Help! NTVDM error

W

Wesley Vogel

Good lord, Cheryl, you have a bunch of crap starting. ;-)

This is the one...
DVDSentry c:\windows\system32\dsentry.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tip: HKLM = HKEY_LOCAL_MACHINE

OK.

Start the Registry Editor...
Start | Run | Type: regedit | Click OK |
Navigate to >>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right hand pane you should see under the Name column, DVDSentry.
Right click DVDSentry and select: Delete.
This message will popup...
[[Are you sure you want to delete this value?]]
Click YES
Close the Registry Editor
When you reboot dsentry.exe should not start.
-----

If you do not want to mess with registry get one or both of the following
programs and one of them to disable whatever you do not want to start.

[[StartMan is an extended 'msconfig' Startup Manager, designed to take
control of all those pesky programs and background services that load and
run at logon - most of which you probably don't need. As well as providing
the usual trouble-shooting options to enable or disable startups, StartMan
also permits the removal of startups.
Duplicate Detection and Removal, a unique feature of StartMan, can be
configured to remove all duplicates automatically, with or without
prompting.
Orphan Detection and Removal. As above, for orphaned startups.
Executable Detection and Removal. As above, for executables.
Includes a full range of sorting options to make it easier to locate a
specific startup - by name, by filename - even by command line parameter! ]]

StartMan v1.3.96
http://www.pt.lu/comnet/desc/startman.html

StartMan v1.3.96 Direct download
http://www.pt.lu/comnet/files/utils/startman10396.exe

===

Startup Control Panel is another pretty good application.

[[Startup Control Panel is a nifty control panel applet that allows you to
easily configure which programs run when your computer starts. It's simple
to use and, like all my programs, is very small and won't burden your
system. A valuable tool for system administrators!]]

Download the EXE Version and just extract the executable wherever you want.

Startup Control Panel
http://www.mlin.net/StartupCPL.shtml

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello Wesley,

I did the suggested operations first with the sf/reverse and also the
msconfig. The boot up log is as follows:
System Information report written at: 02/23/06 17:37:30
System Name: SPLOTCH
[Startup Programs]

Program Command User Name Location
DESKTOP desktop.ini NT AUTHORITY\SYSTEM Startup
DESKTOP desktop.ini SPLOTCH\Cheryl Duff Startup
SmartSync c:\progra~1\compan~1\smartsync.exe SPLOTCH\Cheryl
Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
MoneyAgent "c:\program files\microsoft
money\system\mnyexpr.exe" SPLOTCH\Cheryl
Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
ctfmon.exe c:\windows\system32\ctfmon.exe SPLOTCH\Cheryl
Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
DESKTOP desktop.ini .DEFAULT Startup
DESKTOP desktop.ini All Users Common Startup
Exif Launcher c:\progra~1\finepi~1\quickdcf.exe All Users Common Startup
Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe All
Users Common Startup
Office Startup c:\progra~1\micros~3\office\osa.exe -b All Users Common
Startup
RCScheduleCheck c:\program files\vcom\recovery commander\rcsched.exe
-check All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Fix-It AV c:\progra~1\vcom\fix-it\memcheck.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
gcasServ "c:\program files\microsoft antispyware\gcasserv.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmds c:\windows\system32\hkcmd.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPDJ Taskbar
Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTray c:\windows\system32\igfxtray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelMeM c:\program files\intel\modem event monitor\intelmem.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mmtask c:\program files\musicmatch\musicmatch jukebox\mmtask.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MMTray c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PCMService "c:\program files\dell\media experience\pcmservice.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DwlClient c:\program files\common files\dell\eusw\support.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dla c:\windows\system32\dla\tfswctrl.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
REGSHAVE c:\program files\regshave\regshave.exe /autorun All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TkBellExe "c:\program files\common files\real\update_ob\realsched.exe"
-osboot All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UserFaultCheck %systemroot%\system32\dumprep 0 -u All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vptray c:\program files\navnt\vptray.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DVDSentry c:\windows\system32\dsentry.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Thanks again.

Wesley Vogel said:
Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called it)
and we will see where dsentry.exe is starting from and disable it there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes up
and says: Please wait while windows verifies that all protected windows
files are intact and in their original versions.......this has occured 5
reboots since I ran SFC yesterday. Also the system configuration
utility comes up and asks me to return to normal startup which would
include dsentry.exe. What should I do next? And is a possible virus
involved? I currently run Adware SE, Norton antivirus corporate
edition, spybot and msn beta. Thanks for your patience!

:

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you can
run it when you need to. It is advised that you disable this program so
that it does not take up necessary resources. The following information
is a brief description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I also currently have the same error message as described in this
post. I attempted to rectify it by using the sfc.exe, however, did not
experience the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an
illegal instruction. 'Close' to terminate the application. What I
did was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to
its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was
restored to its original version
and
this one could not be restored: oembios.sig The problem is I still
get the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are
screwed up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source
files. Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a
file to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on
there. I searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help!
But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>
 
W

Wesley Vogel

Things that I would think about disabling from starting at boot (from your
list). Start if/when needed. Entirely up to you, but some if this stuff is
pure crap. I would think about uninstalling some of this stuff, my opinion.

MoneyAgent "c:\program files\microsoft
money\system\mnyexpr.exe" SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[To stop Money Express from running:
Open MS Money
On the Tools menu, click Options.
Click the Bills and Deposits tab.
Clear the Use Money Express check box, and then click OK.
Quit Money]] I have this disabled.

ctfmon.exe c:\windows\system32\ctfmon.exe SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[ctfmon.exe is a part of the Microsoft Office suite. It activates the
Alternative User Input Text Input Processor (TIP) and the Microsoft Office
XP Language Bar. This program is a non-essential system process]]
[[If you do not use a language bar or handwriting,'
To prevent Ctfmon.exe from running, follow these steps.
http://support.microsoft.com/default.aspx?scid=kb;en-us;282599#XSLTH3124121122120121120120]]
I have this disabled.

Exif Launcher c:\progra~1\finepi~1\quickdcf.exe
All Users Common Startup
[[quickdcf.exe is a piece of software installed alongside the Fuji digital
camera. This is a non-essential process. Disabling or enabling this is down
to user preference]]

Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe
All Users Common Startup (In Start\All Programs\Startup folder)
[[Microsoft Office Indexing process used by Microsoft Office applications to
index Office documents to speed up search operations.]] Terrible thing.
Newer versions of MS Office do not even have findfast.exe.

Office Startup c:\progra~1\micros~3\office\osa.exe -b
All Users Common Startup (In Start\All Programs\Startup folder)
[[osa.exe is installed with Microsoft Office Suite. This process is the
startup assistant which improves performance and deals with some commands.
This program is non-essential process to the running of the system]] I have
this disabled.

HotKeysCmds c:\windows\system32\hkcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hkcmd.exe is installed alongside Intel multimedia devices and allows
configuration and diagnostic options for these devices. This program is
non-essential process to the running of the system]]

HPDJ Taskbar
Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hpztsb04.exe is a process belonging to the HP Deskjet Taskbar Utility
which is installed alongside the HP deskjet range of printers. This program
is non-essential process to the running of the system]] I have 2 HP
printers and have similar program disabled.

IgfxTray c:\windows\system32\igfxtray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[igfxtray.exe is a process which allows you to access the Intel Graphics
configuration and diagnostic application for the Intel 810 series graphics
chipset. This program is a non-essential system process]]

mmtask c:\program files\musicmatch\musicmatch jukebox\mmtask.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[part of Music Match Box software.
It's released in the new version of MMBox.
Mmtask is used to determine the CD type and launch apps.]]

MMTray c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mm_tray.exe is the tray bar process for MusicMatch Jukebox which organizes
and plays music media such as MP3. It gives the user easy access to the
MusicMatch Jukebox application and settings. This is a non-essential
process]]

PCMService "c:\program files\dell\media experience\pcmservice.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[pcmservice.exe process is typically installed on Dell computers from a CD
included with the system containing applications and tools. It is used to
gain quick access to Music, Movies and other media. It is not required for
your computer to function correctly.]]

QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[qttask.exe produced by Apple, installs a tray bar icon which links to the
Apple QuickTime video streaming tool. This program is a non-essential system
process]] This is hard to get rid of. I hate QuickTime.

DwlClient c:\program files\common files\dell\eusw\support.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[support.exe is a process belonging to Dell's support assistant which comes
installed on Dell computers. This is a non-essential process.]]

dla c:\windows\system32\dla\tfswctrl.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[tfswctrl.exe is an essential process for HP's packet writing software
which burns data to CD's using Microsoft Windows explorer. This program is a
non-essential system process]]

Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dlbkbmgr.exe is a process which is installed alongside your Dell printer
and offers additional diagnostics and configuration for the Dell range of
printers. This program is non-essential process to the running of the
system]] Two printers, huh?

REGSHAVE c:\program files\regshave\regshave.exe /autorun
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[regshave.exe installed alongside the drivers for Fuji FinePix digital
cameras. This program is a non-essential process]]

TkBellExe "c:\program files\common files\real\update_ob\realsched.exe"
-osboot
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[realsched.exe is a program which schedules for manual update checks for
Real Networks products. This is a non-essential process]] I hate RealPlayer
as much as Quicktime.

UserFaultCheck %systemroot%\system32\dumprep 0 -u
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[-u is a user fault check for Error Reporting]]

DVDSentry c:\windows\system32\dsentry.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
We know about this pig.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello Wesley,

I did the suggested operations first with the sf/reverse and also the
msconfig. The boot up log is as follows:
System Information report written at: 02/23/06 17:37:30
System Name: SPLOTCH
[Startup Programs]

Thanks again.

Wesley Vogel said:
Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called it)
and we will see where dsentry.exe is starting from and disable it there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes up
and says: Please wait while windows verifies that all protected windows
files are intact and in their original versions.......this has occured 5
reboots since I ran SFC yesterday. Also the system configuration
utility comes up and asks me to return to normal startup which would
include dsentry.exe. What should I do next? And is a possible virus
involved? I currently run Adware SE, Norton antivirus corporate
edition, spybot and msn beta. Thanks for your patience!

:

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you can
run it when you need to. It is advised that you disable this program so
that it does not take up necessary resources. The following information
is a brief description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I also currently have the same error message as described in this
post. I attempted to rectify it by using the sfc.exe, however, did not
experience the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an
illegal instruction. 'Close' to terminate the application. What I
did was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to
its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was
restored to its original version
and
this one could not be restored: oembios.sig The problem is I still
get the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are
screwed up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source
files. Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a
file to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!

My Dell supplied XP disk is not the full works. No sfc.exe on
there. I searched and found 3 likely files on c:

sfc on c:I386 [Windows 2000 System File Checker]
SFC.EXE-2FD11AB0.pf on c:\windows\prefetch
sfc on c:\windows\system32 [Windows 2000 System File Checker]

The first and third just bring up a DOS screen (I think) very, very
briefly. The second brings the usual NTVDM error.

So, what's next? Thanks for your persistence!

John

:

John,

I found this...

NTVDM CPU Has Encountered an Illegal Instruction
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q245184

The article states...
[[SYMPTOMS
When you attempt to run a 16-bit program on a computer running
Microsoft Windows NT 4.0 Service Pack 3, the program may quit
immediately, or you may receive the following error message:
Hidden Console of WOW VDM
The NTVDM CPU has encountered an illegal instruction.
CS: 04c3 IP:3937 OP:c71c 9d 37 00
Choose Close to terminate the application.

CAUSE
This behavior can occur if you use an incorrect version of the
Command.com file.

RESOLUTION
To resolve this issue, replace the Command.com file]]

I did some searching on Google and another fellow had this problem.

[[When booting up my computer I get the following error message:

C:\WINDOWS\System32\rundll32.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0d9e IP:0132 OP:63 09 3a f0 9c]]
http://forums.spywareinfo.com/index.php?showtopic=36445

His rundll32.exe file was corrupt.

Either your command.com or rundll32.exe or both are corrupt.

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

If that doesn't work we can replace rundll32.exe and command.com
another way.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Hi Wes

you're certainly trying hard, and I really appreciate the help!
But,
no luck so far. I've tried both progressivly ending tasks with the
Task Manager and deleting Start Up items with msconfig. But the
problem persists. Is there anything else to try, or should I
reinstall XP?

Thanks
John

:

<snip>
 
G

Guest

Hello again!

Yippee!! No more error message. I used the regedit to diable the DSentry
from boot up. When I have more time I will get rid of all the unwanted
entries that you suggest, but tired now of working on this! It's time for
choclate!

Thanks again for all your help.

Cher

Wesley Vogel said:
Things that I would think about disabling from starting at boot (from your
list). Start if/when needed. Entirely up to you, but some if this stuff is
pure crap. I would think about uninstalling some of this stuff, my opinion.

MoneyAgent "c:\program files\microsoft
money\system\mnyexpr.exe" SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[To stop Money Express from running:
Open MS Money
On the Tools menu, click Options.
Click the Bills and Deposits tab.
Clear the Use Money Express check box, and then click OK.
Quit Money]] I have this disabled.

ctfmon.exe c:\windows\system32\ctfmon.exe SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[ctfmon.exe is a part of the Microsoft Office suite. It activates the
Alternative User Input Text Input Processor (TIP) and the Microsoft Office
XP Language Bar. This program is a non-essential system process]]
[[If you do not use a language bar or handwriting,'
To prevent Ctfmon.exe from running, follow these steps.
http://support.microsoft.com/default.aspx?scid=kb;en-us;282599#XSLTH3124121122120121120120]]
I have this disabled.

Exif Launcher c:\progra~1\finepi~1\quickdcf.exe
All Users Common Startup
[[quickdcf.exe is a piece of software installed alongside the Fuji digital
camera. This is a non-essential process. Disabling or enabling this is down
to user preference]]

Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe
All Users Common Startup (In Start\All Programs\Startup folder)
[[Microsoft Office Indexing process used by Microsoft Office applications to
index Office documents to speed up search operations.]] Terrible thing.
Newer versions of MS Office do not even have findfast.exe.

Office Startup c:\progra~1\micros~3\office\osa.exe -b
All Users Common Startup (In Start\All Programs\Startup folder)
[[osa.exe is installed with Microsoft Office Suite. This process is the
startup assistant which improves performance and deals with some commands.
This program is non-essential process to the running of the system]] I have
this disabled.

HotKeysCmds c:\windows\system32\hkcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hkcmd.exe is installed alongside Intel multimedia devices and allows
configuration and diagnostic options for these devices. This program is
non-essential process to the running of the system]]

HPDJ Taskbar
Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hpztsb04.exe is a process belonging to the HP Deskjet Taskbar Utility
which is installed alongside the HP deskjet range of printers. This program
is non-essential process to the running of the system]] I have 2 HP
printers and have similar program disabled.

IgfxTray c:\windows\system32\igfxtray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[igfxtray.exe is a process which allows you to access the Intel Graphics
configuration and diagnostic application for the Intel 810 series graphics
chipset. This program is a non-essential system process]]

mmtask c:\program files\musicmatch\musicmatch jukebox\mmtask.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[part of Music Match Box software.
It's released in the new version of MMBox.
Mmtask is used to determine the CD type and launch apps.]]

MMTray c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mm_tray.exe is the tray bar process for MusicMatch Jukebox which organizes
and plays music media such as MP3. It gives the user easy access to the
MusicMatch Jukebox application and settings. This is a non-essential
process]]

PCMService "c:\program files\dell\media experience\pcmservice.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[pcmservice.exe process is typically installed on Dell computers from a CD
included with the system containing applications and tools. It is used to
gain quick access to Music, Movies and other media. It is not required for
your computer to function correctly.]]

QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[qttask.exe produced by Apple, installs a tray bar icon which links to the
Apple QuickTime video streaming tool. This program is a non-essential system
process]] This is hard to get rid of. I hate QuickTime.

