Help! NTVDM error

[Guest]

XP Home When I start Windows I get the following message, which also appears
when I run anything from the Control Panel. The problem appears to be
preventing my PC recognising new hardware eg USB connection to a mobile phone
or a broadband ADSL modem.

C:\Windows\system32\rundll.exe
The NTVDM CPU has encountered an illegal instruction
CS:06ae IP:0100 OP:ff ff b7 c4 00

Can I fix this without reinstalling Windows? I have told I might need to
edit the Registry but don't have a clue how to do this.

 

[Wesley Vogel]

Update your antivirus software and run a full system scan.

NTVDM.EXE has nothing to do with rundll32.exe. NTVDM.exe also has nothing
to do with the Control Panel. Rundll32.exe loads the Control Panel.

NTVDM.EXE (NT Virtual DOS Machine) is used in conjuction with wow.exe to run
16-bit applications.

Opening the Control Panel should not start NTVDM.EXE.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

No luck! The error has been on my system for a while but not been a problem
until now as I can just close it and carry on with most tasks.

Any other ideas?

Thanks
John

 

[Wesley Vogel]

Hi John,

This will show what programs are started when you boot your machine.

Open System Information...
Start | Run | Type: msinfo32 | Click OK |
Click the [+] next to Software Environment |
Click on Startup Programs |

This will save the startup information to Startup.txt to your Desktop.

On the top toolbar, click on File | Click on Export | When the Export As
window opens, click on the Desktop icon | Use Startup for filename | Click
the Save button | Close System Information

Now go to your Desktop and locate Startup.txt, open it, right click and
select Select All, right click and select Copy.

Now paste what you just copied into a message and post back.
-----

rundll.exe is a Windows System process belonging to the Windows 95, 98 and
ME.

rundll32.exe is what's in Windows XP. If rundll.exe exists on your machine
it is part of LOXOSCAM or Backdoor.SchoolBus.B trojans.

Backdoor.SchoolBus.B
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.schoolbus.b.html

Backdoor.LoxoScam
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.loxoscam.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Here you go

System Information report written at: 10/08/05 19:41:45
System Name: DJX6X51J
[Startup Programs]

Program Command User Name Location
DESKTOP desktop.ini NT AUTHORITY\SYSTEM Startup
CTFMON.EXE c:\windows\system32\ctfmon.exe NT
AUTHORITY\SYSTEM HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DESKTOP desktop.ini DJX6X51J\Father John Startup
msnmsgr "c:\program files\msn messenger\msnmsgr.exe"
/background DJX6X51J\Father
John HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSMSGS "c:\program files\messenger\msmsgs.exe" /background DJX6X51J\Father
John HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DESKTOP desktop.ini .DEFAULT Startup
CTFMON.EXE c:\windows\system32\ctfmon.exe .DEFAULT HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DESKTOP desktop.ini All Users Common Startup
WinZip Quick Pick c:\progra~1\winzip\wzqkpick.exe All Users Common Startup
VSOCheckTask "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VirusScan Online c:\program files\mcafee.com\vso\mcvsshld.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VirusScan c:\progra~1\mcafee.com\vso\mcvsshld.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdateManager "c:\program files\common files\sonic\update
manager\sgtray.exe" /r All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SunJavaUpdateSched c:\program files\java\j2re1.4.2_03\bin\jusched.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RealTray c:\program files\real\realplayer\realplay.exe
systemboothideplayer All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PCMService "c:\program files\dell\media experience\pcmservice.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
OASClnt c:\program files\mcafee.com\vso\oasclnt.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MPFExe c:\progra~1\mcafee.com\person~1\mpftray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MessengerPlus3 "c:\program files\messengerplus! 3\msgplus.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MCUpdateExe c:\progra~1\mcafee.com\agent\mcupdate.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MCAgentExe c:\progra~1\mcafee.com\agent\mcagent.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelMeM c:\program files\intel\modem event monitor\intelmem.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTray c:\windows\system32\igfxtray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmds c:\windows\system32\hkcmd.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DVDLauncher "c:\program files\cyberlink\powerdvd\dvdlauncher.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dla c:\windows\system32\dla\tfswctrl.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BTopenworld "c:\program files\bt yahoo! internet\dialbtyahoo.exe"
/reinstallautodial All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Hi John,

This will show what programs are started when you boot your machine.

Open System Information...
Start | Run | Type: msinfo32 | Click OK |
Click the [+] next to Software Environment |
Click on Startup Programs |

This will save the startup information to Startup.txt to your Desktop.

On the top toolbar, click on File | Click on Export | When the Export As
window opens, click on the Desktop icon | Use Startup for filename | Click
the Save button | Close System Information

Now go to your Desktop and locate Startup.txt, open it, right click and
select Select All, right click and select Copy.

Now paste what you just copied into a message and post back.
-----

rundll.exe is a Windows System process belonging to the Windows 95, 98 and
ME.

rundll32.exe is what's in Windows XP. If rundll.exe exists on your machine
it is part of LOXOSCAM or Backdoor.SchoolBus.B trojans.

Backdoor.SchoolBus.B
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.schoolbus.b.html

Backdoor.LoxoScam
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.loxoscam.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

No luck! The error has been on my system for a while but not been a
problem until now as I can just close it and carry on with most tasks.

Any other ideas?

Thanks
John

 

[Guest]

Hi Wesley

I searched for both rundll.exe and rundll32.exe but only found the latter (3
times in CI386, SYSTEM32 and Service PackFiles/i386)

Error messages cite either. So far as I can tell just rundll on start up and
rundll32 in the Control Panel. Should I follow the instructions on the sites
you refer to?

Thanks
John

Hi John,

This will show what programs are started when you boot your machine.

Open System Information...
Start | Run | Type: msinfo32 | Click OK |
Click the [+] next to Software Environment |
Click on Startup Programs |

This will save the startup information to Startup.txt to your Desktop.

On the top toolbar, click on File | Click on Export | When the Export As
window opens, click on the Desktop icon | Use Startup for filename | Click
the Save button | Close System Information

Now go to your Desktop and locate Startup.txt, open it, right click and
select Select All, right click and select Copy.

Now paste what you just copied into a message and post back.
-----

rundll.exe is a Windows System process belonging to the Windows 95, 98 and
ME.

rundll32.exe is what's in Windows XP. If rundll.exe exists on your machine
it is part of LOXOSCAM or Backdoor.SchoolBus.B trojans.

Backdoor.SchoolBus.B
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.schoolbus.b.html

Backdoor.LoxoScam
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.loxoscam.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

No luck! The error has been on my system for a while but not been a
problem until now as I can just close it and carry on with most tasks.

Any other ideas?

Thanks
John

 

[Wesley Vogel]

Hi John,

I cleaned this up some and added comments or info about what something is
inside the [[ ]].

Nothing jumps out at me.

Jeez, you have a bunch of things that start at boot. McAfee sure adds a
bunch of crap.
------

What you're going to have to do is get rid of startup items one at a time
and keep rebooting until you find the offending entry.

Or uncheck the first half of the startup items, reboot and see if you still
get the error message. If you don't get the error message, then you have
narrowed it down to the second half. If you still get the error message,
recheck the first half of the items and then uncheck the last half of the
items, reboot and see if you get the error message.

You can keep narrowing it down until you find one offending startup item.

Make sure that you unplug the phone line to your modem while troubleshooting
as you will be disabling McAfee, your antivirus.

Open the System Configuration Utility...
Start | Run | Type: msconfig | Click OK |
Click the Startup tab.
UNCheck the first half of everything that's listed
Click the Apply button.
Click the Close button.
You will see this message...

[[You must restart your computer for some of the changes made by
System Configuration to take effect.]]

Click the Restart button.
Your machine will then reboot.

After your machine reboots, you will get the MSCONFIG Reminder Message...

[[You have used the System Configuration Utility to change the way Windows
starts.
The System Configuration Utility is currently in Diagnostic or Selective
Startup mode, causing this message to be displayed and the utility to run
every time Windows starts.
Choose the Normal Startup mode on the General tab to start Windows normally
and undo the changes you made using the System Configuration Utility.]]

Check: "Don't show this message or launch the System Configuration Utility
when Windows starts" and click OK.

You'll have to keep doing this until the guilty item is found. Since you
have a boatload of startup items, this will take a while.

Another way to troubleshoot this is, first make sure that you unplug the
phone line to your modem while troubleshooting as you will be disabling
McAfee, your antivirus. Then start killing off processes one at time with
the Task Manager and open the Control Panel after you kill each process.
When you stop getting the error message you should know what process you
killed. That is the guilty party.
---------

Startup Programs
CTFMON.EXE c:\windows\system32\ctfmon.exe
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[ctfmon.exe = CTF Loader. Part of Microsoft Office. It activates
the Alternative User Input Text Input Processor (TIP) and the Microsoft
Office XP Language Bar.]]

msnmsgr "c:\program files\msn messenger\msnmsgr.exe"/background
HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\
Microsoft\Windows\CurrentVersion\Run
[[msnmsgr.exe is the main executable for MSN Messenger, which is bundled
with Windows and Microsoft Office. It provides online chat, an file sharing
capabilities.]]

MSMSGS "c:\program files\messenger\msmsgs.exe" /background
HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\
Microsoft\Windows\CurrentVersion\Run
[[msmsgs.exe is the main process relating to the MSN Messenger Internet chat
tool installed by default on most Windows computers. A tray bar is also
installed alongside this process for easy access to its features which
include Internet chat, file sharing and audio/video conferencing. This is a
non-essential process. Disabling or enabling this is down to user
preference.

Note: msmsgs.exe is a process which is registered as the W32.Alcarys.B@mm
worm. This virus is distributed via the Internet through e-mail and comes in
the form of an e-mail message, in the hopes that you open its hostile
attachment. The worm has it’s own SMTP engine which means it gathers E-mails
from your local computer and re-distributes itself. In worst cases this worm
can allow attackers to access your computer, stealing passwords and personal
data. It is a registered security risk and should be removed immediately.]]

CTFMON.EXE c:\windows\system32\ctfmon.exe
..DEFAULT HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why is CTFMON.EXE listed twice???

WinZip Quick Pick c:\progra~1\winzip\wzqkpick.exe
Common Startup (This is Start button | All Programs | Startup)
[[Wzqkpick.exe is the tray bar process for WinZip. The process is used to
access WinZip from the tray bar. To save resources this process can safely
be removed. ]]

VSOCheckTask "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcmnhdlr.exe is vital process for McAfee SecurityCenter and Virusscan
Online. Removing this process will dissable the automatic scanning.]]

VirusScan Online c:\program files\mcafee.com\vso\mcvsshld.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcvsshld.exe is an important executable belonging to McAfee's Internet
security suite. This program is important for the stable and secure running
of your computer and should not be terminated.]]

VirusScan c:\progra~1\mcafee.com\vso\mcvsshld.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why is mcvsshld.exe listed twice???

UpdateManager "c:\program files\common files\sonic\update
manager\sgtray.exe" /r
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[If you are running Veritas or Stomp Backup MyPC, then the sgrtray.exe is
the Veritas Update Manager. You can easily remove it by going through
Add/Remove Programs. It will be listed as the Veritas Update Manager.]]

SunJavaUpdateSched c:\program files\java\j2re1.4.2_03\bin\jusched.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[jusched.exe is a process installed alongside Sun Microsystem's Java2 suite
and checks for/installs Java updates.]]

RealTray c:\program files\real\realplayer\realplay.exe
systemboothideplayer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
realplay.exe
[[System Tray icon for RealPlayer. If you subsequently start RealPlayer
manually it adds itself back to the start-up list. You can stop this from
happening by right-clicking on the tray icon and disabling SmartCenter via
Preferences]]

PCMService "c:\program files\dell\media experience\pcmservice.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[PCMService.exe is a part of the Dell media experience software. This is a
multimedia product, and program is non-essential process to the running of
the system]]

OASClnt c:\program files\mcafee.com\vso\oasclnt.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[oasclnt.exe is a process associated with the McAfee VirusScan software. It
is an scan client service and should not be removed to ensure that your
AntiVirus application keeps you protected.]]

MPFExe c:\progra~1\mcafee.com\person~1\mpftray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mpftray.exe is a process associated with McAfee Internet Security suite.
It creates a icon on the desktop tray for easy access. This program is a
non-essential system process, and is installed for ease of use]]

MessengerPlus3 "c:\program files\messengerplus! 3\msgplus.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[msgplus.exe is distributed as a third party MSN extension. However is also
spyware if installed with the sponsor program it offers to install. If this
optional sponsor program was installed, this process monitors your browsing
habits and distributes the data back to the author's servers for analysis.
This also prompts advertising popups.]]

MCUpdateExe c:\progra~1\mcafee.com\agent\mcupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcupdate.exe is a process associated with McAfee Internet Security Suite.
This process ensures the computer's virus definations are up to date by
connectign to McAfee's server on the Internet. This program is important for
the stable and secure running of your computer and should not be
terminated.]]

MCAgentExe c:\progra~1\mcafee.com\agent\mcagent.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcagent.exe is a process associated with McAfee Internet Security Suite.
This process ensures the computer's virus definations are up to date by
communicating with the McAfee VirusScan server on the network. This program
is important for the stable and secure running of your computer and should
not be terminated.]]

IntelMeM c:\program files\intel\modem event monitor\intelmem.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[IntelMEM.exe is a process which assists Intel chipset based modems. This
program is non-essential process to the running of the system]]

IgfxTray c:\windows\system32\igfxtray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[igfxtray.exe is a process which allows you to access access the Intel
Graphics configuration and diagnostic application for the Intel 810 series
graphics chipset. This program is a non-essential system process, and is
installed for ease of use via the desktop tray. ]]

HotKeysCmds c:\windows\system32\hkcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hkcmd.exe is installed alongside Intel multimedia devices and allows
configuration and diagnostic options for these devices. This program is
non-essential process to the running of the system]]

DVDLauncher "c:\program files\cyberlink\powerdvd\dvdlauncher.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dvdlauncher.exe is a process belonging to the Cyberlink PowerCinema video
viewing software which allows you to play DVDs on insertation. This program
is a non-essential process, and is installed for ease of use. ]]

dla c:\windows\system32\dla\tfswctrl.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[tfswctrl.exe is an essential process for HP's packet writing software
which burns data to CD's using Microsoft Windows explorer. This program is a
non-essential system process]]

Dell AIO Printer A920 "c:\program files\dell aio printer a920\dlbkbmgr.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dlbkbmgr.exe is a process which is installed alongside your Dell printer
and offers additional diagnostics and configuration for the Dell range of
printers. This program is non-essential process to the running of the
system]]

BTopenworld "c:\program files\bt yahoo! internet\dialbtyahoo.exe"
/reinstallautodial
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[Connection for BTYahoo?????????]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wesley

I searched for both rundll.exe and rundll32.exe but only found the latter
(3 times in CI386, SYSTEM32 and Service PackFiles/i386)

Error messages cite either. So far as I can tell just rundll on start up
and rundll32 in the Control Panel. Should I follow the instructions on
the sites you refer to?

Thanks
John

Hi John,

This will show what programs are started when you boot your machine.

Open System Information...
Start | Run | Type: msinfo32 | Click OK |
Click the [+] next to Software Environment |
Click on Startup Programs |

This will save the startup information to Startup.txt to your Desktop.

On the top toolbar, click on File | Click on Export | When the Export As
window opens, click on the Desktop icon | Use Startup for filename |
Click the Save button | Close System Information

Now go to your Desktop and locate Startup.txt, open it, right click and
select Select All, right click and select Copy.

Now paste what you just copied into a message and post back.
-----

rundll.exe is a Windows System process belonging to the Windows 95, 98
and ME.

rundll32.exe is what's in Windows XP. If rundll.exe exists on your
machine it is part of LOXOSCAM or Backdoor.SchoolBus.B trojans.

Backdoor.SchoolBus.B
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.schoolbus.b.html

Backdoor.LoxoScam
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.loxoscam.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

No luck! The error has been on my system for a while but not been a
problem until now as I can just close it and carry on with most tasks.

Any other ideas?

Thanks
John

:

Update your antivirus software and run a full system scan.

NTVDM.EXE has nothing to do with rundll32.exe. NTVDM.exe also has
nothing to do with the Control Panel. Rundll32.exe loads the Control
Panel.

NTVDM.EXE (NT Virtual DOS Machine) is used in conjuction with wow.exe
to run 16-bit applications.

Opening the Control Panel should not start NTVDM.EXE.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
XP Home When I start Windows I get the following message, which also
appears when I run anything from the Control Panel. The problem
appears to be preventing my PC recognising new hardware eg USB
connection to a mobile phone or a broadband ADSL modem.

C:\Windows\system32\rundll.exe
The NTVDM CPU has encountered an illegal instruction
CS:06ae IP:0100 OP:ff ff b7 c4 00

Can I fix this without reinstalling Windows? I have told I might need
to edit the Registry but don't have a clue how to do this.

 

[Guest]

Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no luck
so far. I've tried both progressivly ending tasks with the Task Manager and
deleting Start Up items with msconfig. But the problem persists. Is there
anything else to try, or should I reinstall XP?

Thanks
John

Hi John,

I cleaned this up some and added comments or info about what something is
inside the [[ ]].

Nothing jumps out at me.

Jeez, you have a bunch of things that start at boot. McAfee sure adds a
bunch of crap.
------

What you're going to have to do is get rid of startup items one at a time
and keep rebooting until you find the offending entry.

Or uncheck the first half of the startup items, reboot and see if you still
get the error message. If you don't get the error message, then you have
narrowed it down to the second half. If you still get the error message,
recheck the first half of the items and then uncheck the last half of the
items, reboot and see if you get the error message.

You can keep narrowing it down until you find one offending startup item.

Make sure that you unplug the phone line to your modem while troubleshooting
as you will be disabling McAfee, your antivirus.

Open the System Configuration Utility...
Start | Run | Type: msconfig | Click OK |
Click the Startup tab.
UNCheck the first half of everything that's listed
Click the Apply button.
Click the Close button.
You will see this message...

[[You must restart your computer for some of the changes made by
System Configuration to take effect.]]

Click the Restart button.
Your machine will then reboot.

