Help - Search - Members - Calendar
Full Version: The Ntvdm Cpu Has Encountered An Illegal Instruction
BleepingComputer.com > Operating Systems > Windows Vista
   
Lorenti
HELP PLEASE
I keep getting the following message
16 bit MS-DOS Subsystem
The NTVDM CPU has encountered an illegal instruction
CS:11f7 IP:012d OP:f0 62 74 71 13 Choose 'Close' to terminate the application.
If I choose close it disappear for a couple of seconds then it will appear again. but if I choose ignore the above disappear but I'm left with the MS -DOS window 'C:\Windows\System32\wuauclt.exe.
DaChew
We need to turn off windows update and do a malware scan, what types of antimalware protection are you using and you are running vista? right?
Lorenti
I'm running kaspersky anti virus and it is vista
DaChew
http://windowshelp.microsoft.com/Windows/e...e508331033.mspx

see if this removes the error for now, we will procede from there if it does

Lorenti
Great no error message any more ..thanks a lot..But now I have stopped the windows update is that mean no more updates for my pc?
DaChew
Don't worry about the updates for now, let's try and find out what was causing the conflict?

If this was xp I would ask for a running processes list to give me a clue.

Are there any other problems with the computer like signs of malware?

Lorenti
No other problems to report. I have windows vista. thanks Chewy
DaChew
which exact version of kasp are you running?

Is defender active?

any other anti-malware software installed?
Lorenti
kasp 7.0

as for the anti - malware software installed, yes I have quite few.

SUPERAntiSpyware Free Edition
Trojan Remover
Uniblue Powersuite with spyeraser included.
Lorenti
windows defender is active

DaChew
which kasp?

http://www.kaspersky.com/

av or the suite?
Lorenti
av
DaChew
first I would try the manual update from microsoft, then I would consider turning off defender, it's not very good

are all these versions paid? Kasp is a very good AV product

what you want to watch out for is duplicate resident(loading at bootup) protection

Lorenti
None of the softwares are paid up they are all from utorrent..how do i perform manual update. My windows fiewall is turned off do i turn it on?
DaChew
anything from utorrent is highly suspect, the best malware writers in the world seed their evil there, often integrating a backdoor trojan or downloader into an installer

by all means turn on windows firewall, it's not the best but vista's is a lot better than xp's which is better than nothing

are you behind a good hardware nat firewall(a router)?

there are plenty of free or very economical protection products, don't resort to cracked ones

whistling.gif



Lorenti
Yeah I think you are spot on there mate... I will not download anything again from utorrent ..And yes the firewall is quite good .. so I'll keep what I have I suppose In have managed to do a manual update so thanks.

What about the other anti malware - software I have mentioned earlier, do I unstall them all and rely on kaspersky only? what do you think?
DaChew
let's get a second opinion

here's a good free scanner

Please download Malwarebytes' Anti-Malware to your desktop.

http://www.besttechie.net/tools/mbam-setup.exe

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:


Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware


Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.

If it finds anything we can always have this thread moved over to the Am I Infected
Lorenti
Here's the report mate have a look..thanks

Malwarebytes' Anti-Malware 1.11
Database version: 702

Scan type: Quick Scan
Objects scanned: 31658
Time elapsed: 7 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\AdwareAlert (Rogue.AdwareAlert) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Users\djamel\AppData\Roaming\AdwareAlert (Rogue.AdwareAlert) -> No action taken.
C:\Users\djamel\AppData\Roaming\AdwareAlert\Log (Rogue.AdwareAlert) -> No action taken.
C:\Users\djamel\AppData\Roaming\AdwareAlert\Settings (Rogue.AdwareAlert) -> No action taken.

Files Infected:
C:\Users\djamel\AppData\Roaming\AdwareAlert\rs.dat (Rogue.AdwareAlert) -> No action taken.
C:\Users\djamel\AppData\Roaming\AdwareAlert\Log\2008 Apr 04 - 04_35_08 PM_398.log (Rogue.AdwareAlert) -> No action taken.
C:\Users\djamel\AppData\Roaming\AdwareAlert\Settings\ScanResults.pie (Rogue.AdwareAlert) -> No action taken.
DaChew
are those entries left from a previous install?
Lorenti
probably..can I just remove them? please advise. thanks Chewy
DaChew
yes remove them, I don't think we need to move your thread tho

I suspect you just have a software conflict
Lorenti
all done thanks chewy
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.