Corrupt ping.exe ?

[Guest]

http://www.diskusjon.no/uploads/post-29604-1136447071.jpg

Error message in English:
The NTVDM CPU has encountered an illegal instruction.


What can possibly be the reason for this?
I don`t want to re-install just because of this, and I`m must get ping.exe
to work

 

[Guest]

Problem solved!

I was infected by a worm called Alcan and in the system32 folder there was a
file named ping.com

I deleted the infected files using Lavasoft Adaware.

But when looking through the system32 folder I see some suspicious files;
cmdial32.dll
cmdl32.exe

Are these normal Windows-files?

Before I got this problem I installed the free, sponsored version of
Bearshare.
I will never touch that shit again.

 

[Wesley Vogel]

You probably have a trojan/virus/worm.

ping.com and not ping.exe is trying to open. Since ping.com is not a real
useful file, you get the error message. If you do not type an extension and
you have ping.com, that opens instead of the real file ping.exe.

ping.exe and cmd.exe are not part of the 16 bit MS-DOS Subsystem and should
give no 16 bit MS-DOS Subsystem errors unless you have screwed up files.

Try ping.exe www.vg.no in a command prompt just to see if it works.

Update your antivirus software and run a complete scan!!!

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[David H. Lipman]

From: "jering" <[email protected]>

| http://www.diskusjon.no/uploads/post-29604-1136447071.jpg
|
| Error message in English:
| The NTVDM CPU has encountered an illegal instruction.
|
| What can possibly be the reason for this?
| I don`t want to re-install just because of this, and I`m must get ping.exe
| to work


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *