System trying to load awvtt.dll

Viruses and worms
1

I have two accounts on my Windows XP Pro SP2 the one I use (password protected) and a Guest account (no password), the first one seems to have no problems but the guest account any time I open it it shows soon a pop-up with a message like this:

RUNDLL
Error loading C:|Windows|System32|awvtt.dll
Impossible to find the specified module

There is no awvtt.dll file on my computer but it looks like something is trying to load it. I am using Avast Home Edition 4.8 and SpywareBlaster up to date but nothing wrong is detected.

I have also another problem which I am not sure concerns a malicious activity or it depends on a bug in the Microsoft Windows Update. Trying to update to SP3 the update stops saying that I have not enough space on disk and at least 4 M are required, this seems do not make too much sense since I have 170 G of disk and only 20,5 G are used.

Any help would be appreciated.

2

I think you have a serious infection. Hopefully, someone can help you with it very soon. In the mean time, I have gathered some information to help understand the problem you have.

Information about awvtt.dll from File.Net …

This dll file is a Browser Helper Object (BHO) that runs automatically every time you start your Internet browser. BHOs are not stopped by personal firewalls, because they are identified by the firewall as your browser itself. BHOs are often used by adware and spyware.

The program is not visible. There is no detailed description of this service. It is not a Windows system file. File awvtt.dll is located in the Windows folder, but it is not a Windows core file. It is able to change the behavior or monitor the Internet Explorer. awvtt.dll is able to monitor applications, manipulate other programs, record inputs.

Information about awvtt.dll from Prevx …

The filename is associated with the malware group SpywareQuake.Some files using the name AWVTT.DLL are also associated with the malware groups: ADWARE.VIRTUMONDE.ALH Trojan.Vundo ADWARE.VIRTUMONDE.GFN These files have no vendor, product or version information specified in the file header. [b]AWVTT.DLL has been seen to perform the following behavior(s):[/b] The Process is packed and/or encrypted using a software packing process Registers a Dynamic Link Libray (DLL) File The Process is polymorphic and can change its structure This Process uses Anti Dissasembly Tricks [b]AWVTT.DLL has been the subject of the following behavior(s):[/b] Added as a Winlogon Notification DLL to automatically load on system start up Enabled as an In Process Object/Server - Common with DLL Injections Created as a process on disk Registered as a Dynamic Link Library File The process is hooked into all running processes which could allow it to take control of the system or record keyboard input, mouse activity and screen contents Registered as a Dynamic Link Libray (DLL) File Added as a Registry auto start to load Program on Boot up
3

I suggest:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on.
  4. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
4

Ok here are the logs but it seems (if I am not wrong) that nothing was found after all the steps except for some adware tracking cookie which I use to clean up periodically by hands.

As I wrote before the pop-up warning that awvtt.dll cannot be found appears only in the guest account and in effect there is not any file with that name on my computer but there is some other application who is trying to call it. I thing is what I have to understand from that pop-up message. Am I wrong?
Do I have to do a skan also on the guest account? I suppose not since I have done it as administrator, of course I am not an expert and I may be wrong.

The real problem I have is that I can’t update to SP3 with a not enough space motivation when there are 150 GB of free space. I hope some body on this forum could help me to understand if that is a matter of infection or is a Windows Update problem.

5

Please, post a screenshot (see how: http://forum.avast.com/index.php?topic=8982.0).
You can use Gadwin PrintScreen to get a screenshot (http://www.gadwin.com/printscreen/) or the free version of WinSnap 1.1.10 (http://www.filehippo.com/download_winsnap/?2173).

You’re right.

Which is the exactly error (and error number) of Windows Update?

6

Here is the screenshot

http://www.felixonedst.com/prova/screen.jpg

The translated message is in the first message.

No error number for the Windows Update, it says that there is not enough space on disk and that at least 4 Mb are required.

7

Ok latest update of SuperAntiSpyware fixed the awvtt.dll problem. The Windows Update problem still remain I guess I have to notify it to Microsoft support.