16 bit MS-DOS Subsytem

lolly291060

Hi I,m a new member and i'd like firstly to say hello,

Can anyone help with a problem I'm having on my pc.Over the last few days I have a message box popping up on my screen,
at the top it says, 16 bit MS-DOS Subsytem,

and inside it says, C:\windows\INSTAL~1\{4A65D~1\_A685C~1.EXE
The NTVDM CPU has encountered an illegal instruction.
CS:058d IP:01df OP:0f 00 09 0000 Choose 'Close' to terminate the application. and the bottom are 2 boxes one for close and another for ignore

I am running windows 7 with norton 360 installed,I have done a scan with malwarebytes and deleted what it found,scanned with eset online and deleted what that found norton always scanning and that not showing anything also scanned with Superanti spywear and deleted what that found.This messge still popping up any ideas please?

Myser

It could be some sort of Spyware on your system:

http://www.techspot.com/vb/topic5039.html

Clearly, Norton isn't very good at removing it as you've found. All the other products you used have detected something and you've removed what they found.

I would suggest you download SpyBot (Search & Destroy) and run a full scan with that:

http://www.spybotupdates.biz/files/spybotsd162.exe

When did you last update Norton anti-virus?

lolly291060

just done scan with spybot and its not found anything and norton updates a few times a day, i know it misses things thats why i use other programs.I just cant understand where this has come from because when it started popping up i hadn't downloaded anything.I do online shopping and online banking and i am just concerned as to whether my details are safe so I would love to get this matter cleared up.Thanks for your help and if any other advice is available I would be really appreciative

closed

upload the file to www.virustotal.com or just delete it

and check for a lnk in your startup folder pointing to it

c:\progra~2\micros~1\windows\startm~1\programs\startup\launch.lnk - c:\windows\installer\{4a65dad2-e914-4923-9c2a-81b968a68ce2}\_A685CC3126A7CC37D335DE.exe

alanrowell

It's not any form of nasty. Deleting the file might result in some "interesting" results.

It's likely that some update has affected your system.

First do a system restore to before the problem started
If that doesn't fix it the follow these instructions to identify the program that is causing the problem

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/the-ntvdm-cpu-has-encountered-an-illegal/8c747c8a-4b42-4dd1-923a-de32ede64584

lolly291060

Cant upload because i don't know where the file is all i can see is was pops up on screen plus i forgot to mention a black command box appears aswell.Ive looked in my startup file and theres nothing in it ??

closed

the short path and probable long path is listed above.

lolly291060

well I'v done a system restore and it seems to have stopped the pop up also done another scan and nothing showing.Keeping my fingers crossed that my problem solved ,thanks to you all :T

esuhl

I didn't think that Vista/7 had a 16-bit subsystem (except for XP-mode in the Ultimate versions), so I guess that's the reason the executable encountered an illegal instruction.

I assume that the file was some kind of malware, but if it was one that you wanted to run, you could either upgrade to a version of Windows that includes XP-mode or install XP as a virtual machine using software like VirtualBox.

lolly291060

dint want to run what ever it was and seems to av gone now,hopefully, fingers crossed.all i know it started to pop up and even though i would press the red x it would keep comin back.I'm not sure if it was something my grandaughter had clicked on when she was on her side of computer,anyway I'm happy for now thanks

rmg1

Is it worth posting the logs from MalwareBytes, Eset online and SAS?
Might be something else on there that shouldn't be.