I have a pretty weird and annoying problem with XP... well, weird to me anyway. I recently started using XP Pro (yes, late convert), and I'm encountering a few issues that seriously make it unuseable:

After some system uptime, let's say maybe a day or two, my XP starts to show a few annoying system instabilities, the most critical being that it apparently starts to corrupt files that are saved. I first noticed it when I looked at the Firewall log in the Windows folder (pfirewall.log) and found long sequences of zero bytes (i.e. long rows of 0x00 byte values). At first I thought it's a problem with the Firewall, but it's now turned off (I'm behind a NAT, no problem), and by now I'm seeing this symptom everywhere, so it's not restricted to one application. XP seems to be doing it all over the place, I find this in every sort of File Write operation from all sorts of applications, sound, graphics, downloaded files, databases, etc.

Key points and symptoms:

-The 0x00 bytes aren't "fills", i.e. inserted into the files at some offset. It's rather as if the original data has been flattened. So it's some serious data corruption, the original byte values that are supposed to be there instead are really lost.

-Seems as if it's always a block of 4k, i.e. exactly 4096 bytes of zero values. IIRC that's also my FAT32 block size, but I'm not sure.

-This zero block always begins at an offset multiple of 8. So in a hex editor it's always aligned nicely and never begins just "somewhere" within a line of data.

-The offset depth is seemingly random, i.e. it can occur anywhere in a file, from beginning to end.

-The system is still a fairly fresh install (a few weeks old) of XP with SP2 and I think all the latest post-SP2 fixes, no malware issues, no overly fancy hardware or software or strange tweaks to it.

-This system has two HDs from two different manufacturers, and this symptom occurs on both HDs, so I'm inclined to point my finger at the OS.

-The symptom does not occur now, and has never occurred before, under any other OS on this machine (Linux, Win98SE, Dos, ...). It's a multiboot XP, so running e.g. Win98 now on this same PC, I don't have this problem. It really seems to be an XP issue.


I sort of suspect it to be a file system or caching problem, hopefully something that could be fixed with a driver update or a registry tweak or something along that line. But it could be so many things that I have no clue even where to begin to check, so I'm at a bit of a loss and left puzzled (and annoyed - sucks to kill your files that way). Has anyone ever seen this, or has any idea where to look for the cause or how to fix it?

Thanks much in advance.

Hi there and welcome to the site!

Are you fully Windows patched up there?

Hi, thanks for the welcome.
Yes, for all I can tell I'm all set patch-wise. It's basically a run-off-the-mill XP Pro.

Yessir-- but you need to run Windows update to be sure... even behind a hardware firewall ...there are vulnerabilties that can lead to problems.

Well like I said, patch-wise I'm up to date for all I know. The system "works" and has no issues that I could trace to any vulnerabilities, it's just that after a day or two I always seem to have done something that makes this XP installation sufficiently unstable to show this symptom, but I don't know what or why. It's kinda like when XP then is supposed to write a file to HD, it randomly writes one FAT32 block as plain zeroes instead of the intended data - or not, there are unaffected files too. When I reboot, everything is fine again for another day or two.

It's not any of the HDs as such - it could be e.g. a HD controller or chipset issue, in which case a driver update specific to XP would do the trick (the symptom never occurs under any other OS than XP). Though I tried that a lot and I think I've eliminated that option.

As for system stability causing it, after some time of "doing stuff", there is the ntvdm.exe running as a process which doesn't go away and can't be killed either. Obviously some program I'm using causes this to crop up and stay resident (it's of course not yet there after bootup), but I haven't determined yet which program or if this is even related to the symptom occurring.

Another wild guess would be XP's way of HD caching somehow getting funky on this PC after some time, and then screwing up when it does a write-back. Which might be fixed with somehow tweaking it accordingly, but I know too little about that to play with it just like that.

It's pretty strange, and no one I tell of it seems to have heard of anything like it before. It sure is new to me too.

Ntdvm.exe is a DOS-emulator for Windows NT-based Operating Systems...it is for much older software... 16-bit apps.
There are spyware apps which use this filename-- according to a google search-- if I were you-- I would run the Prework from the link in my sig and post a HJT log.

Yeah I know what ntvdm.exe is and does, and the file I have here is legit and uncompromised, and it's being called in nominal fashion as well. Usually it's a child process of the 16bit app that calls it and closes when that app closes as well. Sometimes I have it resident as a process for itself, as if it couldn't be shut down successfully, and I actually can't kill it manually either. I have yet to find out which of my programs causes this, and I also don't know (yet) if this is even associated with the symptom I described, or something else entirely. Stabbing in the dark here.

I'm not concerned about any possible malware or spyware issue, I'm very aware of such concerns and checked high and low for all that already. I don't see any "fishy" processes running anyway or even a whole lot of processes to begin with, or anything suspicious being started upon booting in the various autorun locations. Checks all come up clean too.