Jump to content

First "rogram too big to fit in memory" now explorer.exe isn't running


Recommended Posts

As you can probably tell by the title, a machine I've been working on is infected with Windows AV PRO.. Everytime I attempt to open a program I get a command prompt box that flashes briefly with the text "Program too big to fit in memory". This prevents me from running any antispyware software.I found a forum on the internet saying that the file c:\windows\system32\desot.exe was responsible for this issue. i moved it to the recycling bin and was able to open programs again, but as soon as I tried hitting the MBAM site explorer.exe crashed. I attempted to reopen it from task manager and it came up with the "choose a program to run explorer.exe" window... no good

I booted into safemode and was able to open to the command prompt by manually specifying that I wanted to use c:\windows\system32\cmd.exe to open cmd.exe and ran the install/scan of mbam from there.... but it closed it out as soon as the scan started. now it's saying access is denied when I try to manually run it. I was able to install hijack this as well and midway through the scan the same thing happens. I don't have any logs because it couldn't out put any.

Link to post
Share on other sites

  • Root Admin

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  1. If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".

[*]During the download, rename Combofix to Combo-Fix as follows:

CF_download_FF.gif

CF_download_rename.gif

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    -----------------------------------------------------------


  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

If this doesn't work either, try the same method (above method), but name Combofix.exe to iexplore.exe instead, or winlogon.exe..

This because It also happens in some cases that malware blocks EVERY process except for what is in its own whitelist, so this whitelist also includes system important processes such as iexplore.exe, explorer.exe, winlogon.exe...

Link to post
Share on other sites

Combo fix will run for a split second then close out. If I try to run it again the response is ACCESS IS DENIED. this happens with any anti spyware software I run. infact, I have to open a command prompt and use the command "cacls" to clear the acl on explorer.exe just to get to the desktop... is there something I can boot to to clear this out?

Link to post
Share on other sites

  • Root Admin

Download and run Win32kDiag:

  1. Download Win32kDiag from any of the following locations and save it to your Desktop.

[*]Double-click Win32kDiag.exe to run Win32kDiag and let it finish.

[*]When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.

[*]Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic, please do not attach the file.

Please let it run for at least an hour without bothering it regardless of what it says. Then post back the log.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.