1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Resoloved] command prompt

Discussion in 'Windows XP' started by ipatriot, Sep 17, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Hi,

    My problem is i cant open command prompt when i click on it i get a message saying:"The C:\windows\system32\smss.exe application cannot be run in Win32 mode."

    Any ideas what this means in engish and canit be fixed????

    cheers ipatriot
     
  2. dai

    dai

    Joined:
    Mar 6, 2003
    Messages:
    11,198
  3. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Thanks will hav a look.
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    That's a very abnormal error message. Could you post a HijackThis Scanlog so we can see if perhaps you have some worm or virus running...

    http://www.tomcoyote.org/hjt/

    Also do you get this same message if you go to start, run and enter:

    cmd

    rather than click on a shortcut?
     
  5. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Hi,

    No it opens then didnt think about going that way about it.

    Thanks ipatriot
     
  6. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Logfile of HijackThis v1.97.2
    Scan saved at 12:32:21, on 20/09/2003
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Personal Firewall\NISUM.EXE
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton Personal Firewall\SymProxySvc.exe
    C:\Program Files\Norton Personal Firewall\NISSERV.EXE
    C:\WINDOWS\Mixer.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\My Shared Folder\nerkey.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX01.376\FreeRAM XP Pro 1.31.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\SuperBar\sbhc.exe
    C:\Documents and Settings\Ryan\Local Settings\Temp\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Virgin.net
    O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\System32\ipinsigt.dll
    O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\Program Files\SuperBar\SuperBar.Dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: SuperBar - {CD22FC28-5C24-44F5-BEB2-4AA0056E7AD8} - C:\Program Files\SuperBar\SuperBar.Dll
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX01.376\FreeRAM XP Pro 1.31.exe" -win
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
    O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} (SysWebTelecom Class) - http://www.sponsoradulto.com/SysWebTelecom.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6436ED57-7716-4208-8823-FABEE838E3E2}: NameServer = 194.168.4.100 194.168.8.100
     
  7. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    First to address the cmd shell problem.

    The fact that it runs properly from start, run but not from the shortcut has to mean there is something wrong with the shortcut itself.

    Right Click on the shortcut and select "properties". Does the Target field contain this path:

    %SystemRoot%\system32\cmd.exe

    If not, copy/paste that line to it and click ok and then try it.

    If it still doesn't work, verify that you have a copy of cmd.exe in the system32 directory and that the command shell opens when you double click it directly.

    There is also a registry tweak that I find very useful that allows the CMD shell to be opened at any folder location by Right Clicking and selecting CMD Shell from the right click dialog. I will include it as an attachment. Jus downlowd it to a convenient folder and RENAME it CMD Shell.reg and then double click it to merge to the registry.

    ======================================

    Now for the Scanlog. Are those desired Search Pages shown at the top? They do nothing for me and I see you have a Search Hijack running. To restore defaults check the following boxes in HijackThis and close all browser windows and click "fix checked":

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/

    O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\System32\ipinsigt.dll
    O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\Program Files\SuperBar\SuperBar.Dll

    O3 - Toolbar: SuperBar - {CD22FC28-5C24-44F5-BEB2-4AA0056E7AD8} - C:\Program Files\SuperBar\SuperBar.Dll

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    ^^^ legit but of use only to professional program debuggers

    >> Finally, any idea what this is running?

    C:\My Shared Folder\nerkey.exe

    >> And to complete the cleaning, you should install, UPDATE, and run Spybot following directions here; be sure to reboot after running it:

    http://tomcoyote.org/SPYBOT/
     

    Attached Files:

  8. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Hi,

    Thanks for all your help i have done what you have said and it all seems to be working again. And as for C:\My Shared Folder\nerkey.exe i dont have a clue what it is but it wont let me delet it thats for sure.

    Thanks ipatriot
     
  9. Triple6

    Triple6 Moderator

    Joined:
    Dec 26, 2002
    Messages:
    52,899
    First Name:
    Rob
  10. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Let's see if we can figure out how it's starting, it may be configured as a service.

    Run HijackThis, but instead of posting a ScanLog, post a Startuplist with "list minor sections" checked.

    Here's how:

    Click Config > Misc Tools, put a check in "list minor sections", then click Generate Startuplist.

    Copy/paste that here.

    You may have to disable or remove the service to properly delete it.

    Alternately you can try doing so by terminating the running process from the Task Manager, or rebooting in Safe Mode, but if it is starting as a service other steps need to be taken as well.
     
  11. ipatriot

    ipatriot Thread Starter

    Joined:
    Feb 26, 2003
    Messages:
    333
    Ah got rid of it at last. Thanks for all your help.

    ipatriot
     
  12. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
  13. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/165433

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice