CMD will not run properly

Windows XP >> CMD will not run properly Hello,
My cmd will not run properly. When i type "ping 192.168.1.100" or any other
command for that matter, it displays about 2 lines of zeros, then says: the
NTVDM CPU has encountered an illegal instruction. CS:054c IP:fff0 OP:fe ff 1d
09 30 Choose 'close' to terminate the app. Someone help!

Windows XP1310

Windows XP >> CMD will not run properly You may have a trojan/virus/worm.

Are you using cmd.exe or cmd.com?

cmd.com is *NOT* an XP file. This is a file that gets added by a
trojan/virus/worm.

What happens if you type: cmd.exe in Start | Run instead of cmd?

What happens if you type: ping.exe 192.168.1.100 instead of ping
192.168.1.100?

Does regedit open if you type: regedit in Start | Run?

Update your antivirus software and run a complete scan.

Update whatever anti-spyware applications that you have and run a full
system scan with each one.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:EMail@HideDomain.com,
Nublet <EMail@HideDomain.com> hunted and pecked:
> Hello,
> My cmd will not run properly. When i type "ping 192.168.1.100" or any
> other command for that matter, it displays about 2 lines of zeros, then
> says: the NTVDM CPU has encountered an illegal instruction. CS:054c
> IP:fff0 OP:fe ff 1d 09 30 Choose 'close' to terminate the app. Someone
> help!

Windows XP >> CMD will not run properly
"Nublet" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> Hello,
> My cmd will not run properly. When i type "ping 192.168.1.100" or any
other
> command for that matter, it displays about 2 lines of zeros, then says:
the
> NTVDM CPU has encountered an illegal instruction. CS:054c IP:fff0 OP:fe ff
1d
> 09 30 Choose 'close' to terminate the app. Someone help!

Your machine is most likely infected with spyware or
with a virus. It placed some garbage commands on your
PC that are now invoked instead of the real thing. How
good is your virus protection?

Have a look the folders c:\Windows and c:\Windows\System32.
You will most likely find some files such as cmd.com or ping.com.
Get rid of them - the correct commands are cmd.exe and ping.exe.

Windows XP >> CMD will not run properly I tried that Ping...and got "Request Timed Out".

"Nublet" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> Hello,
> My cmd will not run properly. When i type "ping 192.168.1.100" or any
> other
> command for that matter, it displays about 2 lines of zeros, then says:
> the
> NTVDM CPU has encountered an illegal instruction. CS:054c IP:fff0 OP:fe ff
> 1d
> 09 30 Choose 'close' to terminate the app. Someone help!

Windows XP >> CMD will not run properly Yeah, guys. Thank you. When i typed the 'exe' after the files, they worked.
So im running a full 'deep scan' as we speak. Should take care of the
problem. Thanks again.

Windows XP >> CMD will not run properly
"Nublet" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> Yeah, guys. Thank you. When i typed the 'exe' after the files, they
worked.
> So im running a full 'deep scan' as we speak. Should take care of the
> problem. Thanks again.

Not necessarily. The bogus files may be duds but they
may not be infected with a virus, in which case your virus
scanner may not detect them. Get rid of them manually!

Windows XP >> CMD will not run properly Because 192.168.1.100 is probably an intranet address on a home network not
an internet address.

[[Private Addresses
There are also blocks of IP addresses that are set aside for internal
private use for computers not directly connected to the Internet. These IP
addresses are not supposed to be routed through the Internet, and most
service providers will block the attempt to do so. These IP addresses are
used for internal use by company or home networks that need to use TCP/IP
but do not want to be directly visible on the Internet. These IP ranges are:
192.168.0.0 through 192.168.255.255 ]]
from...
IP addresses Explained
http://www.bleepingcomputer.com/tutorials/tutorial37.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:eo$EMail@HideDomain.com,
Andrew Murray <EMail@HideDomain.com> hunted and pecked:
> I tried that Ping...and got "Request Timed Out".
>
> "Nublet" <EMail@HideDomain.com> wrote in message
> news:EMail@HideDomain.com...
>> Hello,
>> My cmd will not run properly. When i type "ping 192.168.1.100" or any
>> other
>> command for that matter, it displays about 2 lines of zeros, then says:
>> the
>> NTVDM CPU has encountered an illegal instruction. CS:054c IP:fff0 OP:fe
>> ff 1d
>> 09 30 Choose 'close' to terminate the app. Someone help!

Windows XP >> CMD will not run properly Adding to what Pegasus posted.

You still have get rid of some things manually.

WORM_ALCAN.A
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FALCAN%2EA&VSect=Sn

W32.Alcra.A
http://www.symantec.com/security_response/writeup.jsp?docid=2005-051714-2837-99&tabid=3

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:EMail@HideDomain.com,
Nublet <EMail@HideDomain.com> hunted and pecked:
> Yeah, guys. Thank you. When i typed the 'exe' after the files, they
> worked. So im running a full 'deep scan' as we speak. Should take care of
> the problem. Thanks again.