Disable Command Prompt Command

[John Callaway]

How do I disable the following command which shows up in the command
prompt during bootup of XP?

C:\WINDOWS\system32>start /b regsvr32.exe /s /n /i:"" "C:\Documents
and Settings
\All Users\Application Data\2308189059\BIT2A.tmp"

I think it is looking for a file I have erased and the is no such
directory.

JPC

 

[VanguardLH]

How do I disable the following command which shows up in the command
prompt during bootup of XP?

C:\WINDOWS\system32>start /b regsvr32.exe /s /n /i:"" "C:\Documents
and Settings
\All Users\Application Data\2308189059\BIT2A.tmp"

I think it is looking for a file I have erased and the is no such
directory.

I take it you are trying to clean out remnants left behind after a
disinfection of malware.

You could run msconfig.exe to see where the startup item is located
(registry Run key, Startup folder, or wherever). If not listed in
msconfig under the Startup tab then it's in a less common startup
location. For that, you need a better startup manager, like
SysInternals AutoRuns.

The item doesn't have to exist for it to be listed as a startup item.
This is similar to defining a shortcut to an .exe. Later deleting the
..exe file doesn't automatically delete the shortcut.

 

[John Callaway]

Vanguard,
Thanks. I have run Autoruns and have cleaned up a lot of
entries that I don't need/want. The command prompt still shows up on
my desktop after a bootup. This is what it displays:

"C:\WINDOWS\system32>start /b regsvr32.exe /s /n /i:"" "C:\Documents
and Settings\All Users\ApplicationData\2308189059\BIT2A.tmp"

The directory is not accurate nor is there any such file. I think it
is looking for some file that I deleted when I changed my Firefox
profile.The command itself does not hurt anything, it is just a
nuisance showing up on my desktop every time I boot up. Could I create
a command to have the command prompt not show up after I bootup?

Thanks,
JPC

 

[VanguardLH]

Thanks. I have run Autoruns and have cleaned up a lot of
entries that I don't need/want. The command prompt still shows up on
my desktop after a bootup. This is what it displays:

"C:\WINDOWS\system32>start /b regsvr32.exe /s /n /i:"" "C:\Documents
and Settings\All Users\ApplicationData\2308189059\BIT2A.tmp"

The directory is not accurate nor is there any such file. I think it
is looking for some file that I deleted when I changed my Firefox
profile.The command itself does not hurt anything, it is just a
nuisance showing up on my desktop every time I boot up. Could I create
a command to have the command prompt not show up after I bootup?

You want a 2nd command to stop a 1st command already started? Too late.
The 1st command already started.

AutoRuns should show every startup path in Windows. Did you use its
search on "regsvr" to see if it found something that you missed through
manual inspection? Select the Everything tab and hit Ctrl+F to search.

It is possible that "regsvr32" is part of some batch/script file. The
batch or script file is an autorun item, not the commands it executes.
You could use something like FileLocator Lite (aka Ransack) to search
files on their contents to find which ones called the regsvr32 program
(Microsoft screwed up file search in XP so I don't trust it to find
files and instead use FileLocator).

You could use File -> Save to save AutoRuns' list to an .arn file that
you upload somewhere to let someone else with AutoRuns load it to review
your startup items but then you're letting everyone know about your
startup items.

Did you disable all startup items listed in msconfig.exe, reboot, and
check if the mystery DOS shell reappears? While it doesn't cover as
many startup locations as does AutoRuns, that might indicate if the
mystery DOS shell is loaded by a startup item or something else.

 

[John Callaway]

Vanguard,
Yes, I did disable all services and found out that if I disable event
log the command box does not show on my desktop after bootup. But
then I am in selective bootup and don't want to harm my computer. Do
you think it would be ok to leave it in selective boot? Would you be
willing to look at my autoruns arn file if I sent it directly to you
at your email?
JPC

 

[VanguardLH]

Yes, I did disable all services and found out that if I disable event
log the command box does not show on my desktop after bootup. But
then I am in selective bootup and don't want to harm my computer. Do
you think it would be ok to leave it in selective boot? Would you be
willing to look at my autoruns arn file if I sent it directly to you
at your email?

I don't see how disabling the Event Log service would affect the
presence or absence of a DOS shell. It records events. It doesn't run
anything.

So you disabled all the items under the Startup tab in msconfig.exe,
rebooted, and the DOS shell did *not* appear? Don't start with
disabling both services and startup items. Start first only with
disabling the items listed under the Startup tab in msconfig. If that's
what you did, reenable each startup item one at a time and reboot. When
the DOS shell reappears, the last reenabled startup item is the culprit.
If you end up having to disable a service to address the problem then
you need to uninstall some software that defined and has its service
loaded. After all, if you're disabling its service then that software
doesn't run.

As soon as you disable any startup item(s), Windows will boot in a
"selective" startup mode. I have several startup items disabled because
they are superluous or a nuisance. That means I am always starting in
selective mode.

 

[John Callaway]

OK I'll just run in selective mode with the event log service off.
Thanks!
JPC