Bad Image Errors - dll files changing to 0 bytes

Hi
Have an unusual problem (to me anyway)

Last week I got "Bad Image" errors with Adobe Lightroom (the program had worked OK previously). Two .dll files were listed as corrupt and in Explorer both were shown has having 0 bytes size. Re-installation resolved the problem.
Today I have had the same "bad image" error with another program. Techsmith SnagIt. Once again it was .dll files and they show in explorer as 0 bytes. The timestamp on the 0 byte dlls is the time of the error i.e. today (not when the files were installed).

What I've done so far :
Ran McAfee viruscan across all disks - no problems reported.
Ran Malwarebytes - no problems reported

Went to the properties for the disk drive and under "Tools" ran error check - nothing found
The disk is an SSD so I went to Samsung Magician which shows drive condition as good and S.M.A.R.T. shows wear levelling count at Current Value 99. I do not use Rapid Mode.

The problems are happening on a Samsung 850 Evo 500GB

Any suggestions welcome

Dave

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Right-click on FRST icon and select Run as Administrator to start the tool.
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please copy and paste their content into your next reply.

Sorry for delay in replying - I have being trying to reply over the last half hour and keep getting a message telling me to wait 30-13 secs between posts.

So trying again after 5 mins from a different browser and attaching the files rather than pasting to see if I get more success.

Addition.txtFRST.txt

Dave

Please run the following

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it in the same location as FRST, and name it fixlist.txt

Code:

start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
hosts:
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
GroupPolicy: Restriction <==== ATTENTION
2017-10-19 01:19 - 2017-10-29 11:07 - 000000438 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2017-09-29 13:42 - 2017-09-30 15:18 - 000630784 _____ C:\WINDOWS\system32\hgattest.dll
2017-09-29 13:42 - 2017-09-30 15:18 - 000055808 _____ C:\WINDOWS\system32\hgsclientplugin.dll
2017-09-29 13:42 - 2017-09-30 15:18 - 000023040 _____ C:\WINDOWS\system32\hnsproxy.dll
CustomCLSID: HKU\S-1-5-21-321452018-3466158101-1813489261-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-7FCB8A6F166E}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
Task: {BEFAC72D-68C8-40BB-893D-955EF51D2A0C} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
end

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Now restart, let it boot normally and tell me how it went.

Hi
Thank you for taking your time with this. Before I run this can you please describe what it does.

Dave

It will delete few files that is malware infection.

I would like you to check the system integrity of your Windows OS installation.

• Please type cmd.exe into Start Menu search box.
• Please right click cmd.exe and select "Run as administrator".
• Please type the following command and press the <Enter> key: sfc /scannow (Please note that there is a space between 'sfc" and "/scannow".)
• It should take about 20 minutes to run, if there are no serious errors.
• If the System File Checker reports that some errors were fixed, but some remain; please reboot your computer and run the System File Checker from an Administrator Command Prompt, again.
• If the System File Checker again reports that some errors were fixed, but some remain, please reboot your computer and run it a third time.
• If "Resource Integrity Violations" (errors) are reported that could not be corrected, or were not corrected after a third SFC run, then please navigate to the folder: C:\Windows\Logs\CBS and copy the file "cbs.log" to your desktop immediately. I am asking you do that because that file is dynamic, so I want to be able to examine a copy that is unchanged from the time that the System File Checker was run.
• If there are errors that couldn't be corrected, let me know and I will provide you with instructions as to how to upload the file

Hi
I ran sfc scan- which showed no errors.
I ran FRST from recovery command prompts and it generated the attached log :

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-10-2017
Ran by SYSTEM (29-10-2017 22:44:14) Run:1
Running from F:\Downloads\Fabar
Boot Mode: Recovery
==============================================
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
hosts:
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
GroupPolicy: Restriction <==== ATTENTION
2017-10-19 01:19 - 2017-10-29 11:07 - 000000438 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2017-09-29 13:42 - 2017-09-30 15:18 - 000630784 _____ C:\WINDOWS\system32\hgattest.dll
2017-09-29 13:42 - 2017-09-30 15:18 - 000055808 _____ C:\WINDOWS\system32\hgsclientplugin.dll
2017-09-29 13:42 - 2017-09-30 15:18 - 000023040 _____ C:\WINDOWS\system32\hnsproxy.dll
CustomCLSID: HKU\S-1-5-21-321452018-3466158101-1813489261-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-7FCB8A6F166E}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
Task: {BEFAC72D-68C8-40BB-893D-955EF51D2A0C} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
end
*****************
Error: Restore point can only be created in normal mode.
CloseProcesses: => Error: This directive works only outside recovery mode.
EmptyTemp: => Error: This directive works only outside recovery mode.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
========= bitsadmin /reset /allusers =========
'bitsadmin' is not recognized as an internal or external command,
operable program or batch file.
========= End of CMD: =========

========= netsh winsock reset catalog =========
The following helper DLL cannot be loaded: WLANCFG.DLL.
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.

========= End of CMD: =========
C:\Windows\System32\GroupPolicy\Machine => moved successfully
C:\Windows\System32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\system32\Drivers\etc\hosts.ics => moved successfully
C:\WINDOWS\system32\hgattest.dll => moved successfully
C:\WINDOWS\system32\hgsclientplugin.dll => moved successfully
C:\WINDOWS\system32\hnsproxy.dll => moved successfully
CustomCLSID: HKU\S-1-5-21-321452018-3466158101-1813489261-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-7FCB8A6F166E}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File => Error: The entry should be fixed outside recovery mode.
Task: {BEFAC72D-68C8-40BB-893D-955EF51D2A0C} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION => Error: The entry should be fixed outside recovery mode.
==== End of Fixlog 22:44:14 ====




On restarting the PC two Techsmith .dll files were reset to 0 bytes

Dave

Please Scan your computer with HitmanPro.

Hi
Thanks for your continued advice. I've run HitManPro- it showed 0 threats and found 179 tracking cookies which I've now deleted.

I am starting to wonder whether the issue might be McAfee Antivirus - detecting and deleting (rather than quarantining) false positives. Although it did not find anything on a scan. I've added the .dll files that were deleted in the last few days to the exceptions list to see how things go.

Dave

You are head of me yes antivirus software could be the cause of the problem.