System32\cmd.exe

[rvc68]

I am running Windows XP and when I bootup I get a menu "C:\windows\system32\cmd.exe". I use both Spyware Blaster and Spyware Stormer and have run both programs but the menu keeps coming up. I don't have any problems because of this but would like to get rid of it. How do I go about doing this. Thank you.

[XTC46]

its a virus...use an anti virus...I believe symantecs online one will pick it up. and you dont THINK its causing problems...look in you task manager and see if ftp.exe was started lol

[lowtone]

Check msconfig [Startup]?

[rudack]

go into your registry. Regedit

locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Look for anything fishy.

[SDK]

Run Msconfig if you use XP, It'll show you ALL program that will start at boot because Windows use more that one registry key to open program.

[©opy®ight]

wtf ? And here i though cmd.exe was the command prompt in windows xp....i mean, here i know that cmd is the command prompt in win xp

[HTRegz]

Hey Hey,

I'm not too sure why virus was immediately mentioned... because as ©opy®ight said.. it's the NT-based command line. SDK had a good suggestion, however I've learned recently that msconfig doesn't include the RunServices and RunServicesOnce registry keys... which are places where I've found a few viruses and malware to hide... I'm guessing it's not a menu, but Window.... black with white text.. and it says "C:\Windows\System32\cmd.exe" on the top... this is just the CLI in any NT-Based OS (as I stated above and ©opy®ight also mentioned). A better question to ask would be what text is displayed in the window or is it simply a pure black screen... That text could lead us to an answer... It sounds to me like something is callign your CLI on startup... MSConfig is a good start to finding a solution... If there is any text, let us know and we may be able to point you in the right direction... The only time I've seen the CLI open on start-up.... other than when cmd.exe was a startup entry somewhere.... was when a console virus was going to run but got an error because of corrupted files and the window locked open... Did you get any errors about a 16-bit subsystem popping up?

Peace,
HT

[rvc68]

First off, the menu I get is as you questioned "C:\Windows\System32\cmd.exe" and with the black screen showing " C:\" only. I must admit, most of these responses are commenting on things I know nothing about I am obviously not very computer savy. Not sure where to go from here. The comment check for fishy entries in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run" I afraid I wouldn't know a fishy entry if I saw one, sorry. Appreciate all the help though just hope I can get this thing corrected.

[arisecanfly]

Well we can help you out in spotting fishy entries. Go to this website

http://www.spychecker.com/program/hijackthis.html

Download Hijackthis-->Open it-->Scan-->copy report-->paste it on here

So hopefully we can be of help...

[sec_ware]

Maybe an even simpler approach: It might be, that this cmd-shell is executed
(to do whatever) in the StartUp (Start.All Programs.StartUp) by some
batch-job.
Check Start.All Programs.StartUp by right-clicking on every-entry with a
black-icon (and a tiny "c:\" ). In the context-menu, there is in addition to OPEN also an EDIT,
click EDIT and copy-paste the content here.

If there is nothing, you can try the other approaches.

I hope, you have nothing sensitive there.