Strange issue

[Fly_Guy]

Good Day! I have some strange problems. I can not run any .MSC files
and can not do most command line commands. Examples: if I go to "RUN"
and type "cmd" I get the error "cmd is not a valid win32 file", yet if
I do cmd.exe it will work. Same with Regedit, yet Regedit.exe will
work. I can not do a defrag in "My Computer" or from a command line
"dfrg.msc". Yet can get to Defrag from MMC console by adding Defrag
to the console. Another issue is I can not "Search" from the Start
Button or from My Computer. The message says "Search Assistant is not
configured". When I Right Click on My Computer and choose Manage it
fails with "MMC can not find the file c:\windws\system32\xxxxx"

I have Notron Anti Virus, AdAware and Windows Defender and all are up-
to-date. Ran full scans on all and found little to nothing. I went
back to an old restore point and still have the issues. I created
another profile and it has the issues too. XP version is 5.1.2600.
Office 2000, system is a Sony MutliMedia 3.6ghz PC.

Thnaks for any help! Randal

 

[Wesley Vogel]

You most likely have a virus, trojan or a worm.

cmd.com Error Message...

---------------------------
cmd
---------------------------
cmd is not a valid Win32 application.

---------------------------
OK
---------------------------

and can not do most command line commands. Examples: if I go to "RUN"
and type "cmd" I get the error "cmd is not a valid win32 file", yet if
I do cmd.exe it will work. Same with Regedit, yet Regedit.exe will
work.

Cmd.com is trying to run instead of cmd.exe. Regedit.com is trying to run
instead of regedit.exe. Windows looks for .com file first if now extension
is typed.

You have a trojan/virus/worm. cmd.com is *NOT* an XP file.

cmd.exe and command.com are legitimate Windows XP files.

When you type cmd in the Start | Run box, XP finds cmd.com instead of
cmd.exe. When a command is typed without an extension, XP looks for the
..com extension first before it looks for the .exe extension, if it finds
cmd.com, it will not even look for cmd.exe.

cmd.com is *NOT* an XP file, it's added by a trojan/worm/virus.

If you were to type cmd.exe in the Start | Run box, cmd.exe might open if
the trojan/worm/virus hasn't rendered it useless.

UPDATE your antivirus software and run a complete scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

Also Known As: W32.Alcan.A, Win32.Alcan.A [Computer Associates],
P2P-Worm.Win32.Alcan.a [Kaspersky Lab], W32/Alcan.worm!p2p [McAfee],
W32/Alcra-A [Sophos], WORM_ALCAN.A [Trend Micro]

[[This worm drops the legitimate file compression DLL, BSZIP.DLL in the
Windows system folder. It does this so it can compress itself. It also drops
the following files in the Windows system folder:

CMD.COM
NETSTAT.COM
PING.COM
REGEDIT.COM
TASKKILL.COM
TASKLIST.COM
TRACERT.COM

These files contain the string MZ so that this worm can disable the
following Windows tool applications:

CMD.EXE
NETSTAT.EXE
PING.EXE
REGEDIT.EXE
TASKKILL.EXE
TASKLIST.EXE
TRACERT.EXE ]]
From...
WORM_ALCAN.A - Technical details
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ALCAN.A&VSect=T

Symantec Security Response - W32.Alcra.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In