rmass.exe

silverandcold · Oct 7, 2006

Everytime I try to boot my laptop, after the Windows screen, the blank desktop appears with no icons or start menu, and the following message appears in a pop up box...

16 bit MS-DOS Subsytem
C:\Windows\System32\rmass.exe
The NTVDM CPU has encountered an illegal instruction
CS:0d9b IP:0110 OP:62 da da da

There are two buttons, Ignore and Close. Regardless of which button I click on, the box does not go away.

It does this even in safe mode. I can't get in to Windows to run an AV. I suspect this is malware related, since there was some spyware already on the system. It is Win XP home service pack 1.

Thanks for any assistance.

chaslang · Oct 8, 2006

Welcome to Majorgeeks!

Yes rmass.exe is malware but if you cannot boot Windows in either safe mode or normal boot mode, then the only way to remove the file would be from the Recovery Console. Do you have your Windows XP SP1 CD that you can boot from? If you do then try the below.

put the Windows CD in the tray and reboot the computer (make sure your PC has the BIOS setup to boot from CD before trying to boot from your hard disk)

if you receieve a "press any key to boot from CD" message, press a key.

It will load a bunch of files and eventually give you a menu where you can select the Recovery Console by pressing R

You'll see your Windows Installation like "C:\Windows", type the number 1 and press enter.

Administrator password is next. It will be whatever you set it to or it may be blank if it was never set. If blank, just press enter.

When the above is finished you should have a C:\Windows> prompt

Now we will delete the file by typing the following command

del System32\rmass.exe

Now reboot your PC and tell me what happens.

Log in or Sign up

rmass.exe

silverandcold Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member