After your machine reboots, you will get the MSCONFIG Reminder Message...

[[You have used the System Configuration Utility to change the way Windows
starts.
The System Configuration Utility is currently in Diagnostic or Selective
Startup mode, causing this message to be displayed and the utility to run
every time Windows starts.
Choose the Normal Startup mode on the General tab to start Windows normally
and undo the changes you made using the System Configuration Utility.]]

Check: "Don't show this message or launch the System Configuration Utility
when Windows starts" and click OK.

You'll have to keep doing this until the guilty item is found. Since you
have a boatload of startup items, this will take a while.

Another way to troubleshoot this is, first make sure that you unplug the
phone line to your modem while troubleshooting as you will be disabling
McAfee, your antivirus. Then start killing off processes one at time with
the Task Manager and open the Control Panel after you kill each process.
When you stop getting the error message you should know what process you
killed. That is the guilty party.
---------

Startup Programs
CTFMON.EXE c:\windows\system32\ctfmon.exe
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[ctfmon.exe = CTF Loader. Part of Microsoft Office. It activates
the Alternative User Input Text Input Processor (TIP) and the Microsoft
Office XP Language Bar.]]

msnmsgr "c:\program files\msn messenger\msnmsgr.exe"/background
HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\
Microsoft\Windows\CurrentVersion\Run
[[msnmsgr.exe is the main executable for MSN Messenger, which is bundled
with Windows and Microsoft Office. It provides online chat, an file sharing
capabilities.]]

MSMSGS "c:\program files\messenger\msmsgs.exe" /background
HKU\S-1-5-21-2472243092-1981300170-3414494143-1006\SOFTWARE\
Microsoft\Windows\CurrentVersion\Run
[[msmsgs.exe is the main process relating to the MSN Messenger Internet chat
tool installed by default on most Windows computers. A tray bar is also
installed alongside this process for easy access to its features which
include Internet chat, file sharing and audio/video conferencing. This is a
non-essential process. Disabling or enabling this is down to user
preference.

Note: msmsgs.exe is a process which is registered as the W32.Alcarys.B@mm
worm. This virus is distributed via the Internet through e-mail and comes in
the form of an e-mail message, in the hopes that you open its hostile
attachment. The worm has it’s own SMTP engine which means it gathers E-mails
from your local computer and re-distributes itself. In worst cases this worm
can allow attackers to access your computer, stealing passwords and personal
data. It is a registered security risk and should be removed immediately.]]

CTFMON.EXE c:\windows\system32\ctfmon.exe
..DEFAULT HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why is CTFMON.EXE listed twice???

WinZip Quick Pick c:\progra~1\winzip\wzqkpick.exe
Common Startup (This is Start button | All Programs | Startup)
[[Wzqkpick.exe is the tray bar process for WinZip. The process is used to
access WinZip from the tray bar. To save resources this process can safely
be removed. ]]

VSOCheckTask "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcmnhdlr.exe is vital process for McAfee SecurityCenter and Virusscan
Online. Removing this process will dissable the automatic scanning.]]

VirusScan Online c:\program files\mcafee.com\vso\mcvsshld.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcvsshld.exe is an important executable belonging to McAfee's Internet
security suite. This program is important for the stable and secure running
of your computer and should not be terminated.]]

VirusScan c:\progra~1\mcafee.com\vso\mcvsshld.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why is mcvsshld.exe listed twice???

UpdateManager "c:\program files\common files\sonic\update
manager\sgtray.exe" /r
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[If you are running Veritas or Stomp Backup MyPC, then the sgrtray.exe is
the Veritas Update Manager. You can easily remove it by going through
Add/Remove Programs. It will be listed as the Veritas Update Manager.]]

SunJavaUpdateSched c:\program files\java\j2re1.4.2_03\bin\jusched.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[jusched.exe is a process installed alongside Sun Microsystem's Java2 suite
and checks for/installs Java updates.]]

RealTray c:\program files\real\realplayer\realplay.exe
systemboothideplayer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
realplay.exe
[[System Tray icon for RealPlayer. If you subsequently start RealPlayer
manually it adds itself back to the start-up list. You can stop this from
happening by right-clicking on the tray icon and disabling SmartCenter via
Preferences]]

PCMService "c:\program files\dell\media experience\pcmservice.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[PCMService.exe is a part of the Dell media experience software. This is a
multimedia product, and program is non-essential process to the running of
the system]]

OASClnt c:\program files\mcafee.com\vso\oasclnt.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[oasclnt.exe is a process associated with the McAfee VirusScan software. It
is an scan client service and should not be removed to ensure that your
AntiVirus application keeps you protected.]]

