CMD does not work (aswel as other "dos" applications like ping)

[Guest]

Hey there,

I'm having major problems with my XP installation. When running the command
prompt (start>run>cmd) the DOS box appears but just hangs with a blinking
cursor. This is the same for ping, ipconfig and other DOS applications. I've
tried repairing the XP installation and running virus scans but nothing fixes
it. On top of this, when viewing the properties of MP3 files explorer
crashes. Short of formatting and doing a doing a full install again I just
don't know what to do. Formatting will be the VERY last resort as there are
many critical applications on the system that I can't afford to lose and I
can't back them up.

Forever grateful for any assistance.

Kind Regards

Dann Rees

 

[Wesley Vogel]

What happens if you type cmd.exe in the Start | Run box?

What happens if you type ping.exe ?

What happens if you type regedit in the Start | Run box?

What happens if you type regedit.exe in the Start | Run box?

*Update* your antivirus software and run a complete scan.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Thank you for your quick response.

cmd,regedit etc. seem to load fine when putting the .exe extension on the end.
However I have run a full system scan using eTrust Antivirus but nothing was
found,
all the signature files are up to date.

Not sure where to go from here.

Thanks again

Dann

What happens if you type cmd.exe in the Start | Run box?

What happens if you type ping.exe ?

What happens if you type regedit in the Start | Run box?

What happens if you type regedit.exe in the Start | Run box?

*Update* your antivirus software and run a complete scan.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hey there,

I'm having major problems with my XP installation. When running the
command prompt (start>run>cmd) the DOS box appears but just hangs with a
blinking cursor. This is the same for ping, ipconfig and other DOS
applications. I've tried repairing the XP installation and running virus
scans but nothing fixes it. On top of this, when viewing the properties
of MP3 files explorer crashes. Short of formatting and doing a doing a
full install again I just don't know what to do. Formatting will be the
VERY last resort as there are many critical applications on the system
that I can't afford to lose and I can't back them up.

Forever grateful for any assistance.

Kind Regards

Dann Rees

 

[Malke]

Thank you for your quick response.

cmd,regedit etc. seem to load fine when putting the .exe extension on
the end. However I have run a full system scan using eTrust Antivirus
but nothing was found,
all the signature files are up to date.

Not sure where to go from here.

In addition to running EZ-AV, it would be smart to run another av scan
with Dave Lipman's Multi-AV. Here is the link:
http://www.ik-cs.com/multi-av.htm

I would also do some scans for non-viral malware:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

After that, if you computer is really clean, you can run the System File
Checker:
Start>Run>sfc /scannow

You may need your XP cd, so have it handy. Note that there is a space
between "sfc" and "/scannow".

In any case, you should back up your data and find installation media
for the "critical applications" you have. Even if you keep your
computer completely clean and in tip-top condition, a computer is a
machine and hard drives can die. You need to be prepared.

Malke

 

[Wesley Vogel]

Dann,

In addition to what Malke posted.

Do a Search for these files on your machine, they should *not* exist.

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

I believe that these are the legitimate Windows XP *.com files.

chcp.com (Change CodePage Utility)
command.com (MS-DOS Prompt)
diskcomp.com (Disk Comparison Utility)
diskcopy.com (Disk Copy Utility)
edit.com (MS-DOS Editor)
format.com (Disk Format Utility)
graftabl.com (Graftabl Utility)
graphics.com (graphics for compatibility with MS-DOS files)
kb16.com (16-bit keyboard mapping utility, previously known as the Keyb.com
utility)
loadfix.com (loadfix)
mode.com (DOS Device MODE Utility)
more.com (More Utility)
tree.com (Tree Walk Utility)
win.com (WIN.COM for compatibility??? WIN.COM was the executable file
used to load Microsoft Windows 3.1, 3.11, 95 and 98. I have no idea what it
does in XP.)
NTDETECT.COM (NTDETECT detects installed hardware components when XP boots.)

You may have more legitimate .com files such as WZ.COM (WinZip running DOS
program).

COM extension, is short for Command and is an executable file like .EXE only
smaller. Supposed to be less than 64K in size.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

Thank you for your quick response.

cmd,regedit etc. seem to load fine when putting the .exe extension on the end.
However I have run a full system scan using eTrust Antivirus but nothing was
found,
all the signature files are up to date.

Not sure where to go from here.

Thanks again

Dann

What happens if you type cmd.exe in the Start | Run box?

What happens if you type ping.exe ?

What happens if you type regedit in the Start | Run box?

What happens if you type regedit.exe in the Start | Run box?

