IEBHO.DLL - why does Windows 7 run without this DLL?

Question

I am trying to repair daughter's Dell XPS laptop - Windows 7 home Premium 64-bit. About a week ago it started popping up a message:

LogonUI - Bad Image (in title bar)

C:\PROGRA~2\WI3C8A~1\Datamngr\X64\IEBHO.DLL is either not designed to run on Windows or contains an error.

The app mentioned in the title bar of the message is different each time mostly, but the offending file - C:\PROGRA~2\WI3C8A~1\Datamngr\X64\IEBHO.DLL is always the same. If I navigate to that folder, the file is there, but it is only 20 bytes long, and there is nothing else in the folder, so I'm thinking that a recent auto update (probably Windows 7 SP1) failed and clobbered this folder. The file is dated 12 July 2011, and the update log shows SP1 was installed 14 July.

This occurs for just about every app, multiple times for some, so I conclude that it's a fairly low-level, often used DLL. The strange thing is, everything seems to run fine anyway, apart from the popups!

No backups of any type have been done. A restore to a point prior to the SP1 update fails with error 0x8000FFFF, which is an "unspecified error".

sfc /scannow at a safe mode Command Prompt produced thousands of entries in the log file, but none of them mentioned the aforementioned file. Operation, and the DLL file were unchanged.

On a hunch, figuring that if things ran okay without it anyway, I thought I would try renaming the file out of the way. Bingo. The popups have gone and PC seems to be fine.

What have I broken? Does anyone know what this file/folder is for?

Solution 1

I found no hits when searching for IEBHO.DLL but quite a few hits when searching for Datamngr.

Reading those links suggests that Datamngr is some kind of malware, so my suggestion is that you read What to do if my computer is infected by a virus or a malware? and do a through sweep.

Solution 2

I agree that it sounds viral. I would download HijackThis and run a scan. Look for entries for that file and directory, and check them. Based on the name of the file, look especially closely at the section 02 - BHO (Browser Helper Objects). Then click "Fix Checked".

I would also run Malwarebytes, Superantispyware and Hitman Pro to make sure you are clean.

http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;1

http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html?tag=mncol;1

http://download.cnet.com/Hitman-Pro-3-64-bit/3000-2239_4-75110395.html?tag=mncol;2

Comments

[Ramhound]

It works because the file WI3C8A~1 is not system folder. You should have your daughter do backups.

[rossmcm]

@Ramhound, I suspect, after a bit more Googling, C:\PROGRA~2\WI3C8A~1 is C:\Program Files (x86)\Windows iLivid Toolbar. Also, see my typo edit to OP.

[JdeBP]

Running DIR /X C:\ C:\PROGRA~2\ in the command interpreter will give you enough information to work out for definite what the long filenames are.

[rossmcm]

see typo fix in OP