Computing.Net > Forums > Security and Virus > NTVDM CPU illegal instruction

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

NTVDM CPU illegal instruction

Reply to Message Icon

Name: a2dox
Date: June 19, 2006 at 09:36:34 Pacific
OS: Windows XP SP2 (WinNT 5.0
CPU/Ram: AMD Athlon XP 1800/256meg
Product: custom
Comment:

Trying to fix my husband's computer and am about at my
wit's end. It appears that these problems may be related
to the Trojan Dowloader Zlob.AOJ that I've since removed,
but the problems still persist.

Symptoms

Several programs will not run, instead displaying the error
message:

C:\WINDOWS\system 32\rundll.32.3xe
The NTVDM CPU has encountered an illegal instruction
CS:0549 IP:02b0 OP:c6 32 fa 3c 77 (this code varies)

Some of the programs affected include: Netscape,
Properties, Add/Remove programs, eTrust autodownload,
Add Hardware, Security Center, System Info, Wordperfect

The problem also occurs in Safe Mode

Also, upon booting, eTrust antivirus (which I've since
disabled since it's not working) would display the
following message:

eTrust EZ Antivirus Out-of-date Warning:
Warning You MUST download and install the latest virus
signature files for your anti-virus software before it will
start working. You have no antivirus protection until you
finish installation by installing the virus signature update.
(Note: this product was up-to-date before.)

If we then click Autodownload we get the message:
AutoDown.exe - Bad Image: The application or DLL C:
WINDOWS\system32\sesapi.dll is not a valid Windows
image. Please check this against your installation
diskette.

eTrust Firewall gives the message on boot-up: Unable to
load MyVault.

My husband tried to Restore to an earlier system; this did
not work.

Per some suggestions on the Microsoft site, I've checked
autoexec.nt and config.nt - both look fine. I can run
command.com from the "Run" command, and have no
problems running commands from the DOS prompt. It
seems to only be some Windows programs that are
affected.

I tried disabling all programs that load at start-up. That
didn't work. I deleted tmp files. I cleaned the registry
using Tune Up Utilities 2004. That didn't work either.
(After that the network connection to the internet
completely disappeared and the system isn't recognizing
our wireless adapter, though that could be a hardware
problem since the adapter's been a bit quirky lately.) At
this point, I'm downloading things onto my computer and
copying them to my husband's computer. So far we've
used AVG - which detected and cleaned the Zlob.AOJ
virus, Ewido - which got rid of 37 adware/tracking
cookies, ErrorKiller - which cleaned up over 300 registry
entries - all to no avail.

I ran HiJackThis and found a few questionable or unnecessary items after running it through the analyzer which I had it fix. The latest HijackThis log appears to be clean, but the problems still persist.

Does this suggest some permanent file damage?




Sponsored Link
Ads by Google

Response Number 1
Name: XpUser4Real
Date: June 19, 2006 at 10:00:25 Pacific
Reply:

This page may be of help to you
http://forums.spybot.info/showthread.php?t=5037

Hopefully my advice will help you...Please post back with your results....thanks


0
Reply to Message Icon

Related Posts

See More


I dont know how it got th... BDS/Ruledor.j.1 again



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: NTVDM CPU illegal instruction

16 bit ms dos subsystem ntvdm cpu has encount www.computing.net/answers/security/16-bit-ms-dos-subsystem-ntvdm-cpu-has-encount/26626.html

h91746.exe cannot get rid of it www.computing.net/answers/security/h91746exe-cannot-get-rid-of-it/17862.html

Trojan detected! Please advise. www.computing.net/answers/security/trojan-detected-please-advise/17977.html