Member Avatar for solepixel

Everything I try to run pops up a black DOS window first points to ntvdm.exe, then quickly changes to desot.exe, displays a message in the window "Program too big to fit in memory", then quickly closes. The program never launches, not directly or from a desktop shortcut.

I can log into Administrator in Safe Mode (and Standard Mode), I can run Task Manager, but not My Computer > Properties. IE nor Firefox will run.

It was working a few days ago (except for viruses). My sister-in-law gave it to me to fix. After running AVG, it found about 8 infections, however couldn't be removed because I did not know the Administrator password. I tried [blank/none] (along with several others) however it popped up a box that said it couldn't proceed.. something about trying to use a blank password... I now know that the Admin password is [nothing] because I just logged in today in Safe Mode. It doesn't do me much good though, because I can't run AVG anymore.

Please help! All I know is that it's running Windows XP (not sure which SP, probably 2).

Thanks.

  • 3 Contributors
  • 7 Replies
  • 253 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

This thread describes a very common fake‑AV / file‑association infection pattern. was right to push a dedicated scanner, and was right to point at offline rescue approaches — the behavior you reported (NTVDM briefly, then desot.exe and a quick “Program too big to fit in memory” DOS box, and no EXE will run) is exactly what many removal guides report for rogue packages such as “Windows Antivirus Pro” and its clones; those kits typically drop desot.exe / dddesot.dll and companion files. (myantispyware.com)

What actually happens: the fake‑AV installs helper binaries and inserts hooks/registry entries so that double‑clicking an EXE is redirected into the malicious stub. When the 16‑bit loader/NTVDM tries to run that stub you get the DOS error and the real programs never start. Several removal threads document the same “Virtual Device Driver / 16‑bit subsystem” symptoms and show the same set of files. (forums.malwarebytes.com)

If you need to salvage the install instead of reformatting, there are safer steps to try from a clean environment (use a different PC to prepare tools). Two practical tricks when EXE files are hijacked: rename a trusted cleaning tool from .exe to .com and run it, or boot rescue media and run offline scans. If you can open an elevated command prompt, restoring the EXE association is often done with the built‑in commands (example — run as Administrator): 

assoc .exe=exefile
ftype exefile="%1" %*

Those commands are the documented method for fixing file‑type associations; many removal guides also recommend using tools like OTM (renamed to .com) or importing a small .INF fix when the shell is poisoned. Only perform these if comfortable — registry fixes can make things worse. (myantispyware.com)

When a rootkit or many system components are infected, reinstalling Windows is the fastest, safest fix (which ultimately did). If you want to try cleanup first, use current, vendor rescue ISOs (Kaspersky, ESET, etc.) to boot and scan offline, and always scan any user backups on a separate clean machine before restoring them. Reinstall, patch to current updates, and avoid unknown codec/installer sites to prevent reinfection. (help.eset.com)

Recommended Answers

All 7 Replies

Member Avatar for Rik_

Download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

If you can't run it in normal mode, try safe mode first.

Member Avatar for solepixel

As I mentioned before, trying to run ANY EXE files causes the 2 DOS windows to pop-up telling me the Program is too big to fit in memory. I downloaded this file, moved it over to the bad computer via USB Thumb drive, copied it to desktop, and double clicked it. The result was again, the same 2 DOS pop-up windows.

Member Avatar for Rik_

If no .exe will run then I can't see a way of cleaning it.

Member Avatar for PhilliePhan

You might try a bootable option similar to RecoveryConsole to gain access. Check these out:

Avira Rescue System

The Trinity Kit should give you a number of cleaning options.

Best Luck :)
PP

Member Avatar for PhilliePhan

Actually, let's try something else - if we can....

-- Copy and paste the text in the box to Notepad and save it to your Desktop as Tasklist.bat
-- DoubleClick on it to run it. A log should pop up. Copy and paste that here for us.

@ECHO OFF

IF EXIST %systemdrive%\TSKLST.txt del %systemdrive%\TSKLST.txt
tasklist >> %systemdrive%\TSKLST.txt
notepad %systemdrive%\TSKLST.txt
del /q %systemdrive%\TSKLST.txt

Cheers :)
PP

Member Avatar for solepixel

Sorry, after hearing that there was "nothing I can do", i threw linux mint into the disk drive, backed up their photos, documents, videos, etc, and formatted/reinstalled Windows.

Oh well, I did end up getting an external hard drive out of the deal, so thanks anyway.

Member Avatar for PhilliePhan

Sorry, after hearing that there was "nothing I can do", i threw linux mint into the disk drive, backed up their photos, documents, videos, etc, and formatted/reinstalled Windows.

Sorry to hear that! There is a way to attack this malware, though when rootkits are involved, I usually recommend a format as the best option.

Due to the nature of this malware , I hope you didn't back up some bad along with the good.....

Cheers :)
PP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.