Need Help: Serious Malware infection from Antispy Protector 2009

I ‘m experiencing some serious problems with my computer. About three weeks ago Icomputer noticed this program pop up on my computer AntiSpy Protector 2009 . I immediately started Malware Bytes to get rid of this program but all it did was change into another progam called Windows Antivirus Pro. I read the article on the front py Prtector 2009, and here is a list of problems I’m having:

1. I receive this message whenever Iget to the desktop screen – Windows cannot find `logon.exe`. Make sure you typed the name correctly, and then try again. To search for a file click the Start Button and then click search.

2. Also while this message in number 1 is showing, these pop-ups are occurring C:\WINDOWS\System32\ntvdm.exe and C:\WINDOWS\System32\desot.exe about three to four windows.

3. I can only open Internet Explorer all other programs like HiJack This, Malware Bytes, I-tunes, etc. don’t open and I get to following pop-up: Can’t load VDM IPX/SPX support Program too big to fit in memory.

4. Also, This program keeps popping up every 30 seconds (Windows Antivirus Pro)

5. Lastly, when I try and start my computer in safe mode, I get a blue screen with this message:

A problem has been detected and windows has been shut down to prevent damage to your computer.

If this the first time you’ve seen this stop error screen, restart your computer. If this screen appears again follow these steps: Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check our hard drive to make sure it is properly configured and terminated. Run CHKDSK/F to check for hard drive corruption, and then restart your computer.

Sorry this is so long but I wanted you guys to know exactly what was going on. Also, I don’t have any virus protection on the computer and my computer is a Dell Dimension E510. Can my computer be fixed?

Exact same problem. it will run firefox but all other programs it blocks. ...including Webroot.

will not run MalwarBytes even if filename is changed....

ran in safe mode and but it still would not allow me to open any programs.


Did you find a fix?....

Exact same problem. it will run firefox but all other programs it blocks. ...including Webroot.

will not run MalwarBytes even if filename is changed....

ran in safe mode and but it still would not allow me to open any programs.


Did you find a fix?....

No, no one has replied to help.

ok...well i still have this apparent rootkit virus..... BUT i was able to run my (Malwarebytes and WebRoot) programs....by right clicking the exe file and selecting Run As.... and choosing administrator.....

scanning now and hopefully will be headed in the right direction...


hope this helps...

Malwarebytes found a registry data infection..... and it looks like it could be the culprit....i remove it after this posting and we will see what happens....

Here is the info Malwarebytes found..



VENDOR: BROKEN.OPENCOMMAND

CATEGORY: REGISTRY DATA

ITEMS: HKEY_CLASSES_ROOT\EXEFILE\SHELL\OPEN\COMMAND\

OTHER: BAD:(C:\WINDOWS\SYSTEM32\DESOT.EXE "%1" %*) GOOD: ("%1" %*)

ACTION TAKEN: No Action Taken

BINGO! I can now open all of my programs.....

After removal I was asked to Restart...and now I can use all programs as normal.


I hope you have the same luck.

Blessings,
Fireeye

Thanks for replying Fireeye, but running as administrator didn't work because I don't remember the administrative password. Sad I know but it's been like 4 years since I've had this computer.

Damn, is there anyone out there that can help me with this problem? If I'm screwed will the experts just tell me that so I can stop hoping for a solution. I'm in begging mode now

you could try running a password finder like this.... http://projectw.org/viewtopic.php?f=23&...p;hilit=Spotmau

you would have to run it in safemode....and that itself may not work based on the program info....

have you tried to find the file... VENDOR: BROKEN.OPENCOMMAND

CATEGORY: REGISTRY DATA

ITEMS: HKEY_CLASSES_ROOT\EXEFILE\SHELL\OPEN\COMMAND\

OTHER: BAD:(C:\WINDOWS\SYSTEM32\DESOT.EXE "%1" %*) GOOD: ("%1" %*)

ACTION TAKEN: No Action Taken


try to search it....perhaps by removing it...it will allow you to run your spyware/ rootkit killing programs.....



the other thing I saw was perhaps trying to partition your drive and load another version of XP (i.e. OS) to that new partition and your windows password would be blank....

I am still digging to find "the solution".... once you can run as admin I am pretty sure it will get rid of this bug....it worked for me and I had the exact same problems.