Hi All,

Good Day!!!

I am facing an issue of desktop.exe. Its right under startup folder.In the task Manager I am frequently getting this error message. Once I kill the process it goes away but after sometime its generated.

Also the users are frequently getting the error message "NTVDM CPU has encountered an illegal instruction."

No Log entry for both the case.

Can any one help me regarding this.

Submit the file to security response

http://www.symantec.com/security_response/submitsamples.jsp

Take the machine off the network and scan in safe mode with the latest defs.

Is this just affecting one PC?

Use the SymHelp tool to do a Load Point analysis

How to collect Load Point Analysis logs for Symantec Support with the SymHelp utility

Also, you can submit to virustotal and threatexpert to see what this may be and if it is being detected by other AV products.

https://www.virustotal.com/

http://www.threatexpert.com/

hi,

You can submit the virus file in symantec response team,if sep not detect virus.

How to Use the Web Submission Process to Submit Suspicious Files

The Symantec Security Response sample submission process

Whether the below error message is related to this desktop.exe issue.

"NTVDM CPU has encountered an illegal instruction". Is it possible for a windows related issue

Hello,

Yes this is window related issue

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/the-ntvdm-cpu-has-encountered-an-illegal/8c747c8a-4b42-4dd1-923a-de32ede64584

hello,

Can you share OS version ?

Check this

http://answers.microsoft.com/en-us/windows/forum/windows_vista-performance/the-ntvdm-cpu-has-encountered-an-illegal/c1fdc0a2-7c16-4ea9-95a4-05bf73dde383?msgId=9d7a3f88-4636-4322-9420-ce5d0e0a810b

Hello,

You can check the file in Virustotal to analysis the file, if virus content found then submit to symantec secuirty.

https://www.virustotal.com/

Symantec Secuirty Virsu Submission link

https://submit.symantec.com/websubmit/retail.cgi

For NTVDM issue, check the below link

http://www.techspot.com/community/topics/c-windows-system32-wscntfy-exe-the-ntvdm-cpu-has-encountered-an-illegal-instruction.169888/

http://support.microsoft.com/kb/q196453

hi,

You can try to repair your windows system

At the command prompt, the following line, and then press ENTER: sfc /scannow

http://answers.microsoft.com/en-us/windows/forum/windows_other-gaming/i-get-an-error-after-every-updatemaintenance-of/9d700492-3f11-4b0b-b7d5-f94a2dea752c

hi,

Virus has been corrupt your OS you can submit file in symantec team and repair OS

https://submit.symantec.com/websubmit/retail.cgi

Hello,

In case, if your system is infected, symantec tools to help clear an infection. Check this Link:

www-secure.symantec.com/connect/forums/your-system-infected-symantec-tools-help-clear-infection

Try running the SymHelp Utility which may assist you to understand the basic issues.

https://www-secure.symantec.com/connect/articles/about-new-symhelp-tool-sep-121ru2

Symantec Help (SymHelp) is a utility designed to quickly and efficiently diagnose common issues encountered on multiple Symantec products. SymHelp can identify most of the problems that you might run into when installing the client, and provide instructions on how to solve them. 

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

https://www-secure.symantec.com/connect/articles/using-symantec-help-symhelp-tool-how-do-we-collect-suspicious-files-and-submit-same-symante

Symantec Power Eraser using Symantec Help (SymHelp) Tool.

https://www-secure.symantec.com/connect/articles/symantec-power-eraser-using-symantec-help-symhelp-tool

Symantec Endpoint Recovery Tool (SERT)

https://www-secure.symantec.com/connect/articles/symantec-endpoint-recovery-tool-sert

Here's some advice from Security Response on how to make the best use of SEP.  Auto-Protect with traditional AV derfinitions alone is not enough for a complete defence against today's sophisticated threats: using IPS, Insight etc is crucial.  And, of course, educated users following best security practice... that';s the best protection.

http://www.symantec.com/theme.jsp?themeid=stopping_malware&depthpath=0

Secondly, I would also advise you to create a case with Symantec Technical Support - 

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

Hope this helps!

The Clampi virus from a few years back gave this same error message. Also, judging by the name desktop.exe and the behaviour you described, I would say that it is a virus. Follow the posts here to get it submitted to Symantec.

Hi,

Before submitting it to the Symantec go through the following steps 

1) Install all the SEP features i.e. AV/AS, PTP & NTP.

1) System should be updated with Service packs and windows patches.

2) Make sure the machines are installed with the latest third party applications.

3) Disable the Autorun Feature if not using SEP 12.1.

4) Scan the full system in safe mode.

5) Use Symantec power eraser to scan the system.

http://www.symantec.com/theme.jsp?themeid=spe-user-guide

Best practices for responding to active threats on a network

http://www.symantec.com/docs/TECH122466 

If these steps couldn't help then I would also suggest to submit suspicious files to the Symnatec.

How to Use the Web Submission Process to Submit Suspicious Files

http://www.symantec.com/docs/TECH102419  

Hi,

Is there any update?

Kindly update the current status of your issue on the forum, if it resolved then mark the comment as solution which help you.