Command Prompt in XP SP3

I just cleared some malware from my father's computer using Malwarebytes. One of the reasons I for cleaning it up was that the Command Prompt will only load for a nanosecond and dissappears. I've tried first by running Malwarebytes because I know that that is usually a sign of some form of infection. Now that the threats have been removed I am still encountering the same issue. I have tried restoring the CMD.exe into the System32 directory with no luck. I have tried the following at the run command in the start menu; "cmd /k chkdsk /f" with no luck.
I am now at my wits end. I have a bad feeling that I may need to either do a system restore (which I don't think will work) or just do a complete re-install of the OS. Does any one have any other recommendations? All other recommendations are asking me to send logs to some website using HijackThis. I would really like to avoid that route. Any help and/or advice is greatly appreciated.

 

Langa Letter: XP's No-Reformat, Nondestructive Total-Rebuild Option

 

Good idea. Might want to run Malwarebytes Anti-Rootkit.

 

Hi NJTech30, Have you tried using sfc /scannow to see if your Files are correct?

This link may help: "How to use SFC /SCANNOW "
http://www.updatexp.com/scannow-sfc.html

Just make sure you have your XP disc available. Cheers Neil.

 

The command prompt issue became a secondary issue after removing other threats from the computer. I ran Malwarebytes and removed any threats it detected. I was attempting to run a chkdsk /f to run a check on the drive and that is when I encountered the issue. BTW... I do have over 15 years of experience in PC Repair and troubleshooting. As far as root kits go, I haven't much experience with them but I don't hold much weight with them either. I have used them before and I almost always wind up going into the registry to do the fix myself. I was just looking for a simple reghack or DLL file fix.

 

A rootkit is a stealthy, often malicious type of software. It is designed to hide the very existence of itself from normal methods of detection and to enable continued privileged access to a computer.

Removal of 'good' rootkit can be quite complicated or practically impossible, especially in cases where the rootkit resides in the kernel. Reinstallation of the operating system may be the only available solution.

I seriously doubt there is a Registry setting to Enable|Disable "Command Prompt load for a nanosecond and then dissappear ", and/or a DLL.

 

Settings:
User Key: [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
Name: DisableCMD
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = disabled, 2 = disabled but allow batch)

Best I could come up with.

 

That one doesn't load at all.

 

If you want to throw your time at it, go ahead. But I would strongly recommend that you either do what the other recommendations are asking or just forget about it & format the computer.

I would personally go with 2nd option. May take some time, but results are guaranteed and the system would be a lot faster.

 

Thanks loads markp62 - I never knew where this was in the registry - added to my Favourites