16-bit MS-DO Subsystem

[Guest]

I have received this message recently:

C:\WINNT\system32\cmd.com
The NTVDM CPU has encountered an illegal instruction
CS:0070 IP:00eb OP:fe 10 00 c0 15 Choose 'Close' to terminate the application.

Does anyone know what this pertains to. Also, I noticed the System32 folder
in WINNT is missing. I need help with ASAP because it has completed
disrupted my network and online access. thanks in advance.
Sam

 

[Pegasus \(MVP\)]

I have received this message recently:

C:\WINNT\system32\cmd.com
The NTVDM CPU has encountered an illegal instruction
CS:0070 IP:00eb OP:fe 10 00 c0 15 Choose 'Close' to terminate the application.

Does anyone know what this pertains to. Also, I noticed the System32 folder
in WINNT is missing. I need help with ASAP because it has completed
disrupted my network and online access. thanks in advance.
Sam

If your system32 folder was really missing then you would not
be able to run Windows. The folder is probably hidden.

The error message you see was triggered by some 16-bit
application, probably a legacy application. What were you
running at the time? Did you reboot the machine to see if
the problem persists?

 

[Guest]

To be honest with you I have no idea what program was run at the time this
happened. I noticed my internet access was acting erratic, I went to
start/run, cmd, to check on the ip configuration, and that was when the
subsystem error came up. I rebooted the machine several times but the
problem persists. I tried to use the windows setup disks to repair the issue
but that didn't help either. Also, I found the system32 folder. It was
hidden like you said.

 

[Pegasus \(MVP\)]

Although you don't say so, I suspect that you are
attempting to run ipconfig to get your IP address
details. You should mention these things - they are
essential for the trouble-shooting process!

I also suspect that your machine is infected with
spyware or malware. Have a look for files such
as cmd.com or ipconfig.com. They are not part
of Windows - the correct names are cmd.exe and
ipconfig.exe. These files are probably responsible
for your problems. Rename them to cmd.co and
ipconfig.co and see what ahppens.

 

[Guest]

I found the cmd.com file in the system32 folder. I renamed the file cmd.co
but the same problem still exists. I also did a search for the ipconfig.com
file but that is not present. Could I rename the cmd.com file to cmd.exe?
Do you think this might correct the problem? Please let me know when you
can. Thanks

 

[Pegasus \(MVP\)]

You have confirmed my suspicion - your machine is infested
with malware. There are very few .com files under Win2000,
and neither cmd.com nor ipconfig.com is one of them. They
are called cmd.exe and ipconfig.exe and they reside in the
c:\winnt\system32 folder. Renaming a bad .com file to .exe
makes the problem worse, not better.

Let's have a look at your machine! Do this:
- Click Start / Run / c:\winnt\system32\cmd.exe {OK}
- Type these commands:
dir /s c:\winnt\*.com > c:\test.txt {Enter}
c:\winnt\system32\notepad.exe c:\test.txt {Enter}
- Paste the contents of this text file into your reply.

 

[Guest]

Here is the info you requested: I guess from the looks of things I got
nailed pretty good.

Volume in drive C has no label.
Volume Serial Number is 9800-E815

Directory of c:\winnt\assembly\GAC

08/09/2006 11:57p <DIR> Intuit.Spc.Map.EntitlementClient.Common
0 File(s) 0 bytes

Directory of c:\winnt\assembly\GAC_MSIL

07/12/2006 03:03a <DIR> Microsoft.VisualBasic.Compatibility
0 File(s) 0 bytes

Directory of c:\winnt\Microsoft.NET\Framework\v2.0.50727\CONFIG

09/23/2005 08:28a 42,927 machine.config.comments
09/23/2005 08:28a 56,960 web.config.comments
2 File(s) 99,887 bytes

Directory of c:\winnt\ServicePackFiles\i386

07/22/2002 01:05p 50,620 command.com
06/19/2003 03:05p 10,512 diskcomp.com
06/19/2003 03:05p 8,464 diskcopy.com
06/19/2003 03:05p 34,064 format.com
07/22/2002 01:05p 34,724 ntdetect.com
07/22/2002 01:05p 20,614 startrom.com
6 File(s) 158,998 bytes

Directory of c:\winnt\system32

12/07/1999 04:00p 8,464 chcp.com
07/22/2002 01:05p 50,620 command.com
06/19/2003 03:05p 10,512 DISKCOMP.COM
06/19/2003 03:05p 8,464 DISKCOPY.COM
12/07/1999 04:00p 69,886 edit.com
06/19/2003 03:05p 34,064 FORMAT.COM
12/07/1999 04:00p 34,576 graftabl.com
12/07/1999 04:00p 19,694 graphics.com
12/07/1999 04:00p 14,710 kb16.com
12/07/1999 04:00p 1,131 loadfix.com
12/07/1999 04:00p 20,752 mode.com
12/07/1999 04:00p 16,656 more.com
12/07/1999 04:00p 12,560 tree.com
12/07/1999 04:00p 24,848 win.com
14 File(s) 326,937 bytes

Directory of c:\winnt\system32\reminst

07/22/2002 01:05p 20,614 startrom.com
1 File(s) 20,614 bytes

Total Files Listed:
23 File(s) 606,436 bytes
2 Dir(s) 97,061,310,464 bytes free

 

[Pegasus \(MVP\)]

Your list looks fine - all .com files shown are valid Win2000
files, with the exception of startrom.com. I don't know what
it is - disable it by renaming it to startrom.co and see what
happens.