MPFExe c:\progra~1\mcafee.com\person~1\mpftray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mpftray.exe is a process associated with McAfee Internet Security suite.
It creates a icon on the desktop tray for easy access. This program is a
non-essential system process, and is installed for ease of use]]

MessengerPlus3 "c:\program files\messengerplus! 3\msgplus.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[msgplus.exe is distributed as a third party MSN extension. However is also
spyware if installed with the sponsor program it offers to install. If this
optional sponsor program was installed, this process monitors your browsing
habits and distributes the data back to the author's servers for analysis.
This also prompts advertising popups.]]

MCUpdateExe c:\progra~1\mcafee.com\agent\mcupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcupdate.exe is a process associated with McAfee Internet Security Suite.
This process ensures the computer's virus definations are up to date by
connectign to McAfee's server on the Internet. This program is important for
the stable and secure running of your computer and should not be
terminated.]]

MCAgentExe c:\progra~1\mcafee.com\agent\mcagent.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mcagent.exe is a process associated with McAfee Internet Security Suite.
This process ensures the computer's virus definations are up to date by
communicating with the McAfee VirusScan server on the network. This program
is important for the stable and secure running of your computer and should
not be terminated.]]

IntelMeM c:\program files\intel\modem event monitor\intelmem.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[IntelMEM.exe is a process which assists Intel chipset based modems. This
program is non-essential process to the running of the system]]

IgfxTray c:\windows\system32\igfxtray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[igfxtray.exe is a process which allows you to access access the Intel
Graphics configuration and diagnostic application for the Intel 810 series
graphics chipset. This program is a non-essential system process, and is
installed for ease of use via the desktop tray. ]]

HotKeysCmds c:\windows\system32\hkcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hkcmd.exe is installed alongside Intel multimedia devices and allows
configuration and diagnostic options for these devices. This program is
non-essential process to the running of the system]]

DVDLauncher "c:\program files\cyberlink\powerdvd\dvdlauncher.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dvdlauncher.exe is a process belonging to the Cyberlink PowerCinema video
viewing software which allows you to play DVDs on insertation. This program
is a non-essential process, and is installed for ease of use. ]]

dla c:\windows\system32\dla\tfswctrl.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[tfswctrl.exe is an essential process for HP's packet writing software
which burns data to CD's using Microsoft Windows explorer. This program is a
non-essential system process]]

Dell AIO Printer A920 "c:\program files\dell aio printer a920\dlbkbmgr.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dlbkbmgr.exe is a process which is installed alongside your Dell printer
and offers additional diagnostics and configuration for the Dell range of
printers. This program is non-essential process to the running of the
system]]

BTopenworld "c:\program files\bt yahoo! internet\dialbtyahoo.exe"
/reinstallautodial
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[Connection for BTYahoo?????????]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wesley

I searched for both rundll.exe and rundll32.exe but only found the latter
(3 times in CI386, SYSTEM32 and Service PackFiles/i386)

Error messages cite either. So far as I can tell just rundll on start up
and rundll32 in the Control Panel. Should I follow the instructions on
the sites you refer to?

Thanks
John

Hi John,

This will show what programs are started when you boot your machine.

Open System Information...
Start | Run | Type: msinfo32 | Click OK |
Click the [+] next to Software Environment |
Click on Startup Programs |

This will save the startup information to Startup.txt to your Desktop.

On the top toolbar, click on File | Click on Export | When the Export As
window opens, click on the Desktop icon | Use Startup for filename |
Click the Save button | Close System Information

Now go to your Desktop and locate Startup.txt, open it, right click and
select Select All, right click and select Copy.

Now paste what you just copied into a message and post back.
-----

rundll.exe is a Windows System process belonging to the Windows 95, 98
and ME.

rundll32.exe is what's in Windows XP. If rundll.exe exists on your
machine it is part of LOXOSCAM or Backdoor.SchoolBus.B trojans.

Backdoor.SchoolBus.B
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.schoolbus.b.html

Backdoor.LoxoScam
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.loxoscam.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
No luck! The error has been on my system for a while but not been a
problem until now as I can just close it and carry on with most tasks.

Any other ideas?

Thanks
John

:

 

[Wesley Vogel]

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running Microsoft
Windows NT 4.0 Service Pack 3, the program may quit immediately, or you may
receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the Command.com
file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com another
way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no
luck so far. I've tried both progressivly ending tasks with the Task
Manager and deleting Start Up items with msconfig. But the problem
persists. Is there anything else to try, or should I reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very briefly.
The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running Microsoft
Windows NT 4.0 Service Pack 3, the program may quit immediately, or you may
receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the Command.com
file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com another
way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no
luck so far. I've tried both progressivly ending tasks with the Task
Manager and deleting Start Up items with msconfig. But the problem
persists. Is there anything else to try, or should I reinstall XP?

