Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Gibberish when running Command.com


  • Please log in to reply
10 replies to this topic

#1 Pmac2k

Pmac2k

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 05:36 AM

Right here is an interesting problem:

Running a Windows XP machine on a domain, we have seen this problem occure on one PC and didn't think much of it as it didn't really effect anything, now a second machine is displaying the same symptoms! The link MIGHT be combofix but I'd like to see what you all think and see if anyone has any ideas that I might have missed!

Start>Run>Command.com results in a pc speaker beep beep and the dos box opening up with the following (and yes the junk at the top is really there):

‰>!–»—€>– t»L—ΎΓ–‹>˜ ¬<?uŠ< tͺCβρ±° 8t°.ͺ¬<?uŠ< t - 12
52,
Microsoft® Windows DOS
©Copyright Microsoft Corp 1990-2001.

C:\DOCUME~1\UserName>

Now.... So far I have done a full anti-virus Malware spyware etc etc sweep and nothing on there that is showing itself, furthur more cmd is working fine but the software app that the users are using runs under command.com.

I've tried running 2 DOS fix apps XP_Fix.exe (Visualtours fix for dos problems) and the quickfix for 16bit subsystem errors that extracts from the win install disks, both with no joy, same error. The machine is running XPPro SP3 all up-to-date with MS Updates. Any clues to anything would be appreciated.

Regards

Pete

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:25 AM

Posted 05 February 2009 - 09:54 AM

Have you tried running sfc /scannow on the systems in question?

Have you considered possible corruption in the apps you are running?

Louis

#3 Pmac2k

Pmac2k
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 10:49 AM

Hi Louis, thankyou for your reply, I shall try SFC but I have found it is usually in-effective for command.com problems and the 16bit subsystem fix is pretty much replacing the relevent files. In reply to your second question, the error occures if you run command.com on its own (as per the example above) or the 'app' which is just started via a batch file.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:25 AM

Posted 05 February 2009 - 12:00 PM

Hmmm...I would try replacing the command.com file in the C:\Windows\System32 folder with a new copy, either manually or via sfc /scannow. Manually would be faster, but sfc /scannow would allow you to check for other possibly damaged system files.

Louis

#5 Pmac2k

Pmac2k
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 12:25 PM

I did actually try to copy command.com, Autoexec.nt, command.nt and config.nt across from another (fault free) machine, unfortunately I got the same result. Having search for just the gibberish at the top of the dos box I get a few hits from google that seem to appear during virus/malware clean up, which is where I think this problem comes from.

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:25 AM

Posted 05 February 2009 - 01:38 PM

Well...I was trying not to think "infection" when considering your domain.

Those/similar symbols usually result from either malware...or when someone tries to use the wrong program when attempting to open a system file.

Louis

Edited by hamluis, 05 February 2009 - 01:40 PM.


#7 Pmac2k

Pmac2k
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 02:18 PM

More news from the Sticky end... everyone has gone home so I can once more viciously attack the client machine! One file that was removed from this machine that worries me is a file called command.pif, so an infection has managed to get thru! Now this file has been removed by combofix but obviously something else is still causing a problem. Kaspersky online scanner is now running so see what that turns up! This might yet turn into a virus/malware hunt!

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:25 AM

Posted 05 February 2009 - 02:37 PM

FWIW: http://www.ca.com/us/securityadvisor/virus...s.aspx?ID=40839 AND http://www.bleepingcomputer.com/startups/c...d.pif-2783.html

Louis

#9 Pmac2k

Pmac2k
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 03:20 PM

Yeah, I'd found them. Looks like the reg links had been removed as they appear not to be in there anymore. Kaspersky is scanning the entire drive, will report back from there!

#10 Pmac2k

Pmac2k
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 February 2009 - 06:58 PM

Ho Hum... still nothing, ideas good bad and damn right crazy accepted.

#11 zalonen

zalonen

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 21 April 2009 - 11:43 AM

Ho Hum... still nothing, ideas good bad and damn right crazy accepted.


How's your problem? I have similar one... :thumbsup: And I have no idea what should I do :flowers:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users