Hello all,
This is my first thread posting. I am having a similar problem that was reported earlier on your message board concerning an error message that consistently keeps popping up, named "16 bit MS-DOS Subsystem". The message is below:

C:\WINDOWS\TEMP\h91746.exe
The NTVDM CPU has ecountered an illegal instruction.
CS:0dc0 IP:01d4 OP:63 68 65 2f 31 Choose 'Close' to terminate the application

I have tried to do everything that was instructed by howard_hopkinso's posting (http://www.techspot.com/vb/topic44921.html) and now, I'm at the last task where I need to post my hijackthis.txt file as an attachment, for which I've included the file with this thread.

Any help is greatly appreciated!!!

Hello and welcome to Techspot.

Go HERE and follow the instructions.

Then do the following.

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnnsi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140944855546
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: winupx32 - C:\WINDOWS\SYSTEM32\winupx32.dll

Click the fix checked button.

Close HJT.

Reboot into normal mode and turn system restore back on.

Regards Howard :wave: :wave:

Reply to howard_hopkinso on "h91746.exe" error

Hello,
I have completed all the instructions in your thread. Attached are the Look2Me-Destroyer.txt and hijackthis.txt files, as instructed by the link:
http://www.atribune.org/content/view/28/

Shortly after I rebooted my PC into normal mode, the same "h91746.exe" error message popped up again on the screen. So, is this all that needs to be done to solve my problem?

Appreciate your time and help!!!

Boot into safe mode and turn system restore off.

Let HJT fix all your 016 DPF entries.

Also fix all 018 entries.

Fix this one O20 - Winlogon Notify: winupx32 - C:\WINDOWS\SYSTEM32\winupx32.dll

Run HJT and click on the config button, then on the misc tools button. Click on the dlete file on reboot button. Browse to C:\WINDOWS\TEMP\h91746.exe and click open. You will be asked if you want to restart your system. Click yes.

The file should be deleted.

Turn system restore back on.

Regards Howard

Still not working ...

Hello,
After completing all your instructions, the same error message is still poppng up after deleting that .exe file and rebooting my PC, although I have to admit not as often as before. Is there anything else you can recommend to fix this?

Thanks,
yeungkw

You did NOT follow the instructions from this post:
http://www.techspot.com/vb/topic17297.html