Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Bonjour\mdnsnsp.dll Is Not A Valid Windows Image

  • Please log in to reply
3 replies to this topic

#1 cyberabyss


  • Members
  • 26 posts
  • Local time:03:01 PM

Posted 04 August 2008 - 02:28 PM

I remembering this happening before with something else, but annoyingly most remembered and recent is when I try and do a netstat command.

Windows XP pro. = the OS.

you can click on the ok button until christmas and it is continously happens.

Full window prompt: "The application or DLL C:\Program Files\Bonjour\mdnsNSP.dll is not a valid Windows image. Please check this against your installation diskette."

Any assitance as to what to do about this issue? What is going on?

Thank you very mucho.

BC AdBot (Login to Remove)


#2 hamluis



  • Moderator
  • 56,434 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:01 PM

Posted 04 August 2008 - 03:07 PM

Take a look: http://arai.wordpress.com/2008/02/11/compl...and-mdnsnspdll/


#3 bellator7


  • Members
  • 1 posts
  • Local time:04:01 PM

Posted 27 August 2008 - 01:45 PM

The directory \Program Files\Bonjour does not exist on my drive, yet, mdnsNSP.dll still appears on the HijackThis scan (see the line highlighted in red, below). Running the fix mentioned above has proved ineffective since mDNSResponder.exe and mdnsNSP.dll cannot be found. Also, no suspect entries are present in the registry.

Any ideas?



StartupList report, 2008-08-27, 13:58:50
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows Vista SP1 (WinNT 6.00.1905)
Detected: Unable to get Internet Explorer version!

* Using default options


Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


Listing of startup folders:

Shell folders Common Startup:

[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe


Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\Windows\system32\userinit.exe,


Autorun entries from Registry:

ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
Windows Defender = %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl = RtHDVCpl.exe
Persistence = C:\Windows\system32\igfxpers.exe
osCheck = "C:\Program Files\Norton 360 Premier Edition\osCheck.exe"
Kernel and Hardware Abstraction Layer = KHALMNPR.EXE
ISUSScheduler = "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
IgfxTray = C:\Windows\system32\igfxtray.exe
HotKeysCmds = C:\Windows\system32\hkcmd.exe
dscactivate = c:\dell\dsca.exe 3
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


Autorun entries in Registry subkeys of:




Shell & screensaver key from C:\Windows\SYSTEM.INI:

Shell=*INI file not found*
SCRNSAVE.EXE=*INI file not found*
drivers=*INI file not found*

Shell & screensaver key from Registry:

SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*


Enumerating Browser Helper Objects:

NCO 2.0 IE BHO - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}
Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll - {6D53EC84-6AAE-4787-AEEE-F4628F01010C}


Enumerating Download Program Files:

[UploadListView Class]
InProcServer32 = C:\Windows\Downloaded Program Files\UploaderX.dll
CODEBASE = http://picasaweb.google.com/s/v/27.38/uploader2.cab

CODEBASE = http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab

[Shockwave Flash Object]
InProcServer32 = C:\Windows\system32\Macromed\Flash\Flash9f.ocx
CODEBASE = https://fpdownload.macromedia.com/get/flash...ent/swflash.cab


Enumerating Winsock LSP files:

NameSpace #1: C:\Windows\system32\NLAapi.dll
NameSpace #2: C:\Windows\system32\napinsp.dll
NameSpace #3: C:\Windows\system32\pnrpnsp.dll
NameSpace #4: C:\Windows\system32\pnrpnsp.dll
NameSpace #7: C:\Program Files\Bonjour\mdnsNSP.dll (file MISSING)


Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\PROGRA~2\Symantec\SyKnAppS\128643023050787575_19707477-7419-11DD-A073-001AA09680C0.TMP||C:\Windows\LMI2AFD.tmp\LMIRhook.000.dll||C:\Windows\LMI2AFD.tmp\lmi_rescue.exe||C:\Windows\LMI2AFD.tmp\rahook.dll||C:\Windows\LMI2AFD.tmp||C:\Windows\LMI2AFD.tmp\LMIRhook.000.dll||C:\Windows\LMI2AFD.tmp|||.


Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\Windows\system32\webcheck.dll

End of report, 5,612 bytes
Report generated in 0.031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

#4 hamluis



  • Moderator
  • 56,434 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:01 PM

Posted 27 August 2008 - 02:12 PM

If the file does not currently exist on your system...maybe it did at one time...and it left a startup item pointing to the program which now is absent.

If so, you can use AutoRuns for Windows - http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx to find it and disable it or remove it (your preference). I suggest you look on the tab marked Logon.


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users