Monthly Archives: June 2008

The NTVDM CPU has encountered and illegal instruction

Computer Aid Posted on by

Customer PC suddenly shows a black screen (sounds like a power supply problem, or maybe a display/video card issue).

Anyway, I get there, and from what she describes, it sounds like the PSU.

After 45 minutes, I see no evidence of the screen blanking out.

We agree to replace the PSU anyway (just in case).

About 2 weeks later, I’m called back.

I’m told it all ran well for a week, then it started acting up again.

Of course, I get there, and I cannot replicate the problem after trying for 1 hour.

However, I do get 3 other problems:

  • At one point, the screen half freezes (the display won’t update, but the mouse pointer can still move, and I can still hear/see disk activity…
  • Starting a cmd prompt gives me the following error: “The NTVDM CPU has encountered and illegal instruction”. After that, it just vanishes.
  • Regedit refuses to start.

I take the PC back to the office (and leave the customer with a replacement PC (a 600Mhz HP e-PC)).

I eventually find the cause of the NTVDM error: a prior infection has left some files that replace other common windows files. eg cmd.com is placed into the windows folder… typing cmd in the run window means that cmd.com will run before cmd.exe

It also looks like other files are “substituted”:

  • regedit.com
  • tracert.com
  • tasklist.com
  • taskkill.com
  • ping.com
  • netstat.com

But antivir and defender don’t detect anything wrong with these files. I take a peek inside the files, and I see they only have 2 bytes: “MZ”

It looks like the dangerous “payload” within these files never got there (or was removed), but the files remained (causing me some confusion).

I also decide to install Service Pack 3 (and hopefully any odd corrupted file gets fixed in the process)

After that, I do a virus scan, and also look closely at various startup programs, as well as running programs (within task manager).

I find and remove “mirar search” and “funweb products”

A while later, I also notice a service called: secuROM

Research shows that its an annoying copy-protection “enforcer” that stops you from making illegal copies of media… but also seems to cause lots of problems… OK, I disable it.

A while later, while trying to get the PC to “fail” I notice IE7 stops responding whenever I look at a “news clip” (which turns out to use flash).

So I Install the latest flashplayer… and that minor problem goes away.

After running the system non-stop for about 5 days, I find no evidence of the original problem… but I fix up lots of smaller problems along the way.

Once I return the PC to the customer, I don’t hear back for over 2 weeks, so it looks like the problem is gone.

recovering data from an ipod photo

Computer Aid Posted on by

A customer want to recover about 25Gb of music from her ipod photo (30GB hard drive).

Apparently, the ipod no longer works, and she deleted all her music from her PC. She said she reset the ipod multiple times, but it keeps coming up with either a blank screen, or a frowning face.

I give it a try, as it probably has a laptop 2.5″ hard drive.

Turns out it has a weird Toshiba 1.8″ HDD… the connector looks identical to an CF card connector, except for a circle and an oval hole past the end of the rows of pins…

Hmmm, this is looking more difficult than I thought.

There is no indication that the drive will not work in a CF reader, so I try it… but it doesn’t work… it doesn’t even start spinning.

Another alternative, is to buy a special (ie expensive) adapter, so that it will “talk” over a normal IDE cable…

I’m not sure I want to go down that path. I figure I’ll just reassemble it, and give it back (no fix no charge).

Out of curiosity, I look at the apple website, and go through the troubleshooting section… I give the ipod a reset… and after the second reset, it comes back to life!

Unfortunately, the customer has already purchased a new ipod… so it looks like she’ll have 2 ipods now…

New XP SP3 services

Computer Aid Posted on by

After having installed XP SP3 a few times now, I’ve noticed it adds a few new services.

Luckily they are all set to a manual startup, so they don’t seem to impact the system.

The new services are called:

  • Wired Autoconfig
  • Extensible Authentication Protocol Service
  • Health Key and Certificate Management Service
  • Network Access Protection Agent

Other than the new services, I’ve not noticed any problems installing SP3

vista, norton, optus internet security suite 2008 = no internet and 6to4, isatap problems

Computer Aid Posted on by

Another customer calls, saying her internet mysteriously stopped working.

