NTVDM CPU

[Guest]

If I type regedit in RUN I get "the NTVDM CPU has encountered an illegal
instruction message". I run full scans from Norton, Freedom and Panda and
eliminated the W32.Alcan.A virus. However I still have the problem.

Also, I can't see the System 32 file in Windows Explorer. It's there but
the computer won't let me reinstall the file from Windows CD indicating that
the NTDLL.dll file cannot be replaced. I can install it under a different
name.

 

[Wesley Vogel]

Try typing regedit.exe in the Run box.

Try typing %windir%\regedit.exe in the Run box.

Chances are that you have or had a virus\trojan\worm and you have a file
named regedit.com that is trying to open instead of the real regedit.exe.

If typing regedit.exe or %windir%\regedit.exe opens the Registry Editor, do
a Search for regedit.* on your machine and delete anything regedit.??? that
is not regedit.exe, regedit.chm or regedit.hlp. regedit.chm and regedit.hlp
are help files.

NTVDM.exe only runs with 16-bit files like regedit.com or what NTVDM.exe
thinks are 16-bit files.

Use this for referrence when you Search...
HOW TO: Search For Hidden Or System Files In Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;302347

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog box?

Also, I still can't see the System32 folder in Windows Explorer or anywhere
in my computer

 

[Wesley Vogel]

Hi Al,

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog
box?

Yes. You should get rid of the files added by the virus\trojan\worm.

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

What happens if you type: system32 in the Run box?

I think that system32 is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files labeled
System and Hidden) in Windows Explorer.These files are required to start and
run Windows. Deleting or editing them can make your computer inoperable.Are
you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

What those settings do...

Display the contents of system folders
[[Shows the contents of system folders. System folders, such as your system
drive (usually drive C, unless you have more than one drive on your
computer), Program Files, Documents and Settings, and Windows, contain files
your computer needs to work properly. The contents of these folders are
hidden by default.]]

Show hidden files and folders
[[Specifies that hidden files appear in the list of files in Windows
Explorer. ]]

Hide extensions for known file types
[[Hides the last part of a file name, reducing clutter in folder windows.]]

Hide protected operating system files (Recommended)
[[Specifies that operating system files do not appear in the list of files
in this folder in order to protect them from being deleted or changed
accidentally.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

How can I get rid of the file? I've used Norton and Panda and nothing. I ran
regedit.com and regedit.* in the computer and on the registry separately.
Regedit.com only showed up in the registry and I deleted it only to see it
back twice when I booted. I turned off the System Restore and deleted
regedit.com to no avail. Search won't find C: Windows\System32\regedit.com

Hi Al,

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog
box?

Yes. You should get rid of the files added by the virus\trojan\worm.

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

What happens if you type: system32 in the Run box?

I think that system32 is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files labeled
System and Hidden) in Windows Explorer.These files are required to start and
run Windows. Deleting or editing them can make your computer inoperable.Are
you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

What those settings do...

Display the contents of system folders
[[Shows the contents of system folders. System folders, such as your system
drive (usually drive C, unless you have more than one drive on your
computer), Program Files, Documents and Settings, and Windows, contain files
your computer needs to work properly. The contents of these folders are
hidden by default.]]

Show hidden files and folders
[[Specifies that hidden files appear in the list of files in Windows
Explorer. ]]

Hide extensions for known file types
[[Hides the last part of a file name, reducing clutter in folder windows.]]

Hide protected operating system files (Recommended)
[[Specifies that operating system files do not appear in the list of files
in this folder in order to protect them from being deleted or changed
accidentally.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog
box?

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

 

[Guest]

I typed System32 In Run and it tells me that the file doesn't exist.

Hi Al,

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog
box?

Yes. You should get rid of the files added by the virus\trojan\worm.

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

What happens if you type: system32 in the Run box?

I think that system32 is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files labeled
System and Hidden) in Windows Explorer.These files are required to start and
run Windows. Deleting or editing them can make your computer inoperable.Are
you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

What those settings do...

Display the contents of system folders
[[Shows the contents of system folders. System folders, such as your system
drive (usually drive C, unless you have more than one drive on your
computer), Program Files, Documents and Settings, and Windows, contain files
your computer needs to work properly. The contents of these folders are
hidden by default.]]

