[Resoloved] command prompt

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

ipatriot

Thread Starter
Joined
Feb 26, 2003
Messages
333
Hi,

My problem is i cant open command prompt when i click on it i get a message saying:"The C:\windows\system32\smss.exe application cannot be run in Win32 mode."

Any ideas what this means in engish and canit be fixed????

cheers ipatriot
 
Joined
Dec 9, 2000
Messages
45,855
That's a very abnormal error message. Could you post a HijackThis Scanlog so we can see if perhaps you have some worm or virus running...

http://www.tomcoyote.org/hjt/

Also do you get this same message if you go to start, run and enter:

cmd

rather than click on a shortcut?
 

ipatriot

Thread Starter
Joined
Feb 26, 2003
Messages
333
Hi,

No it opens then didnt think about going that way about it.

Thanks ipatriot
 

ipatriot

Thread Starter
Joined
Feb 26, 2003
Messages
333
Logfile of HijackThis v1.97.2
Scan saved at 12:32:21, on 20/09/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton Personal Firewall\SymProxySvc.exe
C:\Program Files\Norton Personal Firewall\NISSERV.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\My Shared Folder\nerkey.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX01.376\FreeRAM XP Pro 1.31.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SuperBar\sbhc.exe
C:\Documents and Settings\Ryan\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Virgin.net
O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\System32\ipinsigt.dll
O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\Program Files\SuperBar\SuperBar.Dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SuperBar - {CD22FC28-5C24-44F5-BEB2-4AA0056E7AD8} - C:\Program Files\SuperBar\SuperBar.Dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX01.376\FreeRAM XP Pro 1.31.exe" -win
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} (SysWebTelecom Class) - http://www.sponsoradulto.com/SysWebTelecom.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6436ED57-7716-4208-8823-FABEE838E3E2}: NameServer = 194.168.4.100 194.168.8.100
 
Joined
Dec 9, 2000
Messages
45,855
First to address the cmd shell problem.

The fact that it runs properly from start, run but not from the shortcut has to mean there is something wrong with the shortcut itself.

Right Click on the shortcut and select "properties". Does the Target field contain this path:

%SystemRoot%\system32\cmd.exe

If not, copy/paste that line to it and click ok and then try it.

If it still doesn't work, verify that you have a copy of cmd.exe in the system32 directory and that the command shell opens when you double click it directly.

There is also a registry tweak that I find very useful that allows the CMD shell to be opened at any folder location by Right Clicking and selecting CMD Shell from the right click dialog. I will include it as an attachment. Jus downlowd it to a convenient folder and RENAME it CMD Shell.reg and then double click it to merge to the registry.

======================================

Now for the Scanlog. Are those desired Search Pages shown at the top? They do nothing for me and I see you have a Search Hijack running. To restore defaults check the following boxes in HijackThis and close all browser windows and click "fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/

O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\System32\ipinsigt.dll
O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\Program Files\SuperBar\SuperBar.Dll

O3 - Toolbar: SuperBar - {CD22FC28-5C24-44F5-BEB2-4AA0056E7AD8} - C:\Program Files\SuperBar\SuperBar.Dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

^^^ legit but of use only to professional program debuggers

>> Finally, any idea what this is running?

C:\My Shared Folder\nerkey.exe

>> And to complete the cleaning, you should install, UPDATE, and run Spybot following directions here; be sure to reboot after running it:

http://tomcoyote.org/SPYBOT/
 

Attachments

ipatriot

Thread Starter
Joined
Feb 26, 2003
Messages
333
Hi,

Thanks for all your help i have done what you have said and it all seems to be working again. And as for C:\My Shared Folder\nerkey.exe i dont have a clue what it is but it wont let me delet it thats for sure.

Thanks ipatriot
 
Joined
Dec 9, 2000
Messages
45,855
Let's see if we can figure out how it's starting, it may be configured as a service.

Run HijackThis, but instead of posting a ScanLog, post a Startuplist with "list minor sections" checked.

Here's how:

Click Config > Misc Tools, put a check in "list minor sections", then click Generate Startuplist.

Copy/paste that here.

You may have to disable or remove the service to properly delete it.

Alternately you can try doing so by terminating the running process from the Task Manager, or rebooting in Safe Mode, but if it is starting as a service other steps need to be taken as well.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top