I have a user that this just started happening on her Windows XP Pro (SP3)
machine. She has administrative rights on the computer. When she goes to
Start | Run and types in CMD (or command), a DOS window opens up pointing to
her Active Directory assigned drive letter U:\. If she tries a ping, telnet,
ipconfig, or just about any other command other than "dir", the command fails
saying that it's not a recognized command. Even if she changes to c:\, she
gets the same thing. In the title bar of the window, it shows
C:\Windows\System32\CMD.exe. However, if she just browses to
C:\Windows\System32\command.com or cmd.exe, the commands work fine. The
title in the window show the same path, but the only way to make it work is
to drill all the way down to the system32 folder to launch the command window.

Has anyone seen this? How can I restore this functionality?

Andy Siegel
Dover, DE

"Andy Siegel" <(E-Mail Removed)> wrote in message
news:C40FE731-9D28-4010-B7EB-(E-Mail Removed)...
>I have a user that this just started happening on her Windows XP Pro (SP3)
> machine. She has administrative rights on the computer. When she goes to
> Start | Run and types in CMD (or command), a DOS window opens up pointing
> to
> her Active Directory assigned drive letter U:\. If she tries a ping,
> telnet,
> ipconfig, or just about any other command other than "dir", the command
> fails
> saying that it's not a recognized command. Even if she changes to c:\,
> she
> gets the same thing. In the title bar of the window, it shows
> C:\Windows\System32\CMD.exe. However, if she just browses to
> C:\Windows\System32\command.com or cmd.exe, the commands work fine. The
> title in the window show the same path, but the only way to make it work
> is
> to drill all the way down to the system32 folder to launch the command
> window.
>
> Has anyone seen this? How can I restore this functionality?
>
> Andy Siegel
> Dover, DE

Your user probably has a rogue file called cmd.com, cmd.bat or cmd.cmd
somewhere on the disk. Find out what it is, then rename or get rid of it.

"Andy Siegel" <(E-Mail Removed)> wrote in message
news:C40FE731-9D28-4010-B7EB-(E-Mail Removed)...

> I have a user that this just started happening on her Windows XP Pro (SP3)
> machine. She has administrative rights on the computer. When she goes to
> Start | Run and types in CMD (or command), a DOS window opens up pointing
to
> her Active Directory assigned drive letter U:\. If she tries a ping,
telnet,
> ipconfig, or just about any other command other than "dir", the command
fails
> saying that it's not a recognized command. Even if she changes to c:\,
she
> gets the same thing. In the title bar of the window, it shows
> C:\Windows\System32\CMD.exe. However, if she just browses to
> C:\Windows\System32\command.com or cmd.exe, the commands work fine.

The OP should remind the user about DOS environments
and paths. WinXP handles these similarly for "unregistered"
EXEcutables like PING, IPCONFIG and so on. CMD.EXE
is registered in the Registry thus can be run from any prompt.
If an unregistered app is in C:\Windows\System32\
it will execute only if you are logged to C:\Windows\System32\.

--
Don Phillipson
Carlsbad Springs
(Ottawa, Canada)

On May 20, 3:27*pm, Andy Siegel <AndySie...@discussions.microsoft.com>
wrote:
> I have a user that this just started happening on her Windows XP Pro (SP3)
> machine. *She has administrative rights on the computer. *When she goes to
> Start | Run and types in CMD (or command), a DOS window opens up pointingto
> her Active Directory assigned drive letter U:\. *If she tries a ping, telnet,
> ipconfig, or just about any other command other than "dir", the command fails
> saying that it's not a recognized command. *Even if she changes to c:\,she
> gets the same thing. *In the title bar of the window, it shows
> C:\Windows\System32\CMD.exe. *However, if she just browses to
> C:\Windows\System32\command.com or cmd.exe, the commands work fine. *The
> title in the window show the same path, but the only way to make it work is
> to drill all the way down to the system32 folder to launch the command window.
>
> Has anyone seen this? *How can I restore this functionality?
>
> Andy Siegel
> Dover, DE

Well, you should do a good malware scan, but when your user gets to a
command prompt type in:

path <enter>

It may be quite long and should include c:\windows\system32 - up
front probably. This "PATH" is where to look for things that get
typed in from the window. The command will work if you CD to that
folder because that is where a lot of the frequently uses commands
(like ipconfig) are.

