Question

Locked

system32\cmd.exe POP-UP's

By stetienne1 ·
Hi this is my first post, I apologize for any protocol errors. I'm trying to fix a friends computer but at startup I get 6 blank popup windows with "windows\system32\cmd.exe" headings. These then disappear one by one after about 10 seconds. Does anyone know what this is, if it is harmful, and how I can fix it? Many thanks, Nick.

This conversation is currently closed to new comments.

15 total posts (Page 2 of 2)   Prev   01 | 02
Thread display: Collapse - | Expand +

All Answers

Collapse -

then mabee

by PC-guru In reply to thanks, have tried that

get somthing like spybot search and detroy and run a scan....also awesome tool hijackthis you can download it from hijackthis.de it tells you everything install on you system

Collapse -

yup

by stetienne1 In reply to then mabee

tried that too, thanks. have done all the obvious stuff, nothing is working! c'est la vie...

Collapse -

A couple of other things to try ...

by OldER Mycroft In reply to system32\cmd.exe POP-UP's

First, what is appearing in your Event Viewer after Windows had finished loading? 'System' or 'Application' might have entries for the timeouts of the pop-ups.

Also, try running 'Autoruns'
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

It may give a better view of the errant routines. If you find 'em, untick 'em. :)

<Layout>

Collapse -

Couple of T's & Q's

by Jacky Howe In reply to system32\cmd.exe POP-UP's

Check your Startup Folder to see if there is anything in there, you should be looking for .BAT .CMD or it could be a disguised .EXE.

Check these settings in the Registry as well. A call like this from the Registry could invoke a CMD.exe The value parameter in a RunOnce entry is a quoted string that has the following form: "Rundll32[.exe] DllName,EntryPoint[Arguments]"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

Check what Processes are running. Quick check in Taskmanager for any instances of CMD.exe

Do a search for .bat and .CMD files on the PC you can check them and you may be able to associate them with something.

Add these lines to Boot.ini and check the Logs.

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /SOS /bootlog

This will create a file in c:\windows named Ntbtlog.txt

Read the file and look at what has been loaded.

Also download and install CCleaner to tidy up your Registry. Let it run through until there are no errors left.

http://www.ccleaner.com/download


http://msdn.microsoft.com/en-us/library/aa906371.aspx

http://msdn.microsoft.com/en-us/library/aa906348.aspx

How long has this been happening. What have you installed recently. If it is only recent try a System Restore.

Collapse -

"windows\system32\cmd.exe".. A solution maybe..

This usually opens when a batch file is created. have you created one recently, or have you downloaded something with it in it?
What is a batch file exactly?
It is a file containing a series of DOS commands i.e. a very basic scripting language.
This might be a solution to your problem:

Download & run the Fixswen.inf file. Save the fixswen.inf file to your local hard disk, right-click on the file and choose install.
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100662

Please post back if you have any more problems or questions.

Back to Desktop Forum
15 total posts (Page 2 of 2)   Prev   01 | 02

Related Discussions

Related Forums