Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

NTVDM Illegal Instruction Popup


  • Please log in to reply

#1
jmcconkey

jmcconkey

    Member

  • Member
  • PipPip
  • 61 posts
Hello all. Last night I started getting this windows popup every 1 - 2 minutes. I have no clue why it has started. Im not sure if its a virus or something? I have listed the entry from the Event viewer.

I am running Win XP Pro. The computer is a little slow as well, and I have 2 gigs of Ram??

EVENT VIEWER ENTRY:

Application popup: 16 bit MS-DOS Subsystem : C:\DOCUME~1\donkey\LOCALS~1\Temp\cmd.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0567 IP:023e OP:63 68 65 2f 31 Choose 'Close' to terminate the application.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


Any help would be great! Thanks
  • 0

Advertisements


#2
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Click start then run, type prefetch then press enter, click edit, select all, right click any file, click delete, confirm

Run disc clean up, reboot the PC
  • 0

#3
jmcconkey

jmcconkey

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
Thanks for the responce. I followed the instructions from your post. However, it did not change anything. I still get the popups. I noticed also just noticed the following in the event viewer:

Timeout (30000 milliseconds) waiting for the winsock32 service to connect.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


__

I also notice winsock32 listed in the Startup list in MSCONFIG. I have never seen it there before.

Also in the registry, I am noticing regscan.exe, i think that is a bad thing. I have ran several spyware dectectors, but they dont seem to help.
  • 0

#4
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

Name: Regscan
Filename: regscan.exe
Command: C:\Windows\System32\regscan.exe
Description: Added by the Troj/Clicker-DV Trojan.
File Location: %System%
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
HijackThis Category: O4 Entry
Note: %System% is a variable that refers to the Windows System folder. By default this is C:\Windows\System for Windows 95/98/ME, C:\Winnt\System32 for Windows NT/2000, or C:\Windows\System32 for Windows XP.

Download and run this for winsock

http://www.snapfiles...nsockxpfix.html

Download and run XPFixe.exe

http://www.visualtou...oads/xp_fix.exe
  • 0

#5
jmcconkey

jmcconkey

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
Okay...I will switch to the malware forum. However, I did run the winsock fix that you gave me the link for, and when the PC rebooted, it would not allow me to connect to the network anymore. When I tried to "repair" the connect, it said it could not. so I went to command prompt and did a "Ipconfig /renew" and it kept saying that the ip address being assigned was already in use. So I eventually just manually assigned a ip address and the internet works, sorta weird
  • 0

#6
jmcconkey

jmcconkey

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
Something is seriously wrong now. However something is definantly wrong. After I ran the Winsockxpfix it did something so my PC would not get an IP addy. I manually gave it one. And it worked fine. Once I rebooted however it will not connect to the internet at all. I can however connect one of my PC's on the local network? I looked at my services and I see a handful of items listed with automatic, but are no running, one being winsock. I really need to figure out how to at least get my internet back.
  • 0

#7
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Open IE even if it does not connect, type 192.168.0.1 in to the address bar, press enter, does it load the router set up page

Has the router got a reset button
  • 0

#8
jmcconkey

jmcconkey

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
Yes it does go to the Router Page. I will try reseting the router. But my other PC's on the network can access the internet fine. I will try it eitherway and let you know.
  • 0

#9
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Have you got the network adapter software, re-install it if only one PC is affected
  • 0

#10
jmcconkey

jmcconkey

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
Wow..what a night. Okay I tried resetting the router, and that screwed everything up...lol After doing that, none of my PC's could connect to the internet. I did finally get one to work by i guess creating a pppoe broadband connection in my network places. This did allow me to connect to the internet, I guess it is just using the router as a bypass? My PC will not connect to the router at all when I put in the IP address of the router. I think something happened to my router when I reset it. Verizon is sending someone out today to look at it.

The popup issues with the NTVDM Illegal Instruction has stopped at this point. So perhaps one problem fixed and another occurs..lol. Hopefully they can get it back up and running today because even though I can connect to the internet this way, I have no connectivity to my other PC's, printers, or vonage phones. :whistling:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP