Cannot run cmd.exe

[Guest]

I have a Dell-8300 desktop with Windows XP Pro. The last time I was able to
run cmd.exe was about a month ago.
Today I found that I cannot run cmd.exe no matter where I tried it (I tried
to use Run and to double click the file under c:\windows\system32\cmd.exe).
In both cases I got the message "Windows cannot find
'C:\WINDOWS\SYSTEM32\cmd.exe'. Make sure you typed the name correctly, and
then try again. To search for a file, click the start button, and then click
Search". I replaced the cmd.exe from my backup disc but it didn't help. I
tried to copy and run the files at different locations, it did not help.

I later found out the same goes with regedit and msconfig. Others like
inetmgr still work by using Run or double-clicking. The interesting point is
that if I change the file names, for example from cmd.exe to cmdt.exe or from
regedit.exe to tregedit.exe, I can execute cmdt.exe and tregedit.exe using
Run or double-clicking within and outside (after copying) their default
directories.

I know this could be caused by virus and other software, but I just want to
know, based on the behavior described, which part of the windows components
has been affected and needs to be checked.

 

[jorgen]

I have a Dell-8300 desktop with Windows XP Pro. The last time I was able to
run cmd.exe was about a month ago.
Today I found that I cannot run cmd.exe no matter where I tried it (I tried
to use Run and to double click the file under c:\windows\system32\cmd.exe).
In both cases I got the message "Windows cannot find
'C:\WINDOWS\SYSTEM32\cmd.exe'. Make sure you typed the name correctly, and
then try again. To search for a file, click the start button, and then click
Search". I replaced the cmd.exe from my backup disc but it didn't help. I
tried to copy and run the files at different locations, it did not help.

I later found out the same goes with regedit and msconfig. Others like
inetmgr still work by using Run or double-clicking. The interesting point is
that if I change the file names, for example from cmd.exe to cmdt.exe or from
regedit.exe to tregedit.exe, I can execute cmdt.exe and tregedit.exe using
Run or double-clicking within and outside (after copying) their default
directories.

I know this could be caused by virus and other software, but I just want to
know, based on the behavior described, which part of the windows components
has been affected and needs to be checked.

if you start command.com, can you run them from there?

 

[Guest]

I can run command.com from Run with the following prompt shown:
========================
Microsoft(R) Windows DOS
(C)Copyright Microsoft Corp 1990-2001.

C:\DOCUME~1\JIkun~1>
==========================

 

[Guest]

Sorry, I forgot to mention that I tried regedit.exe, msconfig.exe and cmd.exe
using the command.exe prompt window. All did not bring up anything. However I
also tried the inetmgr command and it also did not bring up anything.

 

[Elmo]

I later found out the same goes with regedit and msconfig. Others like
inetmgr still work by using Run or double-clicking. The interesting point is
that if I change the file names, for example from cmd.exe to cmdt.exe or from
regedit.exe to tregedit.exe, I can execute cmdt.exe and tregedit.exe using
Run or double-clicking within and outside (after copying) their default
directories.

Schedule a bootscan so Avast! can remove the threats before they take
control of a session.

I know this could be caused by virus and other software, but I just want to
know, based on the behavior described, which part of the windows components
has been affected and needs to be checked.

The Registry. Since your av has been compromised by the malware, a scan
of the registry files won't really show anything.

 

[MAP]

I have a Dell-8300 desktop with Windows XP Pro. The last time I was
able to run cmd.exe was about a month ago.
Today I found that I cannot run cmd.exe no matter where I tried it (I
tried to use Run and to double click the file under
c:\windows\system32\cmd.exe). In both cases I got the message
"Windows cannot find 'C:\WINDOWS\SYSTEM32\cmd.exe'. Make sure you
typed the name correctly, and then try again. To search for a file,
click the start button, and then click Search". I replaced the
cmd.exe from my backup disc but it didn't help. I tried to copy and
run the files at different locations, it did not help.

I later found out the same goes with regedit and msconfig. Others like
inetmgr still work by using Run or double-clicking. The interesting
point is that if I change the file names, for example from cmd.exe to
cmdt.exe or from regedit.exe to tregedit.exe, I can execute cmdt.exe
and tregedit.exe using Run or double-clicking within and outside
(after copying) their default directories.

I know this could be caused by virus and other software, but I just
want to know, based on the behavior described, which part of the
windows components has been affected and needs to be checked.

Yes, you have been infected with something. However you can use emergency
copies of these commands while you clean your system.

Emer. copies can be downloaded here:
http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 35 left hand side.

After you clean your system run the edit on line 275 left hand side, I
believe this one will restore the original funtions.
Note: cmd.,regeit and taskmgr are not gone,whatever nasty you have just
disabled your access to them. Line 275 should restore this.

Here is a link for virus/trojan scanners
http://virusall.com/downscan.html

Good luck!

 

[Guest]

I tried the bootscan and avast!. It cleaned up some viruses. Thanks!
But the problems still remain.

 

[Guest]

After clearned up the system, I tried the script file you refered to - line
275 on the left side (Lift Restrictions - TM, Regedit and CMD). I really
hoped this would solved the problems, but the problems remain. It seems to me
that the system has been set in such a way that the specified command names
can not been recognized or executed. But I don't know how to reverse it.

 

[Pegasus \(MVP\)]

How come your own virus scanner did not detect the
viruses? Did not have one?

If you want a really stable machine then you should back
up all your important documents, then re-install Windows,
allowing the disk to be formatted in the process.

If you prefer to live on the edge then you could scan your
system with the "House Call" option of Trend
(http://us.trendmicro.com/us/home/index.html). It may or
may not undo the damage done by your viruses.

 

[Plato]

I have a Dell-8300 desktop with Windows XP Pro. The last time I was able to
run cmd.exe was about a month ago.
Today I found that I cannot run cmd.exe no matter where I tried it (I tried
to use Run and to double click the file under c:\windows\system32\cmd.exe).
In both cases I got the message "Windows cannot find
'C:\WINDOWS\SYSTEM32\cmd.exe'. Make sure you typed the name correctly, and
then try again. To search for a file, click the start button, and then click
Search". I replaced the cmd.exe from my backup disc but it didn't help. I
tried to copy and run the files at different locations, it did not help.

I later found out the same goes with regedit and msconfig. Others like
inetmgr still work by using Run or double-clicking. The interesting point is
that if I change the file names, for example from cmd.exe to cmdt.exe or from
regedit.exe to tregedit.exe, I can execute cmdt.exe and tregedit.exe using
Run or double-clicking within and outside (after copying) their default
directories.

An indication that you are infected with spyware or a virus, I dont
remember which, but I do recall that some sort of malware creates
exactly the same problem.

 

[Frank]

An indication that you are infected with spyware or a virus, I dont
remember which, but I do recall that some sort of malware creates
exactly the same problem.

Reads like a call for David Lippman's multiAV.

http://www.elephantboycomputers.com/page2.html#Viruses_Malware

 

[Guest]

Found the virus that caused the problem. Virus description and solution can
be found here
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_DELF.GAX&VSect=Sn

Thanks all
Jikun

 

[Guest]

I used the House Call, but it hung all the time. Only after I found out the
virus, I knew that I have to turn off the system restore to let House Call to
do the scan in this case. But I still had to clean it up manually based on
the solution given by Trend Micro.