ntvdm.exe and desot.exe wreaking havoc

[solepixel]

Everything I try to run pops up a black DOS window first points to ntvdm.exe, then quickly changes to desot.exe, displays a message in the window "Program too big to fit in memory", then quickly closes. The program never launches, not directly or from a desktop shortcut.

I can log into Administrator in Safe Mode (and Standard Mode), I can run Task Manager, but not My Computer > Properties. IE nor Firefox will run.

It was working a few days ago (except for viruses). My sister-in-law gave it to me to fix. After running AVG, it found about 8 infections, however couldn't be removed because I did not know the Administrator password. I tried [blank/none] (along with several others) however it popped up a box that said it couldn't proceed.. something about trying to use a blank password... I now know that the Admin password is [nothing] because I just logged in today in Safe Mode. It doesn't do me much good though, because I can't run AVG anymore.

Please help! All I know is that it's running Windows XP (not sure which SP, probably 2).

Thanks.

[Rik_]

Download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

If you can't run it in normal mode, try safe mode first.

[solepixel]

As I mentioned before, trying to run ANY EXE files causes the 2 DOS windows to pop-up telling me the Program is too big to fit in memory. I downloaded this file, moved it over to the bad computer via USB Thumb drive, copied it to desktop, and double clicked it. The result was again, the same 2 DOS pop-up windows.

[Rik_]

If no .exe will run then I can't see a way of cleaning it.

[PhilliePhan]

You might try a bootable option similar to RecoveryConsole to gain access. Check these out:

Trinity Rescue Kit

Avira Rescue System

The Trinity Kit should give you a number of cleaning options.

Best Luck :)
PP

[PhilliePhan]

Actually, let's try something else - if we can....

-- Copy and paste the text in the box to Notepad and save it to your Desktop as Tasklist.bat
-- DoubleClick on it to run it. A log should pop up. Copy and paste that here for us.

@ECHO OFF

IF EXIST %systemdrive%\TSKLST.txt del %systemdrive%\TSKLST.txt
tasklist >> %systemdrive%\TSKLST.txt
notepad %systemdrive%\TSKLST.txt
del /q %systemdrive%\TSKLST.txt

Cheers :)
PP

[solepixel]

Sorry, after hearing that there was "nothing I can do", i threw linux mint into the disk drive, backed up their photos, documents, videos, etc, and formatted/reinstalled Windows.

Oh well, I did end up getting an external hard drive out of the deal, so thanks anyway.

[PhilliePhan]

Sorry, after hearing that there was "nothing I can do", i threw linux mint into the disk drive, backed up their photos, documents, videos, etc, and formatted/reinstalled Windows.

Sorry to hear that! There is a way to attack this malware, though when rootkits are involved, I usually recommend a format as the best option.

Due to the nature of this malware , I hope you didn't back up some bad along with the good.....

Cheers :)
PP