A Way to Stop Some "The NTDVM CPU has encountered an illegal instruction" Error Messages from Occuring During Startup ?

[Scott Broddy]

I hope this helps some of you who are getting this chronic problem always
occuring at every startup or user change. Read on....

In my particular instance, the first symptom that appeared at startup was a
command prompt window with nothing but a flashing cursor at the left
uppermost corner of the window. The window was labelled
"C:\Windows\explorer\Explorer.exe". This was followed shortly by an error
message window titled "16 Bit MSDOS Subsystem" containing the following
message: "C:\Windows\explorer\Explorer.exe. The NTVDM CPU has encountered
an illegal instruction. CS:0532 IP:01b3 OP:636b 65 72 2e. Choose 'Close' to
terminate the application."

Searching Microsoft's Knowledge Base using the keyword "NTVDM" turned up
articles Q314106 and Q156687 which helped me somewhat. However, these did
not relate that close to my particular situation in that they did not
mention the importance of noting the name and location of the file that is
in the error message (in my case, "C:\Windows\explorer\Explorer.exe"). The
Knowledge Base articles only talk about the error message ("The NTVDM CPU
has encountered an illegal instruction") in general. Basically all I gained
was some background about this problem from the articles.

Where I finally began seeing a light at the end of the tunnel was when I
decided to search for all files named 'Explorer.exe'. A file turned up at
'C:\Windows' but also at another subdirectory, 'C:\Windows\explorer'.
Left-clicking the 'Explorer.exe' file in the 'C:\Windows' directory started
up Windows Explorer as expected. I then tried left-clicking the
'Explorer.exe' file in the 'C:\Windows\explorer' subdirectory and lo and
behold the exact same symptoms appeared as those that appear at startup. I
finally located the culprit! I then tried using Windows Explorer to find
the 'C:\Windows\explorer' subdirectory without success. I was able finally
to look up the properties of the 'C:\Windows\explorer' subdirectory and note
that it had a 'hidden' attribute. To change Windows Explorer so hidden
files and directories would be displayed, I clicked 'Start> Control Panel>
Appearances and Themes> Folder Options> View and then selected 'Show hidden
files and folders' in the list that appeared.

I was then finally able to find the 'C:\Windows\explorer\Explorer.exe' file
using Windows Explorer. I took the next bold step of deleting the file (and
ignoring the warning messages that appeared next). I then used 'Norton
Utilities 2002- Norton Windoctor' and it helped by noting a 'Missing Startup
File- C:\Windows\explorer\Explorer.exe'. To repair I first chose "Let me
choose which method to repair" (otherwise choosing "Let Windoctor choose
what method to repair fault with" will allow the program to pull the deleted
file out of the recycle bin and put it back in the 'C:\Windows\explorer'
subdirectory). I chose the option "Delete invalid registry entry" and That
was it.

I restarted Windows and voila! No NTVDM error message! Hope this helps!
May God Bless!

[Vlad R.]

Sounds like the "other" explorer was a Win9x/3.1 virus/trojan.
V.

"Scott Broddy" <sbr...@hotmail.com> wrote in message news:<#vfwfi#qBHA.2432@tkmsftngp07>...