Going back to your original problem: Does it still happen,
and if so, what are the exact circumstances under which it
occurs?

 

[Guest]

I renamed the files ( I found them in 2 places) and rebooted the system.
Still have the same problem. I will go to start/run and type 'cmd' and I get
the same message. Also the window that opens up is cmd.co. This is why I
asked about renaming it. Or if I removed it could I copy it from somewhere
else? I have a problem with my network and I need to get into the ms-dos
system to possibly locate the problem. Thanks

 

[Pegasus \(MVP\)]

What happens when you type this instead:
c:\winnt\system32\cmd.exe

You can, of course, restore the original from the
i386 folder of your Win2000 installation CD.

 

[Guest]

When I type in "C:\winnt\system32\cmd.exe", system32 opens. When I type
cmd.exe, Documents and Settings open. I'll have to contact my ISP to check
on the internet connection problem because everything looks correct in my
configuration. Right now I have disconnected everything so I can find out
why I have no internet connection. Any other advise you can give would be
greatly appreciated. Thanks...Sam

 

[Pegasus \(MVP\)]

This is getting curiouser and curiouser (forgive my
English). When you type "c:\winnt\system32\cmd.exe"
or when you double-click this file name from within
Explorer then you are supposed to get a Command
Prompt, not a view of the System32 folder. Does the
file "c:\winnt\system32\cmd.exe" exist? What is its size?
its date stamp?

There is little point in trying to fix your Internet connection
until you get the basic stuff sorted out. The Command
Processor is about as basic as you can go.

 

[Guest]

Excuse my stupidity, when I type those commands they do open a command
prompt. But what confuses me is that when I open the command prompt it used
to say "C:\Documents and Settings\Admin Plus," but now it opens 2 different
folders in the command prompt.

 

[Pegasus \(MVP\)]

Fine, now that we know that your Command Processor
works we can move on to your connectivity issue. Ignore
the starting folder for the Command Prompts. This is a
minor issue that is resolved either by tweaking the shortcut
you use or a registry hack.

You say that you have no Internet connectivity but I don't
think you ever said HOW you normally connect to the
Internet. Dial-up modem? ADSL modem? ADSL router/
modem? If you have an ADSL router modem, what is its
IP address? Do its diagnostics say that it has a live connectiion?

 

[Guest]

ok, I have a adsl router and modem. IP address for system is 192.168.1.102,
gateway is 192.168.1.1, dns is 192.168.254.254. I have a live connection
because other systems connected to the router are working fine. In the modem
diagnostics however it states I can ping the gateway but it fails Pinging the
primary Domain Name Server.

 

[Pegasus \(MVP\)]

This is hardly surprising with a dns of 192.168.254.254.
If you compare it with your other systems then you will
probably find that the dns should be 192.168.1.1 or
perhaps the dns address issued by your ISP.

 

[Guest]

You were absolutely correct. I contacted my ISP and there has been a change.
My DNS now has a new primary and secondary address. I have changed the
address's and it seems everything is back to normal. Thank you for all your
help. If I didn't have you guys to help me with some of these matters I
don't know what I would do. Once again, thanks...Sam

 

[Guest]

Sorry I got ahead of myself. The same problem still exists with the command
prompt. I try to ping the router or the modem and the same message comes up
as stated in my first message. What do you think could be the trouble now.
This is getting very frustrating.

 

[Pegasus \(MVP\)]

For better clarity of your posts, try to be highly specifc.
Instead of writing "the same problem" and "with the Command
Prompt", you might say: "I can open a Command Prompt
but when I run ipconfig.exe then I get a 16-bit MS-DOS
error". This would avoid a lot of guesswork and running
around in circles.

The answer is simple:
- Start a Command Prompt, using c:\winnt\system32\cmd.exe.
- Type the full name, i.e. c:\winnt\system32\ipconfig.exe
- If the problem persists, replace ipconfig.exe from your Win2000 CD.
- Report the result.

Sorry I got ahead of myself. The same problem still exists with the command
prompt. I try to ping the router or the modem and the same message comes up
as stated in my first message. What do you think could be the trouble now.
This is getting very frustrating.

some

 

[Guest]

ok, I can view the command prompt, and I can view ipconfig.exe. But when I
try to ping the router or the modem I receive the following message,
"c:\winnt\system32\cmd.exe - ping 192.168.1.1 The NTVDM CPU has encountered
an illegal instruction. CS:0070 IP:00eb OP:fe 10 00 c0 15 Choose 'close' to
terminate the application." I have no idea what is causing this problem. As
you know, if I cannot ping the router or the modem I cannot connect to the
internet. Where do I go next?
Thanks.