BleepingComputer.com: 16 bit MS-DOS Subsystem (random pop up)

I was watching a TV show online when all of a sudden my command prompt window pops open, followed by a window that has the following:

16 bit MS-DOS Subsystem

C:\Windows\system32\wuauclt.exe
The NTVDM CPU has encountered an illegal instruction.
CS:1212 IP:0109 OP:8c 75 29 ae 2c Choose 'Close' to terminate the application.
[Close] [Ignore]

If I choose ignore, the window simply remains.
If I choose close, it closes and then pops right back up about 15 seconds later.

After a little looking around on the net I found out this has something to do with one of the following two:
1. Windows Update
2. Its a virus/malware of some sort.

I went in to shut off Windows Update and the screen is totally messed up.




Due to the fact that I've had my computer crash in the past (not anything like this though...it was blue screen of death last time...) I'm currently working on backing up all of my files to my external hard drive.

I am also currently running a full Virus and Spyware scan with Norton 360 - this is the only defense program that I'm aware that I've got on my system.


One last little detail; on the red shut down button in my start menu, it has the little ! sign signifying that there are updates to be installed on my next shut down.

Can anyone help me?

backing up your information is an important first step.

Checking for malware (viruses and such) is an important first step. I would not trust Norton alone. Download Malwarebytes at malwarebytes.org and run it. The great thing about malwarebytes is a) it's free and it does not have an 'active scanner', so there is no chance of a conflict with Norton.

If you don't find any malware, you may want to run a chkdsk (command: chkdsc c: /r)

I have run the malware scan, both a quick and a full, and it came up with nothing.

How do I run a chkdsk?

open a (legitimate) command prompt: windows key + r; type in 'cmd' and press enter.
start the chkdsk: type in 'chkdsk c: /r' and press enter. It will want you to restart so do so.

Be sure to pay close attention when step 5 is almost done. It will bring up a report, look for a report of bad sectors. If you have no bad sectors, nothing will be reported about it.

So, I went in to run the chkdsk and got this:
Access Denied as you do not have sufficient privileges.
You have to invoke this utility running in elevated mode.

Well, I am the owner of the PC and the only account...so I'm the administrator; not really sure how I don't have the privilege to run this....

Still need help if anyone else has advice.

First things first, you would have to download from another non-infected computer Malwarebytes to install on the problematic computer. Head over to http://www.malwarebytes.org/mbam.php and at the left download the free version. Just install that on the infected computer and run the full system scan. It would take an hour or longer. When it’s finished, allow it to remove any infected items it finds.

Secondly, Download hijackthis from http://download.cnet.com/Trend-Micro-Hijac...4-10227353.html transfer it to the infected system and run a system scan. Then save the log file and post it on this thread. Either I or another expert can tell you which items to safely remove.

Chris

Running Malwarebytes is fine, but please do not follow instructions for running HijackThis (HJT). HJT logs are only allowed to be requested and analyzed in our malware forums.
Thanks!

@askpcguy At BleepingComputer, only trained staff can request/assist with HJT logs.


rigel
BC Forums Moderator

Still haven't found a solution to this problem.

jessicalynn021, on Nov 19 2009, 10:22 AM, said:

You have not said anything that you tried in attempting to resolve this problem. We cannot help unless you provide information on what you've tried doing to resolve this problem.

I have noted the following attempts (in former posts) to figure out what is wrong so that I can solve the problem.

1. Ran a full Virus and Spyware scan with Norton 360 [results: nothing found]
2. Ran a full scan with Malwarebytes [results: nothing found]
3. Attempted to run a chkdsk [results: "Access Denied as you do not have sufficient privileges.
You have to invoke this utility running in elevated mode." - note: I am the administrator on my laptop.]

What happened when you experienced the computer crash? Are you still using the operating system from when the computer crashed or did you cleanly install Windows after the crash?

I located this discussion for a similar problem with Windows Update on Windows Vista:

http://social.answers.microsoft.com/Forums...e8-194645295d00

If you decide to follow the directions in that thread, please use System Restore to create a restore point should anything go wrong.