*Update* your antivirus software and run a complete scan.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hey there,

I'm having major problems with my XP installation. When running the
command prompt (start>run>cmd) the DOS box appears but just hangs with a
blinking cursor. This is the same for ping, ipconfig and other DOS
applications. I've tried repairing the XP installation and running virus
scans but nothing fixes it. On top of this, when viewing the properties
of MP3 files explorer crashes. Short of formatting and doing a doing a
full install again I just don't know what to do. Formatting will be the
VERY last resort as there are many critical applications on the system
that I can't afford to lose and I can't back them up.

Forever grateful for any assistance.

Kind Regards

Dann Rees

 

[cquirke (MVP Windows shell/user)]

On Fri, 28 Oct 2005 08:37:07 -0700, "Dann"

I'm having major problems with my XP installation. When running the command
prompt (start>run>cmd) the DOS box appears but just hangs with a blinking
cursor. This is the same for ping, ipconfig and other DOS applications.

I'd start by replacing CONFIG.NT and AUTOEXEC.NT with known-good
versions, then if no joy, I'd drop back and do "the prelim", with
particular respect to HD surface defects and malware - the two items
that can cause this sort of narrow-focus issue as bad RAM etc. cannot.

tried repairing the XP installation and running virus scans

"running virus scans" can't be considered exclusionary if done from
the infected OS. Unless I see the words "Bart CDR boot", "Linux CDR
boot" or perhaps "all volumes are FATxx and I scanned from a DOS mode
boot diskette", I'm unconvinced malware has really been excluded here.

...when viewing the properties of MP3 files explorer crashes.

All .MP3 or only some?

The mechanism is the same in both cases; a persistent handler delves
into the .MP3 file's actual data to populate the folder "view" with
MP3-related info (artist, album, track, genre - that sort of fluff)
and dies ether, taking Explorer with it.

If some .MP3, and those don't play either, then you have some
corrupted .MP3 files, suggesting disk or file system damage may be
behind your "DOS" problems as well.

If all .MP3 crash, then you have a bad persistent handler that's
integrated into the shell (i.e. Explorer.exe). The way to approach
that is to download and use "Shell Extensions Viewer" from NirSoft at
www.nirsoft.net using that to reversibly disable suspicious-looking
handlers until you find what sucks.

When you do, highlight that one, save a report to disk, and paste that
report into a reply in this thread

--------------- ----- ---- --- -- - - -

First, the good Customer feedback has
been clear and unambiguous.

 

[Wesley Vogel]

Chris,

autoexec.nt and config.nt have nothing to do with cmd.exe (Windows Command
Processor). These files are used with command.com (MS-DOS Prompt), not
cmd.exe.

You can move, delete or otherwise mess with autoexec.nt and config.nt and
this will have absolutely *no* affect on cmd.exe.

command.com will not open if either autoexec.nt or config.nt are missing,
messed up or whatever.

I moved my config.nt out of C:\Windows\System32 to my Desktop.

I opened cmd.exe, typed netstat and it worked fine.

I tried to open command.com and got this error message:
---------------------------
16 bit MS-DOS Subsystem
---------------------------
C:\WINDOWS\System32\command.pif
C:\WINDOWS\SYSTEM32\CONFIG.NT. The system file is not suitable for running
MS-DOS and Microsoft Windows applications. Choose 'Close' to terminate the
application.
---------------------------
Close Ignore
---------------------------

I moved config.nt back to C:\Windows\System32 and command.com opened
correctly.

I moved my autoexec.nt out of C:\Windows\System32 to my Desktop.

I opened cmd.exe, typed netstat and it worked fine.

I tried to open command.com and got this error message:
---------------------------
16 bit MS-DOS Subsystem
---------------------------
C:\WINDOWS\System32\command.pif
C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running
MS-DOS and Microsoft Windows applications. Choose 'Close' to terminate the
application.
---------------------------
Close Ignore
---------------------------

I moved both my autoexec.nt and config.nt out of C:\Windows\System32 to my
Desktop.

I opened cmd.exe and typed netstat and it worked fine.

I tried to open command.com and got this error message:
---------------------------
16 bit MS-DOS Subsystem
---------------------------
C:\WINDOWS\System32\command.pif
C:\WINDOWS\SYSTEM32\CONFIG.NT. The system file is not suitable for running
MS-DOS and Microsoft Windows applications. Choose 'Close' to terminate the
application.
---------------------------
Close Ignore
---------------------------

command.com looks for CONFIG.NT first, then AUTOEXEC.NT.

The gist of this is that cmd.exe works fine without either autoexec.nt or
config.nt being where they belong.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In