Command prompt - system file unsuitable for running MS-DOS??????

P

peterlavington

If I open a command prompt and enter cmd, I get the following message-
"16 bit MS=DOS subsystem. Command prompt,
C\WINDOWS\SYSTEM32|autoexec.nt. The system file is not suitable for
running MS-DOS and Windows applications. Choose Close to terminate the
application." In itself it doesn't matter much to me but I recently had
an internet problem and the man at the help desk wanted me to open the
command prompt window and enter cmd. He muttered darkly about a system
problem and I should get it sorted.

My internet is working now but what on earth is this message about and
should I be worried???
 
W

Wesley Vogel

You have a trojan/virus/worm.

You probably have cmd.com.

You have a trojan/virus/worm. cmd.com is *NOT* an XP file.

cmd.com is *NOT* an XP file, it's added by a trojan/worm/virus.

You have a trojan/virus/worm. cmd.exe is not part of the 16 bit MS-DOS
Subsystem. autoexec.nt and config.nt have nothing to do with cmd.exe.

Update your antivirus software and run a complete scan.

Update whatever anti-spyware applications that you have and run a full
system scan with each one.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
P

Pete L

Thanks Guys & Gals for your response.

I'm surprised at the suggestion that it is a virus causing the problem
since I subsequently found out about this on a microsoft page. They
seemed to just think it is a corruption of a file and can be easily
fixed. It's no big deal to me and I have fixed the problem now. My
virus checker certainly didn't pick this one up. Thanks again -
however, I have far more problems regarding my internet line dropping
out every five minutes and my provider saying there is no problem with
the line....... but I won't bore you with this!!!!
 
W

Wesley Vogel

And what did scanning for malware turn up?

Is command.com the file that may be corrupted?

Error message when you install or start an MS-DOS or 16-bit Windows-based
program
http://support.microsoft.com/default.aspx?scid=kb;en-us;324767

How do you open a command prompt?

Start | Run | and type: cmd ?

Start | Run | and type: command ?

autoexec.nt and config.nt have *nothing* to do with cmd.exe (Command
Prompt). These files are used with command.com (MS-DOS Prompt), not
cmd.exe.

You should never get a 16 bit MS-DOS Subsystem error using cmd.exe unless
you are using it to start a 16 bit application or have some sort of malware.

You can move, delete or otherwise mess with autoexec.nt and config.nt and
this will have absolutely *no* affect on cmd.exe.

command.com will not open if either autoexec.nt or config.nt are missing,
messed up or whatever.

command.com looks for CONFIG.NT first, then AUTOEXEC.NT.

Did you have a command.pif error or a command prompt error?

---------------------------
16 bit MS-DOS Subsystem
---------------------------
C:\WINDOWS\System32\command.pif
C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running
MS-DOS and Microsoft Windows applications. Choose 'Close' to terminate the
application.
---------------------------
Close Ignore
---------------------------

command.pif is a shortcut to command.com and has nothing to do with cmd.exe.

command.pif is file called command with no extension in the system32 folder.

Do the commands NETSTAT, PING, REGEDIT, TASKKILL, TASKLIST or TRACERT work?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
P

Pete L

Thanks for your suggestions....

I went to the microsoft site you gave me and followed the steps. When I
open the command prompt and enter cmd nothing appears in the box and
the whole thing freezes on me and I get the windows cannot end this
prog box. None of the commands you mention do anything...

Just about to run a virus checker now......
 
W

Wesley Vogel

Peter,
None of the commands you mention do anything...

There can be two reasons that I know of for NETSTAT, PING, REGEDIT,
TASKKILL, TASKLIST or TRACERT to be not working. One, the PATH is messed
up. Two, there is a trojan/virus/worm that has messed these up.

If these are present:
CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

When typing cmd without an extension, Windows or cmd.exe or command.com
tries to start cmd.com not cmd.exe because when you do not type an extension
Windows or cmd.exe or command.com look for files in this order: .COM, .EXE,
..BAT, .CMD. If both cmd.com and cmd.exe exist, cmd.com will try to start
first. Same with all of the .com files mentioned above. Same when typing
any executable name without an extension.

<quote>
When you run a command that does not contain an extension, Cmd.exe uses the
value of the PATHEXT environment variable to determine which extensions to
look for and in what order. The default value for the PATHEXT variable is:

..COM;.EXE;.BAT;.CMD

(that is, the syntax is the same as the PATH variable, with semicolons
separating the different elements).

When searching for an executable, if there is no match on any extension,
then looks to see if the name matches a directory name. If it does, the
START command launches the Explorer on that path. If done from the command
line, it is the equivalent to doing a CD /D to that path.

When you search for an executable and there is no match on any extension,
start searches directory name. If it does, start opens Explorer.exe on that
path.
<quote>
From...
Start
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/start.mspx

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
P

Pete L

Thanks Wesley for your help and advice.

If I go to Start - run and just key in cmd - all I get is a blank
prompt screen and it then freezes and I get the dialog box to say
program is not responding.

However, if I key in cmd.exe - all seems fine. I did check to see if I
had any virus and none was present. I have, though, picked up a couple
over the last few months. It certainly sounds like a virus may have
messed up the system, although I can live with it as everything else
seems fine. On the rare occasion I need to open a command prompt I
shall always put in the extension.

Thanks again

PS We're off to your wonderful country next Sunday (I guess you are
based in the US!)

Pete L
 
W

Wesley Vogel

Pete,

Look in System32 folder (%windir%\System32) for any of the following files:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

Type: system32 in Start | Run and click OK.

Or do a Search...

HOW TO: Search For Hidden Or System Files In Windows XP
http://support.microsoft.com/kb/302347

Delete all of the .com files listed above.

Do not delete any other .com files. There a number that are legit.
PS We're off to your wonderful country next Sunday (I guess you are
based in the US!)

Colorado.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
P

Pete L

Wes,
Yes, those COM files were lurking in the system 32 file. I
notice they all appeared at the same date in March. Presumably when I
picked up the virus. They are al deleted now and by entering just 'cmd'
now the box comes up and all appears ok.

Many thanks for your help!

Pete L
 
W

Wesley Vogel

Keep having fun, Pete.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top