Thanks
John

:

<snip>

 

[Wesley Vogel]

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry about
it. sfc.exe has to run from a command prompt or the Run box. Clicking on
sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed up
it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file to
make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running Microsoft
Windows NT 4.0 Service Pack 3, the program may quit immediately, or you
may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com another
way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no
luck so far. I've tried both progressivly ending tasks with the Task
Manager and deleting Start Up items with msconfig. But the problem
persists. Is there anything else to try, or should I reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

Yes, Yes, Yes! Thanks very, much Wes. You patient help is much appreciated!
SFC found about 8 things to correct. Now connected on broadband.

Cheers
John

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry about
it. sfc.exe has to run from a command prompt or the Run box. Clicking on
sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed up
it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file to
make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running Microsoft
Windows NT 4.0 Service Pack 3, the program may quit immediately, or you
may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com another
way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no
luck so far. I've tried both progressivly ending tasks with the Task
Manager and deleting Start Up items with msconfig. But the problem
persists. Is there anything else to try, or should I reinstall XP?

Thanks
John

:

<snip>

 

[Wesley Vogel]

John,

I am so happy to hear that!

Were command.com or rundll32.exe among the files that SFC replaced?

Knowing this could help others.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Yes, Yes, Yes! Thanks very, much Wes. You patient help is much
appreciated! SFC found about 8 things to correct. Now connected on
broadband.

Cheers
John

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

The files rundll32.exe, ntvdmd.dll and calc.exe were replaced/fixed. Three
files oembios.sig;.dat; .bin, were found to be bad but couldn't be restored.

Cheers
John

John,

I am so happy to hear that!

Were command.com or rundll32.exe among the files that SFC replaced?

Knowing this could help others.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Yes, Yes, Yes! Thanks very, much Wes. You patient help is much
appreciated! SFC found about 8 things to correct. Now connected on
broadband.

Cheers
John

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Wesley Vogel]

Interesting. I can't find any info on ntvdmd.dll, it has to be related to
NT Virtual Dos Machine, though. calc.exe is the Windows Calculator.

I have no idea what these files are for: oembios.bin, oembios.dat or
oembios.sig

Thanks for the info, John

Keep having fun!

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

The files rundll32.exe, ntvdmd.dll and calc.exe were replaced/fixed. Three
files oembios.sig;.dat; .bin, were found to be bad but couldn't be
restored.

Cheers
John

John,

I am so happy to hear that!

Were command.com or rundll32.exe among the files that SFC replaced?

Knowing this could help others.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Yes, Yes, Yes! Thanks very, much Wes. You patient help is much
appreciated! SFC found about 8 things to correct. Now connected on
broadband.

Cheers
John

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

Hello,

I also currently have the same error message as described in this post. I
attempted to rectify it by using the sfc.exe, however, did not experience the
same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an illegal
instruction. 'Close' to terminate the application. What I did was:
C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to its
original version
and
c:\windows\system32\charmap.exe has a bad signature. File was restored to
its original version
and
this one could not be restored: oembios.sig The problem is I still get the
same error message. Is there anything else I could do?

Thanks in advance ~

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry about
it. sfc.exe has to run from a command prompt or the Run box. Clicking on
sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed up
it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file to
make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running Microsoft
Windows NT 4.0 Service Pack 3, the program may quit immediately, or you
may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com another
way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But, no
luck so far. I've tried both progressivly ending tasks with the Task
Manager and deleting Start Up items with msconfig. But the problem
persists. Is there anything else to try, or should I reinstall XP?

Thanks
John

:

<snip>

 

[Wesley Vogel]

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on startup.
This program is not required to start automatically as you can run it when
you need to. It is advised that you disable this program so that it does not
take up necessary resources. The following information is a brief
description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information about
what customers were watching, they decided to implement an anti-spyware
service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello,

I also currently have the same error message as described in this post. I
attempted to rectify it by using the sfc.exe, however, did not experience
the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an illegal
instruction. 'Close' to terminate the application. What I did was:
C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to its
original version
and
c:\windows\system32\charmap.exe has a bad signature. File was restored to
its original version
and
this one could not be restored: oembios.sig The problem is I still get
the same error message. Is there anything else I could do?

Thanks in advance ~

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on reboot
and the following results are: windows file protection comes up and says:
Please wait while windows verifies that all protected windows files are
intact and in their original versions.......this has occured 5 reboots since
I ran SFC yesterday. Also the system configuration utility comes up and asks
me to return to normal startup which would include dsentry.exe. What should
I do next? And is a possible virus involved? I currently run Adware SE,
Norton antivirus corporate edition, spybot and msn beta. Thanks for your
patience!

