At work we are usin SBS 2008 and all workstations run winXP. Once a week we get the message c:windows\system32\cmd.exe - the NTVDM CPU has encounted an illegal instruction with the option to close or ignore. It comes up on every workstation at the same time each week. Has anyone seen this and know why it does it?

Is there anything in the event log that corresponds with the same time the error occurs?

This is the NT Virtual DOS Machine and simulates a 16-bit environment in Windows. Do you have any older 16-bit apps running that could be causing this? Also, if it's once a week, is something scheduled to run at the time the errors occur?

The NTVDM attempted to create an isolated environment within the architecture of Windows NT, above the Executive Layer. It enabled 16bit (DOS) applications to run within a 32bit environment, it still does in fact. The theory was that if the DOS application crashed, as they were likely to do, it wouldn't take any other applications or the operating system down with it. The application would crash within the NTVDM and the NTVDM would contain that event within the Win32 subsystem, and not allow it to access the hardware (Microkernel). This didn't always work as it should, and usually resulted in the infamous BSOD. Fortunately things are becoming a little more stable on the Windows front, and we see less BSODs than we use to.