Show hidden files and folders
[[Specifies that hidden files appear in the list of files in Windows
Explorer. ]]

Hide extensions for known file types
[[Hides the last part of a file name, reducing clutter in folder windows.]]

Hide protected operating system files (Recommended)
[[Specifies that operating system files do not appear in the list of files
in this folder in order to protect them from being deleted or changed
accidentally.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks. I did type regedit.exe and works. However, is there a problem I
should be concern about because "regedit" opens the regedit.com dialog
box?

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

 

[Wesley Vogel]

Where is regedit.com at in the registry? In what registry key name?

This is an example of a registry key name...
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To copy a registry key name

1. In the registry tree (on the left), click a registry key.
2. On the Edit menu, click Copy Key Name.
3. Paste the name of the registry key into another program or document.

Or...

1. In the registry tree (on the left), right click a registry key.
2. Select Copy Key Name.
3. Paste the name of the registry key into another program or document.

Will Search find regedit.com anywhere on your machine?


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

How can I get rid of the file? I've used Norton and Panda and nothing. I
ran regedit.com and regedit.* in the computer and on the registry
separately. Regedit.com only showed up in the registry and I deleted it
only to see it back twice when I booted. I turned off the System Restore
and deleted regedit.com to no avail. Search won't find C:
Windows\System32\regedit.com

Hi Al,

Thanks. I did type regedit.exe and works. However, is there a problem
I should be concern about because "regedit" opens the regedit.com dialog
box?

Yes. You should get rid of the files added by the virus\trojan\worm.

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

What happens if you type: system32 in the Run box?

I think that system32 is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files
labeled System and Hidden) in Windows Explorer.These files are required
to start and run Windows. Deleting or editing them can make your
computer inoperable.Are you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

What those settings do...

Display the contents of system folders
[[Shows the contents of system folders. System folders, such as your
system drive (usually drive C, unless you have more than one drive on
your computer), Program Files, Documents and Settings, and Windows,
contain files your computer needs to work properly. The contents of
these folders are hidden by default.]]

Show hidden files and folders
[[Specifies that hidden files appear in the list of files in Windows
Explorer. ]]

Hide extensions for known file types
[[Hides the last part of a file name, reducing clutter in folder
windows.]]

Hide protected operating system files (Recommended)
[[Specifies that operating system files do not appear in the list of
files in this folder in order to protect them from being deleted or
changed accidentally.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks. I did type regedit.exe and works. However, is there a problem
I should be concern about because "regedit" opens the regedit.com dialog
box?

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

:

Try typing regedit.exe in the Run box.

Try typing %windir%\regedit.exe in the Run box.

Chances are that you have or had a virus\trojan\worm and you have a
file named regedit.com that is trying to open instead of the real
regedit.exe.

If typing regedit.exe or %windir%\regedit.exe opens the Registry
Editor, do a Search for regedit.* on your machine and delete anything
regedit.??? that is not regedit.exe, regedit.chm or regedit.hlp.
regedit.chm and regedit.hlp are help files.

NTVDM.exe only runs with 16-bit files like regedit.com or what
NTVDM.exe thinks are 16-bit files.

Use this for referrence when you Search...
HOW TO: Search For Hidden Or System Files In Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;302347

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In al <[email protected]> hunted and pecked:
If I type regedit in RUN I get "the NTVDM CPU has encountered an
illegal instruction message". I run full scans from Norton, Freedom
and Panda and eliminated the W32.Alcan.A virus. However I still have
the problem.

Also, I can't see the System 32 file in Windows Explorer. It's there
but the computer won't let me reinstall the file from Windows CD
indicating that the NTDLL.dll file cannot be replaced. I can install
it under a different name.

 

[Wesley Vogel]

I don't know why that doesn't work.

Try typing: %windir%\system32 into the Run box.

Does anything open? If something does you can copy the path from the
Address bar.

Or do a Search for system32. When found you can right click and select Open
Containing Folder to open the folder or just double click it.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

I typed System32 In Run and it tells me that the file doesn't exist.

Hi Al,

Thanks. I did type regedit.exe and works. However, is there a problem
I should be concern about because "regedit" opens the regedit.com dialog
box?

Yes. You should get rid of the files added by the virus\trojan\worm.

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

What happens if you type: system32 in the Run box?

I think that system32 is a Hidden folder.

To display Hidden files and folders...

