You have a trojan/virus/worm. cmd.com is *NOT* an XP file.
This may explain your other problems. Or it may not.
cmd.exe and command.com are legitimate Windows XP files.
You have a trojan/virus/worm. cmd.exe is not part of the 16 bit MS-DOS
Subsystem. autoexec.nt and config.nt have nothing to do with cmd.exe.
When you type cmd in the Start | Run box, XP finds cmd.com instead of
cmd.exe. When a command is typed without an extension, XP looks for the
..com extension first before it looks for the .exe extension, if it finds
cmd.com, it will not even look for cmd.exe. Because XP finds cmd.com XP
thinks that it needs autoexec.nt and config.nt to run cmd.com.
cmd.com is *NOT* an XP file, it's added by a trojan/worm/virus.
If you were to type cmd.exe in the Start | Run box, cmd.exe might open if
the trojan/worm/virus hasn't rendered it useless.
UPDATE your antivirus software and run a complete scan.
UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.
Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]
[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:
CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM
These files contain the string MZ so that this worm can disable the
following Windows tool applications:
CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T
Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html
UPDATE your antivirus software and run a full system scan.
UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.
You might want to start in Safe Mode to run your antivirus and anti-spyware
software.
Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.
How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
stakesbyarmskeane said:
cant run cmd!
" the file system is not suitable for running MS-DOS and windows
applications" did the top bit but the program still doesnt work?
anymore ideas?
chris
Wesley Vogel said:
Reinstalling WMI
http://windowssdk.msdn.microsoft.co...us/wmisdk/wmi/reinstalling_wmi.asp?frame=true
To fix this problem:
1. Use the Start menu to right-click My Computer.
2. Press the Manage item.
3. Double-click Services and Applications in the left-hand pane.
4. Press Services to expand it.
5. Scroll to Windows Management Instrumentation in the right-hand pane
and right-click it.
6. Press Stop.
7. Use Windows Explorer to delete all the files in the
%SystemRoot%\System32\Wbem\Repository folder.
8. Shutdown and restart your computer. The Windows Management
Instrumentation service will start and the files will be
re-created.]] ===
I had a problem with WMI, I also had a problem deleting
%SystemRoot%\System32\Wbem\Repository. I had to run Error Checking
(Chkdsk.exe). And then try to delete the file.
C:\WINDOWS\System32\Wbem\Repository\FS.
-------
Courtesy of Kelly T. @
http://www.kellys-korner.com/
[Windows Management Instrumentation - WinMgmt could not initialize the
core parts
Go to Start/Run/CMD and then run each of these hitting Enter after each:
winmgmt /clearadap
winmgmt /kill
winmgmt /unregserver
winmgmt /regserver
winmgmt /resyncperf
This may or may not repair the repository but will re-install wmi into
the registry.]
From
http://www.kellys-korner-xp.com/xp_w.htm
===
To correct permission issues:
1 - In the Management Console\Services STOP WMI and set to manual.
2 - Go to the WMI repository %Windows%system32%wbem and delete the
repository.
3 -Set the WMI service back to Automatic
4 - From %Windows%system32%wbem run "wbemtest" and connect to your
namespace.
5 - Start/Run/Regedit and navigate to: Locate current
HKEY_CURRENT_CONFIG\System\CurrentControlSet\Control\Class. Open the
class key and right click on the sub key 0000 and select permissions and
make sure that the permissions for you [administrator] are "Full".]]
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
stakesbyarmskeane said:
Hi Everyone
I Installed My SKY BY BROADBAND On Windowx XP Professional/Service pack
2 installed.
The problem is i cant run the program, it just gets an application
exception, no error mesage or anything.
I emailed sky and they sent me the following response:
Thank you for your e-mail with regards to the problem you have
experienced while using the Sky by broadband application.
After extensive investigation, our technical teams have determined that
the error message you've experienced (Application Exception), is not
caused by the Sky by broadband application itself, but is caused by a
core Microsoft Windows issue on your computer.
We believe this issue is caused by one of two problems:
The Windows registry Performance Counter Library values have become
corrupt, or
Another application has manually disabled the Performance Counter
Library Due to the complexity of this issue, we recommend that you seek
advice from Microsoft Windows XP support, or a similarly qualified
technical reference. We apologise for any inconvenience this may cause.
can anyone assist me with either repairing the above counter performance
libraries or checking if they are disabled?
thanks in advance
chris headlam
