefox but if you cannot find this, use a search engine (like Google or Ask) to search for 'import bookmarks firefox' or 'restore bookmarks firefox' - there will be a shed load...

I've not heard bad things about Kaspersky... but might be worth giving Bulldog a go.

You shouldn't need to spend a fortune on it if you are going for paid protection.