Sudden and repeated launching of cmd.exe and net.exe

[Robert \(Remove This\) Benjamin]

I have recently started experiencing frequent and sudden
system slowdowns, apparently caused by multiple iterations
of cmd.exe and net.exe. Without warning, both programs
will start executing repeatedly, and hundreds will show up
in the "processes" list in Task Manager. At that point,
the system will become almost unusable.

I have not been able to find any information about what
causes this problem or how to fix it. Is anyone familiar
with it?

 

[Charles Dye]

I have recently started experiencing frequent and sudden
system slowdowns, apparently caused by multiple iterations
of cmd.exe and net.exe. Without warning, both programs
will start executing repeatedly, and hundreds will show up
in the "processes" list in Task Manager. At that point,
the system will become almost unusable.

I have not been able to find any information about what
causes this problem or how to fix it. Is anyone familiar
with it?

This might be a good time to scan your system with an up-
to-date antivirus program....

 

[Robert \(Remove This\) Benjamin]

I keep Norton AntiVirus 2003 enabled from bootup, do a
full system scan every week, and a live update of virus
definitions every other day. I also run two recommended
anti-spyware programs on a regular basis. Yesterday, just
in case, I ran Microsoft's MyDoom detection-and-removal
tool. Nothing there.

Bob Benjamin

 

[Paul R. Sadowski]

Make sure you don't have a batch file somewhere that's recursively calling
itself, even if by accident, possibly via the task scheduler. Also get a
copy of autoruns.exe from sysinternals.com and make sure nothing nefarious
is being run from the registry.

"Robert (Remove This) (e-mail address removed)"

 

[Guest]

Thanks. Sounds like good advice. I'll try both.

Bob Benjamin

 

[Matt Hickman]

I have recently started experiencing frequent and sudden
system slowdowns, apparently caused by multiple iterations
of cmd.exe and net.exe. Without warning, both programs
will start executing repeatedly, and hundreds will show up
in the "processes" list in Task Manager. At that point,
the system will become almost unusable.

Does your task scheduler show anything or "AT.EXE" at the
command line? Also check your security log (if you are
auditing logon success) to see if there is any logons near
the time of your problems.

The Task manager will also display process users names
(view - > select column... check user name) which may give
you a clue as to what is starting the processes.

You could create a batch file that uses the kill.exe from the
resource kit. "Kill cmd.exe" and "kill net.exe" to try to
keep the system useable. Put it on the desktop so all you need
to do is double click it to start it.

 

[Robert \(Remove This\) Benjamin]

Thank you and thanks also to Paul Sadowski. I followed his
earlier suggestion to check the Task Scheduler for a batch
file that could cause the problem. I found a task to check
for a network connection to run repeatedly every five
minutes starting every day at the same time. Since this
sounded like it could cause repeated execution of both
cmd.exe and net.exe, I decided to try deleting the task
and changing it to run only at logon. Since then the
problem has not recurred. I am wondering if it could have
been implanted earlier by a virus or worm with a time
delay.

As you suggest, I will put the two kill commands on my
desktop.

Bob Benjamin

 

[Guest]

Just a note of thanks for your very helpful suggestions. I
tried them and my system is now running normally.

Bob Benjamin