Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

cmd.exe appearing at start up


  • Please log in to reply
9 replies to this topic

#1 Chillum

Chillum

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:02:04 AM

Posted 04 September 2015 - 07:47 AM

Hi for the past 2 weeks the cmd.exe box has been appearing at startup (it just flashes on/off quickly) and also yesterday I received an error message (0xc0000018) on startup and the command prompt wouldn't open when I tried but his issue was resolved after restarting my pc a couple of times.Does anyone know what is causing this and is it a sign of malware? I ran sfc/scannow and it did not find any problems and I also scan regularly with mbam...thanks for any info regarding this issue.

 

HP 15 Notebook

Windows 10 Home x64



BC AdBot (Login to Remove)

 


#2 Bezukhov

Bezukhov

    Bleepin' Jazz Fan!


  • Members
  • 2,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, R.I.
  • Local time:03:04 AM

Posted 04 September 2015 - 09:08 AM

Did you install any new software just before this started?
To err is Human. To blame it on someone else is even more Human.

#3 Chillum

Chillum
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:02:04 AM

Posted 04 September 2015 - 09:17 AM

The most recent program installed (Zenmate) was a month ago and this problem started 2 weeks.



#4 Bezukhov

Bezukhov

    Bleepin' Jazz Fan!


  • Members
  • 2,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, R.I.
  • Local time:03:04 AM

Posted 04 September 2015 - 10:09 AM

Here are a couple of suggestions:

:step1: Please download Rkill by Grinler and save it to your desktop.
  • Link 1
  • Link 2
    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista/Windows7, right-click on it and Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • If the tool does not run from any of the links provided, please let me know.
  • Do not reboot the computer, you will need to run the application again.
:step2: Open Elevated Command Prompt from Search



1. Do step 2 or step 3 below for how you would like to search.

2. Press the Windows + S keys, type cmd, and go to step 4 below.

3. Open you Start menu, type cmd in the search box, and go to step 4 below.

4. When Command Prompt shows up in the search results, right click or press and hold on it, then click/tap on Run as administrator.


7870d1415056692t-elevated-command-prompt


5. In the elevated command prompt, type the command below, and press Enter. (see screenshot below step 3)



sfc /scannow


6. When the scan is complete, hopefully you will see a Windows Resource Protection did not find any integrity violations message unlike below. (see screenshot below)

NOTE: You will see a blinking cursor at the prompt until finished. This will take a while to finish running though.


8229d1415898249t-sfc-command-run-windows


7. If not issues were found, then close the command prompt.

If anything shows up do this next:
  • Copy and paste the following line of text into the black box:
    note: to paste, right-click in the black box and choose Paste
    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > "%userprofile%\desktop\sfcdetails.txt"
  • Press Enter to run the command, a text file sfcdetails.txt will be created on your desktop
  • Please post the contents of this log in your next reply

To err is Human. To blame it on someone else is even more Human.

#5 Chillum

Chillum
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:02:04 AM

Posted 04 September 2015 - 02:05 PM

sfc /scannow didn't find any violations and Rkill didn't seem to find much either but here is the Rkill log.The DOS box didn't just flash up,it stayed on the screen and ran in full.Windows Defender is disabled because I use Comodo.

 

Program started at: 09/04/2015 05:37:42 PM in x64 mode.
Windows Version: Windows 10 Home 
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * Windows Defender Disabled
 
   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001
 
Checking Windows Service Integrity: 
 
 * HdAudAddService [Missing Service]
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * No issues found.
 
Program finished at: 09/04/2015 05:41:40 PM
Execution time: 0 hours(s), 3 minute(s), and 58 seconds(s)

Edited by Chillum, 04 September 2015 - 02:06 PM.


#6 Bezukhov

Bezukhov

    Bleepin' Jazz Fan!


  • Members
  • 2,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, R.I.
  • Local time:03:04 AM

Posted 05 September 2015 - 01:00 AM

Let's take a closer look.

Please download MiniToolBox, save it to your desktop and run it.
Checkmark the following checkboxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices
  • List Users, Partitions and Memory size.
  • List Minidump Files
  • List Restore Points
Click Go and post the result (MTB.txt). A copy of MTB.txt will be saved in the same directory the tool is run.
To err is Human. To blame it on someone else is even more Human.

#7 Chillum

Chillum
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:02:04 AM

Posted 05 September 2015 - 03:30 AM

Thanks for your replies but I don't have the option to be able to post attachments so I uploaded it to sendspace. 

 

https://www.sendspace.com/file/dias4i


Edited by Chillum, 05 September 2015 - 04:41 AM.


#8 Bezukhov

Bezukhov

    Bleepin' Jazz Fan!


  • Members
  • 2,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, R.I.
  • Local time:03:04 AM

Posted 05 September 2015 - 11:31 PM

I can't say for sure why the command prompt is showing up. Maybe some program silently updated, and this is a result.
 

The DOS box didn't just flash up,it stayed on the screen and ran in full.


Any way of posting a screen shot of that?

Anyways, I should at least see if there is anything amiss.


Please download AdwCleaner by Xplode and save to your Desktop.
  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8/10 users right-click and select Run As Administrator
  • The tool will start to update the database, please wait a bit.
  • Click on I agree button.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Edited by Bezukhov, 05 September 2015 - 11:32 PM.

To err is Human. To blame it on someone else is even more Human.

#9 Chillum

Chillum
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:02:04 AM

Posted 06 September 2015 - 01:31 PM

AdwCleaner didn't find anything (only found uk.ask.com).Seems like this cmd issue isn't anything serious and doesn't seem like it is malware related so I'll leave it at that.Thanks for your time and help with this ..much appreciated! 

 

 

Here is the screenshot btw

 

kcdtle.jpg



#10 Bezukhov

Bezukhov

    Bleepin' Jazz Fan!


  • Members
  • 2,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, R.I.
  • Local time:03:04 AM

Posted 06 September 2015 - 11:38 PM

Your welcome.
To err is Human. To blame it on someone else is even more Human.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users