But only with broswing websites (page not found)… email and messenger still worked.

Its burdened with Vista and 512MB RAM… not a good start.

Soon, I see the PC is running both Norton internet security (with an expired license), and optus internet security suite 2008…

It gives a new meaning to the word “slow computer”

Since norton came with the new PC (A nasty trick, as far as I’m concerned), and once it expired, the customer installed optus ISS2008 (without removing norton first)

I spend most of the first hour trying to uninstall norton.

It got stuck right near the end, but eventually completed.

But browsing still wouldn’t work (pings work just fine)

At that point, I said: I need to work on this at the office, as there are too many possible causes, and I need to access a quick computer with internet access to fix this efficiently.

I disable the firewall, but still no browsing.

I get tired of waiting for vista, so I open up the PC, and install an extra 1GB RAM

I figure I might as well uninstall optus ISS2008, as it might somehow be blocking browsing… but I still can’t browse.

I take a look at device manager, and I see about 9 network adapters… I’m no longer sure which are real adapters, and which are used by vista as “virtual” adapters… but I see a few duplicate adapters… it looks strange, but not too concerning… after all, if they caused a problem, then they wouldn’t stop browsing only.

I do an ipconfig /all … and I’m given details on 60 network adapters :-O

Holy S… batman!

There are 43 X 6to4 adapters, and 11 X ISATAP adapters

A search on the net only shows things like “microsoft is aware of the error message… just ignore it, as it won’t affect anything”

Well I’m not buying it… it might have been caused by running 2 antivirus programs simultaneously, but I can’t leave all those adapters in place.

So I go through the registry, looking for isatap and 6to4, and find a few places where they show up. I’m careful when they show up in a group of 60 entries… So I delete almost all entries (except for the lowest number for isatap and the lowest number for 6to4.

I reboot (and cross fingers)… and vista starts without a single problem.

ipconfig looks normal, and a ping works… but still no browsing!

I install firefox and opera, but they cannot browse either.

Ordinarily, I’d say this is a firewall problem… but I’m really running out of options.

I reset the vista firewall back to default settings… still no browsing.

I remember that norton took a long time to uninstall… so I figure: maybe it didn’t fully uninstall.

So I get the latest norton removal tool, run it, and then restart the PC

Once Vista is running (more like crawling), I find I can finally browse 😀

But I’m also fuming at the piece of S… software from Symantec.

It’s now getting to the point where I sometimes have more problems with norton, as I have with infected systems… Grrr.

Problems using lightscribe with nero 7 and nero 6 coverdesigner

Computer Aid Posted on by

I recently re installed XP on my home PC.

I have a “toolkit” CD that has all my useful software tools, and I usually make it using lightscribe CDs

Well, no amount of installing and reinstall nero 6 and nero 7 would get it to work correctly. I even downloaded and installed the lightscribe service.

But coverdesigner just behaved as if there was no lightscribe drive available.

I went to the nero site, and tried all of their troubleshooting tips.

I did find a few forums that mentioned that the problem was with the license code.

Of course, I had the “bad” code. Someone suggested getting a “good” hacked code. I tried, but there doesn’t seem to be any good codes.

As a last resort, I tried nero 8, and that finally worked!

But I must say that nero 8 is not as easy to use as nero 7 (which, in turn, was worse than nero 6!).

If they keep going like this, I’ll probably switch to using different CD/DVD burning software… there seems to be lots to choose from.

Faulty recovery CD for a Sony Vaio PCG-9R2P (PCG-K7P6) ?

Computer Aid Posted on by

I normally expect a Vaio to be a nice, slim, ultraportable… but not this one!

It was big, heavy, wedge-shaped, and running an inefficient pentium4 as well!

Anyway, the customer said it suddenly stopped working correctly, so she decided to reinstall XP using the recovery CD.

The recovery would get part way through, and then say it had an error reading the disk…

I must say I’ve never seen a factory CD develop a fault before… but there is always a first time.

I take it to my office, and run some bart-pe utilities… but has problems booting the CD.

