Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

pc types strange commands by itself %systemroot%/system32/cmd.exe del eq echo open etc.

Posted on 2011-03-03
10
Medium Priority
?
1,290 Views
Last Modified: 2012-05-11
I'm having this exact problem but haven't found how to fix it. pls help.

http://www.techtalkz.com/windows-xp/148412-pc-typed-itself-systemroot-system32-cmd-exe-del-eq-echo-open.html
0
Comment
Question by:eggster34
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
10 Comments
 
LVL 32

Expert Comment

by:aleghart
ID: 35032690
Wipe the computer and re-install.  You obviously have an infection and haven't found a cure.

What answer are you looking for?   I see people all the time asking how they can do anything to avoid having a clean computer.

Fighting malware doesn't give you a clean computer.  You have no idea what else it has done to comprimise your system.

If you format the drive & re-install everything from clean/legal installation media, there aren't any problems.
0
 
LVL 32

Expert Comment

by:aleghart
ID: 35032722
Possible that the "infection" is screen sharing software or VNC that you installed, allowing someone else to control remotely.  But, like I said, you don't know what else they've done.  And...possibly are stealing your personal files/data while you remain connected to the internet.

Disconnect from the network & backup your data while you can.  Don't worry about trying to save your Windows installation.  Worry about your data and safety first.
0
 

Author Comment

by:eggster34
ID: 35033064
I'd like to know the name of the virus and a way to remove it if possible, rather than general and not very useful advice; I'm smart enough to figure out that if I wipe everything and reinstall the OS from scratch, the issue will go away; I would not have consulted EE if this was my intention; any idiot can wipe his hard drive and reinstall things from installation media, it's the smart guy who can clean the infection and get on with his life rather than spending 12 hours he doesn't have on it, so if you don't know the answer, please just hold your thoughts to yourself so that others can have a chance to look at this question and offer their opinion. thank you.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 32

Accepted Solution

by:
aleghart earned 2000 total points
ID: 35033178
Your symptom points to a VNC vulnerability.  With VNC, the remote attacker has control over your computer.

As much as you may think I'm an idiot, I don't know of any sysadmins who would deliberately leave a system under control of a remote attacker and call it "smart".

Re-imaging a computer is trivial.  I do it twice a year.  More often on test systems.

Have you already tried to uninstall VNC?
0
 
LVL 32

Expert Comment

by:aleghart
ID: 35033210
Launch TaskMgr and kill any VNC app/process that's running.

Find the installation directory \Program Files\xxxVNC
type in the command line using the name of the VNC executable, for example:  WinVNC.exe -remove
0
 

Author Comment

by:eggster34
ID: 35041321
I'm not running VNC. Why did you assume I was?
0
 
LVL 32

Expert Comment

by:aleghart
ID: 35042435
The same symptom show up on users with Windows, OS X, and Linux.  OS X users reported turning on their remote control (VNC server) software before the commands began.  VNC server can also be dropped into a Windows installation as part of malware payload.  It's very small and consumes little memory.

Many flavors already have a stealth mode built-in.

If it's VNC backdoor, remote commands are received via internet, so disconnecting from internet (disable all network interfaces) and rebooting should result in no more commands received/executed.  Connecting to internet would show symptoms again.

Not sure of the connection requirements...remote commands used to require direct connect to the internet (thus having a hardware firewall/router would stop the attack.
0
 

Author Closing Comment

by:eggster34
ID: 35111271
I formatted my PC, but your comments are valid and I thank you for helping me. I believe this would help others with a similar problem looking for a solution.
0
 
LVL 32

Expert Comment

by:aleghart
ID: 35113612
Thanks.  I understand it would have been less time-consuming to nip the problem in the bud.  At least your computer will be running good-as-new, and 100% clean.
0
 

Author Comment

by:eggster34
ID: 35113746
The idea of having a secret vnc server running without my knowledge was quite scary so I chose to format it, thanks again.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question