If the path to the program you want to run is not in the PATH variable
it will not be found and you will get an appropriate and very
informative message.

Compare the PATH to a system that works.

If that is the problem and you don't know how to change the PATH
variable, report back. Please report back anyway.

Jose

I did a search for cmd.* and found cmd.exe in the places I would expect to
find it (i386, windows\prefetch, W\System32, and W\ServicePackFiles\i386).
No other cmd files were found. I also ran a search on command.* and found
command.com in the usual places. No others.

Thanks for your quick response.

"Pegasus [MVP]" wrote:

>
> "Andy Siegel" <(E-Mail Removed)> wrote in message
> news:C40FE731-9D28-4010-B7EB-(E-Mail Removed)...
> >I have a user that this just started happening on her Windows XP Pro (SP3)
> > machine. She has administrative rights on the computer. When she goes to
> > Start | Run and types in CMD (or command), a DOS window opens up pointing
> > to
> > her Active Directory assigned drive letter U:\. If she tries a ping,
> > telnet,
> > ipconfig, or just about any other command other than "dir", the command
> > fails
> > saying that it's not a recognized command. Even if she changes to c:\,
> > she
> > gets the same thing. In the title bar of the window, it shows
> > C:\Windows\System32\CMD.exe. However, if she just browses to
> > C:\Windows\System32\command.com or cmd.exe, the commands work fine. The
> > title in the window show the same path, but the only way to make it work
> > is
> > to drill all the way down to the system32 folder to launch the command
> > window.
> >
> > Has anyone seen this? How can I restore this functionality?
> >
> > Andy Siegel
> > Dover, DE
>
> Your user probably has a rogue file called cmd.com, cmd.bat or cmd.cmd
> somewhere on the disk. Find out what it is, then rename or get rid of it.
>
>
>

"Andy Siegel" <(E-Mail Removed)> wrote in message
news:A98DF451-AD4A-4253-BF12-(E-Mail Removed)...
>I did a search for cmd.* and found cmd.exe in the places I would expect to
> find it (i386, windows\prefetch, W\System32, and W\ServicePackFiles\i386).
> No other cmd files were found. I also ran a search on command.* and found
> command.com in the usual places. No others.
>
> Thanks for your quick response.

OK, let's dig a bit deeper by doing this:
1. Open a Command Prompt by invoking c:\windows\system32\cmd.exe explicitly.
2. Type the following commands:
cd \{Enter}
cmd {Enter}
What do you get?

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting the requested logs
in an appropriate forum.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Andy Siegel wrote:
> I have a user that this just started happening on her Windows XP Pro (SP3)
> machine. She has administrative rights on the computer. When she goes to
> Start | Run and types in CMD (or command), a DOS window opens up pointing
> to
> her Active Directory assigned drive letter U:\. If she tries a ping,
> telnet, ipconfig, or just about any other command other than "dir", the
> command fails saying that it's not a recognized command. Even if she
> changes to c:\, she gets the same thing. In the title bar of the window,
> it shows C:\Windows\System32\CMD.exe. However, if she just browses to
> C:\Windows\System32\command.com or cmd.exe, the commands work fine. The
> title in the window show the same path, but the only way to make it work
> is
> to drill all the way down to the system32 folder to launch the command
> window.
>
> Has anyone seen this? How can I restore this functionality?
>
> Andy Siegel
> Dover, DE

On May 20, 3:27*pm, Andy Siegel <AndySie...@discussions.microsoft.com>
wrote:
> I have a user that this just started happening on her Windows XP Pro (SP3)
> machine. *She has administrative rights on the computer. *When she goes to
> Start | Run and types in CMD (or command), a DOS window opens up pointingto
> her Active Directory assigned drive letter U:\. *If she tries a ping, telnet,
> ipconfig, or just about any other command other than "dir", the command fails
> saying that it's not a recognized command. *Even if she changes to c:\,she
> gets the same thing. *In the title bar of the window, it shows
> C:\Windows\System32\CMD.exe. *However, if she just browses to
> C:\Windows\System32\command.com or cmd.exe, the commands work fine. *The
> title in the window show the same path, but the only way to make it work is
> to drill all the way down to the system32 folder to launch the command window.
>
> Has anyone seen this? *How can I restore this functionality?
>
> Andy Siegel
> Dover, DE

Did you miss my post about running PATH while in the command window?

Why are you searching for where CMD.* is? It is not missing if it
works.

Jose