cmd download

We posted at the same time .........

What is the message?

 

Search the system32 folder for the following files

autoexec.nt
config.nt

If not found in system32, navigate to C:\Windows\repair, copy those two files and paste them into the system32 folder.

Try the cmd command from Run again.

 

I have both of those in system 32.

 

Bubba, I'm assuming you already have set your computer to show hidden files and folders and also to show file extensions for known file types (per noahdfear's instructions earlier).

Unless I missed it, you have not clearly indicated about if/how you searched your hard drive for CMD.*

1. Click Start > Search and that should pull up a "Search Results" window.
2. In the left side of the "Search Results" window under "What do you want to search for? ", click on "All files and folders ".
3. In the "All or part of the filename:" field, type [FONT= "Courier New"][SIZE= "3"]CMD.*[/SIZE][/FONT] (with no spaces).
4. Be sure the "Look in:" field displays "Local Hard Drives ".
5. Click the "Search" button.

The search will probably take a few minutes. If a cmd.com file is found, write down the location indicated in the "In Folder" column. Then right-click on the cmd.com file name and select "Rename" and type BAD.com (or whatever name you want to give it).

If you found the cmd.com file and renamed it, then click Start > Run... and type [FONT= "Courier New"][SIZE= "3"]cmd[/SIZE][/FONT] in the "Open:" field and click the OK button. If it opens a DOS window successfully, then type [FONT= "Courier New"][SIZE= "3"]exit[/SIZE][/FONT] and press the Enter key on your keyboard.

Then let us know if you have solved your problem. We would also probably like to know the location where you found the file.

 

Ok, just for the record, autoexec.nt is present, config.nt is present and command.com is present in the system32 folder? cmd.com is NOT present?
What is the exact message when you type cmd in Run?
And if you type cmd.exe?

 

cmd gives the first illegal instruction message I posted before,

C:\windows\system 32\.com
the NTVDM cpu has encountered an illegal instruction
cs:0572 IP:ffe4 OP:fe 1d 09 e9 "choose close to terminate the application "

cmd.exe opens up a dos window that pertains to C:\Documents and settings\ my name>

 

I did the search as you suggested for the cmd and did not find a cmd.com.

 

After following mailman's instructions in his last post, please download Deckards System scanner (dss.exe) from here, saving the file to your desktop.

Copy the following command.

"%userprofile%\desktop\dss.exe" /config

Click Start>Run and Paste the command, then hit enter. Click OK to the agreement message. Close ALL other programs and windows. On the System Scanner window, click Uncheck All (if only Check All is available, click it, then click again), then uncheck any remaining checked boxes, disregarding any that may be greyed out. Check the box labled 'DOS Environment' then click Scan. Wait for it to complete. A log will open named extra.txt (likely minimized). Post the contents of that log.

 

OK, I'll do those things but wanted to report this scan I got using Spybot. It doesn't tell me how to get rid of them but what the hey.

C:\WINDOWS\Temp\~wa6psetup.exe is infected with WinFixer
C:\WINDOWS\Temp\NI.UWA6P_0001_N91M1807\setup.exe is infected with WinFixer
C:\WINDOWS\Sm9obiBNYXRoZXdz\mA6Cv21hsrlCtrxW.vbs is infected with Spyware.ISearch
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll is infected with WinFixer
C:\Documents and Settings\john\My Documents\My Videos\reference.exe is infected with Adware.Starware

 

I did what you asked and got a could not find message.

 

Hmm..
in c:\windows do you have a folder named "system32" and "system 32" ?
Since there is a space in your error, they may have placed it in "system 32 ", and not "system32 ".

 

As an addition to Mailman's search instructions above ....

Since the cmd.com file is most likely hidden or marked as a system file, in the search options, under More Advanced Options, select Search System Folders, Search hidden files and folders, and search subfolders.

 

I have system32 only.

 

Here is the decard file

Deckard's System Scanner v20070611.50
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\john\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=JOHN-156CBF3A94
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\john
LOGONSERVER=\\JOHN-156CBF3A94
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\STOPzilla!
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\john\LOCALS~1\Temp
TMP=C:\DOCUME~1\john\LOCALS~1\Temp
USERDOMAIN=JOHN-156CBF3A94
USERNAME=john
USERPROFILE=C:\Documents and Settings\john
windir=C:\WINDOWS


-- End of Deckard's System Scanner: finished at 2007-06-19 at 11:10:05 ---------

 

Bubba, I strongly recommend you immediately start a new thread in the Removing Spyware & Viruses forum.

Give the thread a descriptive title similar to the following:

WinFixer/ISearch and Start > Run > CMD Issue (HJT log)

Copy/paste the following blue text into the message. Here are copy/paste instructions.

• Drag your mouse across all of the blue text below so it is highlighted.
• Right-click on the highlighted text and select "Copy ".
• Go to your new thread message editing window in the Removing Spyware & Viruses forum.
• Then right-click in the message body edit field and select "Paste ".

==========
I have a Start > Run > CMD issue described in http://www.windowsbbs.com/showthread.php?t=65317 and apparently have WinFixer/ISearch malware indicated by a recent Spybot Search & Destroy log:

C:\WINDOWS\Temp\~wa6psetup.exe is infected with WinFixer
C:\WINDOWS\Temp\NI.UWA6P_0001_N91M1807\setup.exe is infected with WinFixer
C:\WINDOWS\Sm9obiBNYXRoZXdz\mA6Cv21hsrlCtrxW.vbs is infected with Spyware.ISearch
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll is infected with WinFixer
C:\Documents and Settings\john\My Documents\My Videos\reference.exe is infected with Adware.Starware
==========

Then paste the contents of a fresh HijackThis log in that message or the next follow-up message and patiently wait for expert guidance. Follow that expert guidance exactly.

noahdfear is an expert but the thread will be easier for the assisting expert (who may be TeMerc, Blender, Geri, or another malware-removal expert) won't have to scroll through through the entire thread to find your HiJackThis log.

CAUTION: DO NOT have HijackThis "fix" anything without carefully following expert guidance. Otherwise, you might render your computer unstable or even unbootable.

 

Thanks Mailman, I have intermediate skills, copy and paste are in the mix.

 

OK. I apologize. I thought you had that skill under your belt but I wasn't absolutely certain.

Besides, in case other people with the same or similar problem read your thread, the copy/paste instructions may be handy for someone who is not familiar with that method. They may be only familiar with copying/pasting via the "Edit" menu item in Notepad or MS Word, for example. That is another reason I edited my post above to add the copy/paste instructions (which apply to copying/pasting in many other applications as well). They might not be familiar with the Ctrl-C/Ctrl-V method either but I won't go into detail about that method here.

I suspect you discovered copying text from a DOS window doesn't work either.

 

Yes, I did found out about that copy thing with DOS.

 

Bubba has posted a HJT log in this Removing Spyware & Viruses thread.

(I included the link for convenience so people following this thread can easily follow what's going on.)

 

Ok, i'm closing this thread then.

Regards - Charles