DwlClient c:\program files\common files\dell\eusw\support.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[support.exe is a process belonging to Dell's support assistant which comes
installed on Dell computers. This is a non-essential process.]]

dla c:\windows\system32\dla\tfswctrl.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[tfswctrl.exe is an essential process for HP's packet writing software
which burns data to CD's using Microsoft Windows explorer. This program is a
non-essential system process]]

Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dlbkbmgr.exe is a process which is installed alongside your Dell printer
and offers additional diagnostics and configuration for the Dell range of
printers. This program is non-essential process to the running of the
system]] Two printers, huh?

REGSHAVE c:\program files\regshave\regshave.exe /autorun
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[regshave.exe installed alongside the drivers for Fuji FinePix digital
cameras. This program is a non-essential process]]

TkBellExe "c:\program files\common files\real\update_ob\realsched.exe"
-osboot
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[realsched.exe is a program which schedules for manual update checks for
Real Networks products. This is a non-essential process]] I hate RealPlayer
as much as Quicktime.

UserFaultCheck %systemroot%\system32\dumprep 0 -u
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[-u is a user fault check for Error Reporting]]

DVDSentry c:\windows\system32\dsentry.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
We know about this pig.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello Wesley,

I did the suggested operations first with the sf/reverse and also the
msconfig. The boot up log is as follows:
System Information report written at: 02/23/06 17:37:30
System Name: SPLOTCH
[Startup Programs]

Thanks again.

Wesley Vogel said:
Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called it)
and we will see where dsentry.exe is starting from and disable it there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes up
and says: Please wait while windows verifies that all protected windows
files are intact and in their original versions.......this has occured 5
reboots since I ran SFC yesterday. Also the system configuration
utility comes up and asks me to return to normal startup which would
include dsentry.exe. What should I do next? And is a possible virus
involved? I currently run Adware SE, Norton antivirus corporate
edition, spybot and msn beta. Thanks for your patience!

:

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the autorun
application from executing on disc insertion. This is a non-essential
process. Disabling or enabling this is down to user preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you can
run it when you need to. It is advised that you disable this program so
that it does not take up necessary resources. The following information
is a brief description of what is known about this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I also currently have the same error message as described in this
post. I attempted to rectify it by using the sfc.exe, however, did not
experience the same good results. The error message I receive is:
C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered an
illegal instruction. 'Close' to terminate the application. What I
did was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored to
its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was
restored to its original version
and
this one could not be restored: oembios.sig The problem is I still
get the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to worry
about it. sfc.exe has to run from a command prompt or the Run box.
Clicking on sfc.exe does nothing. As you have already seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are
screwed up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source
files. Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a
file to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!
 
W

Wesley Vogel

Cher,

Before you disable anything else from starting at boot, make sure that you
know how/where to start that item if you ever need to.

Keep having fun. :)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello again!

Yippee!! No more error message. I used the regedit to diable the DSentry
from boot up. When I have more time I will get rid of all the unwanted
entries that you suggest, but tired now of working on this! It's time
for choclate!

Thanks again for all your help.

Cher

Wesley Vogel said:
Things that I would think about disabling from starting at boot (from
your list). Start if/when needed. Entirely up to you, but some if this
stuff is pure crap. I would think about uninstalling some of this
stuff, my opinion.

MoneyAgent "c:\program files\microsoft
money\system\mnyexpr.exe" SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[To stop Money Express from running:
Open MS Money
On the Tools menu, click Options.
Click the Bills and Deposits tab.
Clear the Use Money Express check box, and then click OK.
Quit Money]] I have this disabled.

ctfmon.exe c:\windows\system32\ctfmon.exe SPLOTCH\Cheryl Duff
HKU\S-1-5-21-373620570-482573614-4256592569-1008\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
[[ctfmon.exe is a part of the Microsoft Office suite. It activates the
Alternative User Input Text Input Processor (TIP) and the Microsoft
Office XP Language Bar. This program is a non-essential system process]]
[[If you do not use a language bar or handwriting,'
To prevent Ctfmon.exe from running, follow these steps.
http://support.microsoft.com/default.aspx?scid=kb;en-us;282599#XSLTH3124121122120121120120]]
I have this disabled.

