h91746.exe -- hjt log included.

[erinmiran]

"C:\WINDOWS\TEMP\h91746.exe" and when that comes up another window comes up that says "The NTVDM CPU has ecountered an illegal instruction. CS:0dc0 IP:01d4 OP:63 68 65 2f 31 Choose 'Close' to terminate the application"

I rebooted in safe mode and cleared out the temp folder, and then in normal mode I checked and it was still cleared out, and then a few minutes later, not only was h91746 back, but so was ejkoopmd.exe, win6.tmp.exe, ~DF6083.tmp, ~DF6088.tmp and T30DebugLogFile.txt

Please help me.

 

[howard_hopkinso]

First, go HERE and follow the instructions.

Then, go HERE and follow all the instructions exactly.

Post a fresh HJT log, only after doing the above.

Regards Howard

 

[erinmiran]

done. and I am aware that o10 in my hjt log is still there -- for some reason it can't remove it.

the h91746 program is gone when I first start up the computer, but an hour or so later it's back, and after a day I had nearly 500 randomly named programs in my temp folder.

 

[howard_hopkinso]

Go and follow the instructions in this thread HERE. It should help you to fix that 010 entry.

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

O11 - Options group: [INTERNATIONAL] International*

O20 - Winlogon Notify: winpdc32 - winpdc32.dll (file missing)

Click on the fix checked button.

Close HJT.

Reboot into normal mode and turn system restore back on.

Regards Howard

 

[erinmiran]

it seems to be gone; thanks so much