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on startup.
This program is not required to start automatically as you can run it when
you need to. It is advised that you disable this program so that it does not
take up necessary resources. The following information is a brief
description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information about
what customers were watching, they decided to implement an anti-spyware
service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello,

I also currently have the same error message as described in this post. I
attempted to rectify it by using the sfc.exe, however, did not experience
the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an illegal
instruction. 'Close' to terminate the application. What I did was:
C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to its
original version
and
c:\windows\system32\charmap.exe has a bad signature. File was restored to
its original version
and
this one could not be restored: oembios.sig The problem is I still get
the same error message. Is there anything else I could do?

Thanks in advance ~

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Wesley Vogel]

Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called it)
and we will see where dsentry.exe is starting from and disable it there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes up
and says: Please wait while windows verifies that all protected windows
files are intact and in their original versions.......this has occured 5
reboots since I ran SFC yesterday. Also the system configuration utility
comes up and asks me to return to normal startup which would include
dsentry.exe. What should I do next? And is a possible virus involved?
I currently run Adware SE, Norton antivirus corporate edition, spybot and
msn beta. Thanks for your patience!

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you can
run it when you need to. It is advised that you disable this program so
that it does not take up necessary resources. The following information
is a brief description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello,

I also currently have the same error message as described in this post.
I attempted to rectify it by using the sfc.exe, however, did not
experience the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an
illegal instruction. 'Close' to terminate the application. What I did
was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to
its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was restored
to its original version
and
this one could not be restored: oembios.sig The problem is I still get
the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>

 

[Guest]

Hello Wesley,

I did the suggested operations first with the sf/reverse and also the
msconfig. The boot up log is as follows:
System Information report written at: 02/23/06 17:37:30
System Name: SPLOTCH
[Startup Programs]

Program Command User Name Location
DESKTOP desktop.ini NT AUTHORITY\SYSTEM Startup
DESKTOP desktop.ini SPLOTCH\Cheryl Duff Startup
SmartSync c:\progra~1\compan~1\smartsync.exe SPLOTCH\Cheryl
Duff HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MoneyAgent "c:\program files\microsoft
money\system\mnyexpr.exe" SPLOTCH\Cheryl
Duff HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe c:\windows\system32\ctfmon.exe SPLOTCH\Cheryl
Duff HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DESKTOP desktop.ini .DEFAULT Startup
DESKTOP desktop.ini All Users Common Startup
Exif Launcher c:\progra~1\finepi~1\quickdcf.exe All Users Common Startup
Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe All
Users Common Startup
Office Startup c:\progra~1\micros~3\office\osa.exe -b All Users Common
Startup
RCScheduleCheck c:\program files\vcom\recovery commander\rcsched.exe
-check All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Fix-It AV c:\progra~1\vcom\fix-it\memcheck.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
gcasServ "c:\program files\microsoft antispyware\gcasserv.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmds c:\windows\system32\hkcmd.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPDJ Taskbar
Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTray c:\windows\system32\igfxtray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelMeM c:\program files\intel\modem event monitor\intelmem.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mmtask c:\program files\musicmatch\musicmatch jukebox\mmtask.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MMTray c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PCMService "c:\program files\dell\media experience\pcmservice.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DwlClient c:\program files\common files\dell\eusw\support.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dla c:\windows\system32\dla\tfswctrl.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
REGSHAVE c:\program files\regshave\regshave.exe /autorun All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TkBellExe "c:\program files\common files\real\update_ob\realsched.exe"
-osboot All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UserFaultCheck %systemroot%\system32\dumprep 0 -u All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vptray c:\program files\navnt\vptray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DVDSentry c:\windows\system32\dsentry.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Thanks again.

Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called it)
and we will see where dsentry.exe is starting from and disable it there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes up
and says: Please wait while windows verifies that all protected windows
files are intact and in their original versions.......this has occured 5
reboots since I ran SFC yesterday. Also the system configuration utility
comes up and asks me to return to normal startup which would include
dsentry.exe. What should I do next? And is a possible virus involved?
I currently run Adware SE, Norton antivirus corporate edition, spybot and
msn beta. Thanks for your patience!

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you can
run it when you need to. It is advised that you disable this program so
that it does not take up necessary resources. The following information
is a brief description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I also currently have the same error message as described in this post.
I attempted to rectify it by using the sfc.exe, however, did not
experience the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an
illegal instruction. 'Close' to terminate the application. What I did
was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to
its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was restored
to its original version
and
this one could not be restored: oembios.sig The problem is I still get
the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are screwed
up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source files.
Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a file
to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on there. I
searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help! But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>