Start | Settings | Control Panel | Folder Options | View tab
Check:
Display the contents of system folders
and
Show hidden files and folders
UNCheck:
Hide extensions for known file types
and
Hide protected operating system files (Recommended)
Click Apply | Click OK

When you uncheck: Hide protected operating system files,
you will get this message...

Warning
----------
You have chosen to display protected operating system files (files
labeled System and Hidden) in Windows Explorer.These files are required
to start and run Windows. Deleting or editing them can make your
computer inoperable.Are you sure you want to display these files?
----------

Click YES.

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

What those settings do...

Display the contents of system folders
[[Shows the contents of system folders. System folders, such as your
system drive (usually drive C, unless you have more than one drive on
your computer), Program Files, Documents and Settings, and Windows,
contain files your computer needs to work properly. The contents of
these folders are hidden by default.]]

Show hidden files and folders
[[Specifies that hidden files appear in the list of files in Windows
Explorer. ]]

Hide extensions for known file types
[[Hides the last part of a file name, reducing clutter in folder
windows.]]

Hide protected operating system files (Recommended)
[[Specifies that operating system files do not appear in the list of
files in this folder in order to protect them from being deleted or
changed accidentally.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks. I did type regedit.exe and works. However, is there a problem
I should be concern about because "regedit" opens the regedit.com dialog
box?

Also, I still can't see the System32 folder in Windows Explorer or
anywhere in my computer

:

Try typing regedit.exe in the Run box.

Try typing %windir%\regedit.exe in the Run box.

Chances are that you have or had a virus\trojan\worm and you have a
file named regedit.com that is trying to open instead of the real
regedit.exe.

If typing regedit.exe or %windir%\regedit.exe opens the Registry
Editor, do a Search for regedit.* on your machine and delete anything
regedit.??? that is not regedit.exe, regedit.chm or regedit.hlp.
regedit.chm and regedit.hlp are help files.

NTVDM.exe only runs with 16-bit files like regedit.com or what
NTVDM.exe thinks are 16-bit files.

Use this for referrence when you Search...
HOW TO: Search For Hidden Or System Files In Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;302347

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In al <[email protected]> hunted and pecked:
If I type regedit in RUN I get "the NTVDM CPU has encountered an
illegal instruction message". I run full scans from Norton, Freedom
and Panda and eliminated the W32.Alcan.A virus. However I still have
the problem.

Also, I can't see the System 32 file in Windows Explorer. It's there
but the computer won't let me reinstall the file from Windows CD
indicating that the NTDLL.dll file cannot be replaced. I can install
it under a different name.

 

[Guest]

Hi Wesley. You've being very helpful so far. Thanks. I deleted the
regedit.com from the registry but didn't see from which directory. I still
can't run regedit or cmd or System32 from the Run box although if I type on
both .exe I can get in. Looking at the registry hoever I did find
HKEY_CLASSES_ROOT\Applications\regedit.exe. The value on the right side is
NoOpenWith. Does it mean anything? Whatever is causing the problem must be
related to the System32 folder.

 

[Guest]

Hi again
I just turn on Restore System and C:\Windows\system32\regedit.com and
C:\Windows\system32\cmd.com came back at
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache. Please
advice.

 

[Wesley Vogel]

Hi Al,

If the Data column is blank, no entry at all, all it means is that
regedit.exe will not be listed in the Open With list when you right click a
file and select Open With. I have the same thing in my registry.

HKEY_CLASSES_ROOT\Applications\regedit.exe
Value Name: NoOpenWith
Data Type: REG_SZ
Value Data:

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Wesley Vogel]

#$%#$%#$%

I posted this once and didn't keep a copy and it looks like it got lost in
the ether.

System Restore restores the registry.

cmd.com and regedit.com were in the registry in your restore point. Delete
the references to cmd.com and regedit.com from the registry again after
you...

Update your antivirus software and run a full system scan.

Update whatever anti-spyware applications that you have and run a full
system scan with each one.

Chances are that you could have restored an infection of whatever
trojan\virus\worm that you had.

How antivirus software and System Restore work together
http://support.microsoft.com/default.aspx?scid=kb;en-us;831829

System Restore What's Restored and What's Not
http://bertk.mvps.org/html/tips.html#WhatsRestored

I think that is most of what I posted.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Thanks for your help. I used Ad-Aware SE Personal and solve the problem.
Seems like a very good product.

 

[Wesley Vogel]

Glad to hear it.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In