Command Box doesn't open

Urban Kaos

Ello all

Has anyone experienced any issues when opening up the command box when doing the following Start > Run > cmd.exe and it just hangs on a black screen with no command prompt? If I try and close it down, it constantly comes up that the program is not responding. This is after waiting 5 minutes or so. I know my system may be a bit dated; but it aint that slow!!

I can get to a command prompt as such if I type "command" but when you try and access anything from that such as ping; the box just closes down.

Also try and access it from Start > Accessories and the same thing happens.

Got all the usual updates in place...Sp2 etc running on XP home.

Any ideas on this one would be cracking.

Bob the Builder

XP Home with SP2...work's fine...

Karoma

First things first: install/update anti-spyware, and anti-virus software. Scan in Safe Mode. And see if it open there.

GAAman

Like karoma said cept check one thing

see the top of the dos command box? make sure it says cmd.exe and no cmd.com if its .com then you have a pretty serious infection i had to format because of

stevenmu

Just a quick addition that cmd.exe is correct, cmd.com is a virus, but for command it should show command.com (there's probably a command.exe virus floating around somewhere too)

Urban Kaos

Your right; it comes up with cmd.com but have run many virus scans (tend to schedule it in on friday night) and it cannot find any kind of infection;

Will see if sfc /scannow can find anything untoward. Thanks for your help on this one guys, will get back to you and let you know how it goes

Urban Kaos

Sfc / scannow didn't upturn anything, ran a search on it and managed to find an uncorrupted cmd.exe within the servicepack and that works OK, but still cannot locate any reference to cmd.com within the \system32\ folder - looks like I've got the W32.Picrate.B@mm virus. Tried overwriting the cmd.exe file within system32 from the service pack file, but alas no joy.

Looks like its also got into my regedit file as well! D'oh! But if I type in regedit.exe then it will recognise this fine.

Will also try and perform a safe mode virus check and see if this brings up anything.

rOBeRt frETt

the exe file may be corrupted or himem emmulation may not have run, check your config.sys and autoexec.bat.

Don't format your disk, I think you have a virus, have you tried opening any other exe's from the command prompt

Hold windows key + R and type calc, sol or winword etc

go to windows folder and look for cmd.exe, click properties check file assciations
make sure its associated with ms-dos

the com version should still work

Run command instead, this will invoke the .com version

command.com
cmd.exe

hope this helps

rOBeRt frETt

Looks like this one fits the bill

VB.DA worm (or a variant)

try this

Delete .Com Files.
1.Goto C:\Windows\System32\.
2.Click on "Tools" and then "Folder Options".
3.Select the "View" Tab.
4.Select the option " Show Hidden Files and Folder".
5.Uncheck the option "Hide Extension for known File types" and "Hide Portected Operating system Files"
6.Click " Apply" and close the window.
7. Search and delete
"NTDETECT.COM","cmd.com","netstat.com","ping.com","regedit.com","taskkill.com","tasklist.com","tracert.com".
8.Reboot the machine and Run "Xcleaner" or "Regblock".

as you say you can open regedit, so I think you have a variant of this worm

Urban Kaos

rOBeRt frETt wrote:

Looks like this one fits the bill

VB.DA worm (or a variant)

try this

Delete .Com Files.
1.Goto C:\Windows\System32\.
2.Click on "Tools" and then "Folder Options".
3.Select the "View" Tab.
4.Select the option " Show Hidden Files and Folder".
5.Uncheck the option "Hide Extension for known File types" and "Hide Portected Operating system Files"
6.Click " Apply" and close the window.
7. Search and delete
"NTDETECT.COM","cmd.com","netstat.com","ping.com","regedit.com","taskkill.com","tasklist.com","tracert.com".
8.Reboot the machine and Run "Xcleaner" or "Regblock".

as you say you can open regedit, so I think you have a variant of this worm

I cant seem to find any of these variants located in the \system32\ folder, I did a general search and found ones in other places, but was slightly more wary of deleting these as they seem to be legtimate files (NTDetect.com in the root of C:\ for example)

Ran virus scans both in safe mode and in normal windows environment but nothing seems to work. Perhaps I had it, antivirus picked it up but the associations to those files have remained? Is there any way to check this?