It gets part way through, and then just stops.

I figure: its time to do a RAM test.

And sure enough, it detects a fault in one of the two sticks of 256MB SODIMMS

Customer agrees to replace it with a 512MB stick… giving a total of 768 MB… but I only have 1 supplier who has the RAM in stock.

And of course, as soon as I get there, its sold out. He does have a 256Mb stick, and a 1024MB stick.

I try the 1024MB module, and it half works (it only shows 512MB)… A bit expensive… and more than I quoted the customer. I still don’t understand why laptop makers limit laptop RAM in this way!

I try the 256Mb module, and it works.

So I decide to go with 256MB, as the customer is no worse off, she gets a price discount, and she was happy with the laptops performance beforehand anyway.

I just found the model naming confusing for a while… I usually look for model numbers under most laptops, as thats where the real model number is.

But with this vaio, the number under the laptop (PCG-9R2P) gave very few google hits.

However, the number just above the keyboard (PCG-K7P6) gave me lots of results, and allowed me to track down the correct RAM module.

not enough quota is available to process this command

Computer Aid Posted on by

A new customer had a laptop that was behaving very strangely.

  • After startup, it would show: not enough quota is available to process this command
  • Event viewer would have a few errors about microsoft management console failed to create empty document
  • Most of the top bar of each window was missing (transparent)… except for a thin horizontal bar, and the 3 close/maximise/minimise buttons.

He also mentioned that windows would report that the firewall was disabled.

Naturally, the laptop behaved normally when I started it… but after 30 minutes, and after a restart, it showed its true colours.

It became almost unusable. it was very slow, many applications wouldn’t start (including control panel and regedit)…

I felt like my hand were tied behind my back… most of the tools I would normally use were unavailable.

I was just about to take the drive out and scan it from the office PC, when I decided to just start killing processes using task manager…

I made sure I didn’t kill any important system processes, and started with processes starting with the letter “A”.

After about 3 killed processes, the PC suddenly started to work normally.

Since the customer said that the laptop just didn’t operate normal since he renewed trend, then trend was the first thing to uninstall.

I then disabled various intel proset wireless services and startup applications, as they seem to be implicated in the “quota” errors (particularly the “ownershipprotocol” service).

I also do my usual services and auto-startup cleanup, install antivir, winpatrol, spywareblaster, restart the xp firewall (and reset it to its defaults).

After all that (and a cleanup of temp files and a defrag), the PC is working the way I’d expect it to.

My first infected vista system

Computer Aid Posted on by

Well, despite its significant shortcomings, vista does seem more secure than XP.

After over 1 year since its release, I had my first infected Vista system.

And in the process I found out a few interesting things about Vista.

The system had avast, and it had found a few problems, but didn’t seem able to fix the problem.

The avast log shows problems with files in (amongst other places) c:user{username}Appdatalocaletcetc.

But oddly, windows explorer won’t display the appdata folder.

In its own idiosyncratic way, vista actually lets you view the contents, but only if you actually type (or complete) the name in the “address bar” at the top of windows explorer… how odd!

Anyway, I find I just need to start in safe mode, remove the guilty files, fix the startup areas in the registry, and then defender took care of the rest.

I also reset the firewall settings to its default settings (as it seemed to be allowing most things). I also installed SP1 (without a hitch 🙂 ).

vista: unable to install printer, operation could not be completed (error 0X000006BE)

Computer Aid Posted on by

I wrote about this before:

http://www.computer-aid.com.au/blog/2007/12/10/belkin-f1up0002-setup-lpr/

This time, the customer gets a new vista laptop, so I’m asked to go around and set it up.

The customer had already tried to follow the instructions I left behind last time (just the belkin instructions from the web), but had not gotten far.

So I delete the prior “failed” printers, and then just follow the instructions… and at the end, I get the usual: “unable to install printer, operation could not be completed”. I also got an error 0x000006be

At this point, It looks like it won’t work (the printer I tried to install doesn’t show up under the vista printer list).

But I know vista likes being rebooted… so I restart.

Once vista is back and running again, the printer works perfectly.