Exif Launcher c:\progra~1\finepi~1\quickdcf.exe
All Users Common Startup
[[quickdcf.exe is a piece of software installed alongside the Fuji
digital camera. This is a non-essential process. Disabling or enabling
this is down to user preference]]

Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe
All Users Common Startup (In Start\All Programs\Startup folder)
[[Microsoft Office Indexing process used by Microsoft Office
applications to index Office documents to speed up search operations.]]
Terrible thing. Newer versions of MS Office do not even have
findfast.exe.

Office Startup c:\progra~1\micros~3\office\osa.exe -b
All Users Common Startup (In Start\All Programs\Startup folder)
[[osa.exe is installed with Microsoft Office Suite. This process is the
startup assistant which improves performance and deals with some
commands. This program is non-essential process to the running of the
system]] I have this disabled.

HotKeysCmds c:\windows\system32\hkcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hkcmd.exe is installed alongside Intel multimedia devices and allows
configuration and diagnostic options for these devices. This program is
non-essential process to the running of the system]]

HPDJ Taskbar
Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[hpztsb04.exe is a process belonging to the HP Deskjet Taskbar Utility
which is installed alongside the HP deskjet range of printers. This
program is non-essential process to the running of the system]] I have
2 HP printers and have similar program disabled.

IgfxTray c:\windows\system32\igfxtray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[igfxtray.exe is a process which allows you to access the Intel Graphics
configuration and diagnostic application for the Intel 810 series
graphics chipset. This program is a non-essential system process]]

mmtask c:\program files\musicmatch\musicmatch jukebox\mmtask.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[part of Music Match Box software.
It's released in the new version of MMBox.
Mmtask is used to determine the CD type and launch apps.]]

MMTray c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[mm_tray.exe is the tray bar process for MusicMatch Jukebox which
organizes and plays music media such as MP3. It gives the user easy
access to the MusicMatch Jukebox application and settings. This is a
non-essential process]]

PCMService "c:\program files\dell\media experience\pcmservice.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[pcmservice.exe process is typically installed on Dell computers from a
CD included with the system containing applications and tools. It is
used to gain quick access to Music, Movies and other media. It is not
required for your computer to function correctly.]]

QuickTime Task "c:\program files\quicktime\qttask.exe" -atboottime
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[qttask.exe produced by Apple, installs a tray bar icon which links to
the Apple QuickTime video streaming tool. This program is a
non-essential system process]] This is hard to get rid of. I hate
QuickTime.

DwlClient c:\program files\common files\dell\eusw\support.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[support.exe is a process belonging to Dell's support assistant which
comes installed on Dell computers. This is a non-essential process.]]

dla c:\windows\system32\dla\tfswctrl.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[tfswctrl.exe is an essential process for HP's packet writing software
which burns data to CD's using Microsoft Windows explorer. This program
is a non-essential system process]]

Dell AIO Printer A920 "c:\program files\dell aio printer
a920\dlbkbmgr.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[dlbkbmgr.exe is a process which is installed alongside your Dell
printer and offers additional diagnostics and configuration for the Dell
range of printers. This program is non-essential process to the running
of the system]] Two printers, huh?

REGSHAVE c:\program files\regshave\regshave.exe /autorun
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[regshave.exe installed alongside the drivers for Fuji FinePix digital
cameras. This program is a non-essential process]]

TkBellExe "c:\program files\common files\real\update_ob\realsched.exe"
-osboot
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[realsched.exe is a program which schedules for manual update checks for
Real Networks products. This is a non-essential process]] I hate
RealPlayer as much as Quicktime.

UserFaultCheck %systemroot%\system32\dumprep 0 -u
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[[-u is a user fault check for Error Reporting]]

DVDSentry c:\windows\system32\dsentry.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
We know about this pig.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Cher7 said:
Hello Wesley,

I did the suggested operations first with the sf/reverse and also the
msconfig. The boot up log is as follows:
System Information report written at: 02/23/06 17:37:30
System Name: SPLOTCH
[Startup Programs]

Thanks again.

:

Hi,

First.
Did you somehow ues the sfc /Scanboot option?

/Scanboot: Scans all protected system files every time you start your
computer.

If so you need to run sfc /revert

/Revert: Returns scan to the default setting (do not scan protected
files when you start the computer).

sfc /revert should set sfc back to normal.
-----

Second.
You used the System Configuration Utility (msconfig.exe) to disable
dsentry.exe.

Set msconfig back to Normal Startup and reboot.

Then, follow the instructions here to generate a startuplog.txt...
How to generate a startup log using MSINFO32
http://www.winxptutor.com/msinfo32.htm

Post back with the contents of startuplog.txt (or whatever you called
it) and we will see where dsentry.exe is starting from and disable it
there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I checked and dsentry.exe is not a 16-bit program. I disabled it on
reboot and the following results are: windows file protection comes
up and says: Please wait while windows verifies that all protected
windows files are intact and in their original versions.......this
has occured 5 reboots since I ran SFC yesterday. Also the system
configuration utility comes up and asks me to return to normal
startup which would include dsentry.exe. What should I do next? And
is a possible virus involved? I currently run Adware SE, Norton
antivirus corporate edition, spybot and msn beta. Thanks for your
patience!

:

SFC isn't going to work on this one. dsentry.exe is from Dell not
Microsoft.

First see if dsentry.exe is a 16-bit program.
Locate and Right-click dsentry.exe and then click Properties.
A 16-bit program does not have a Version tab in this dialog box.

Disable dsentry.exe from starting at boot.

[[dsentry.exe is an application provided by Dell. It stops the
autorun application from executing on disc insertion. This is a
non-essential process. Disabling or enabling this is down to user
preference]]
http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/

[[dsentry.exe is a valid program but it is not required to run on
startup. This program is not required to start automatically as you
can run it when you need to. It is advised that you disable this
program so that it does not take up necessary resources. The
following information is a brief description of what is known about
this file.]]

[[Anti-spyware from Dell. Seems that after Dell found out certain
applications being installed from DVD's would report back information
about what customers were watching, they decided to implement an
anti-spyware service. Run manually before installation starts]]
http://www.bleepingcomputer.com/startups/DSentry.exe-1439.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Cher7 <[email protected]> hunted and pecked:
Hello,

I also currently have the same error message as described in this
post. I attempted to rectify it by using the sfc.exe, however, did
not experience the same good results. The error message I receive
is: C:\WINDOWS\System32\DSentry.exe The NTVDM CPU has encountered
an illegal instruction. 'Close' to terminate the application.
What I did was: C:\WINDOWS\SYSTEM32>sfc.exe then
C:\WINDOWS\SYSTEM32>sf scannow then; the result was:
c:\windows\system32\ntvdmd.dll had a bad signature and was restored
to its original version
and
c:\windows\system32\charmap.exe has a bad signature. File was
restored to its original version
and
this one could not be restored: oembios.sig The problem is I still
get the same error message. Is there anything else I could do?

Thanks in advance ~

:

Hi John,

As long as sfc.exe is in c:\windows\system32 you do not need to
worry about it. sfc.exe has to run from a command prompt or the
Run box. Clicking on sfc.exe does nothing. As you have already
seen.

sfc /scannow checks the files in C:\WINDOWS\System32 if any are
screwed up it replaces the screwed up file with a copy from
C:\WINDOWS\System32\dllcache or the Windows installation source
files. Which in your case is probably the C:\I386 folder.

Do this.

Click Start | Click Run | Paste this in the Run box...

sfc /scannow

Then click OK.

It should take a while to run.

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

SFC.EXE-2FD11AB0.pf on c:\windows\prefetch All this file is, is a
file to make sfc.exe run faster.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ronashill <[email protected]> hunted and pecked:
Some challange this!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

16 bit windows subsystem game error 1
16 bit MS-DOS Subsystem 3
NTVDM error? 2
16 bit MS-DOS Subsystem c:\DFNDRF~1.EXE 1
NTVDM problems 5
16 bit MS-DOS Subsystem 1
16-bit MS-DOS Subsystem 6
ntvdm 1

Top