Solved

Can't open cmd.exe in Windows 2003

Posted on 2011-03-09
19
1,030 Views
Last Modified: 2012-05-11
We've taken over a server that appears to have been infected with spyware or some viruses, which I think we've cleaned off. Symantec AV, AVG, MalwareBytes, and Windows Defender have all found infections that they said they cleaned, and we've rebooted after each one. now the server appears to be clean, but we can't open the command line.

Every time we launch cmd.exe (from the Start menu, the Run command, or the System32 folder) the window comes up and shows "tftp.exe" in the upper-left instead of the CMD.exe location. Instead of the folder location in the main window, it shows "Password_" . As soon as we enter any text the window automatically closes.

I've copied the CMD.EXE file from a different server that works as well as a Windows 2003 CD, but they all do the exact same thing. We've also installed all Windows 2003 updates.

We need to get into the command line ASAP to do some work, but have not been able to figure this out.
Any help would be appreciated.

Thanks.
0
Comment
Question by:sfcanderson
19 Comments
 
LVL 3

Expert Comment

by:supermandaddy
ID: 35085101
It looks like a software conflicts to me. Please try to test in Safe Mode. Restart the system and press F8, choose Safe Mode during startup.

What’s the result? If the issue doesn’t occur, you can disable third party software one by one to test.
0
 
LVL 1

Expert Comment

by:oldstone00
ID: 35085156
try sfc /scannow or reinstalling the service pack
0
 

Author Comment

by:sfcanderson
ID: 35085194
I'll try safe mode in about an hour. This is a domain controller, so I think that means we need to do Directory Services Restore Mode?

I've already tried sfc /scannow, but it doesn't do anything. The black window for the command line will pop up for 1/2 second and then disappear.

I'm nervous about reinstalling SP2 because it's been on there for so long. Couldn't this cause a conflict with the other updates that have been installed over the years?
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35085251
This definitely was caused by the virus.  
copy the following and save it to a file named cmdfix.reg and then run it on the server and it should put the correct file association back to the CMD extension.



copy all below here:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.CMD]
@="cmdfile"

[HKEY_CLASSES_ROOT\.CMD\PersistentHandler]
@="{5e941d80-bf96-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\cmdfile]
@="Windows Command Script"
"EditFlags"=hex:30,04,00,00
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
  00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
  32,00,5c,00,61,00,63,00,70,00,70,00,61,00,67,00,65,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,36,00,30,00,30,00,33,00,00,00

[HKEY_CLASSES_ROOT\cmdfile\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
  65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,35,\
  00,33,00,00,00

[HKEY_CLASSES_ROOT\cmdfile\shell]

[HKEY_CLASSES_ROOT\cmdfile\shell\edit]

[HKEY_CLASSES_ROOT\cmdfile\shell\edit\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
  54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\
  00

[HKEY_CLASSES_ROOT\cmdfile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\cmdfile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\cmdfile\shell\print]

[HKEY_CLASSES_ROOT\cmdfile\shell\print\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
  54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,2f,00,70,00,20,\
  00,25,00,31,00,00,00

[HKEY_CLASSES_ROOT\cmdfile\shell\runas]

[HKEY_CLASSES_ROOT\cmdfile\shell\runas\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,6d,00,\
  64,00,2e,00,65,00,78,00,65,00,20,00,2f,00,43,00,20,00,22,00,25,00,31,00,22,\
  00,20,00,25,00,2a,00,00,00

[HKEY_CLASSES_ROOT\cmdfile\shellex]

[HKEY_CLASSES_ROOT\cmdfile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\cmdfile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\cmdfile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\cmdfile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
0
 

Author Comment

by:sfcanderson
ID: 35085473
sweeps, I tried running that Registry key but am having problems. When I just run the file it tells me "The specified file is not a registry script. you can only import binary registry files from within the registry editor."

So, I opened regedit and imported the file. The first time it said "Cannot import ...filename... The key selected is invalid."

After that I edited the permissions on the HKEY_CLASSES_ROOT hive to ensure I had full rights on everything and ran it again. The second time I got this message:

"Cannot import...filename...: The specified file is not a registry file. You can import only registry files."
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35085566
attached is the registry file.  I have verified the entries match 2 of our 2003 servers so there should be no issue.  Please let me know if this still has import errors.
cmdfix.reg
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35085576
One thing I would mention is that if the server is having extenstion issues with cmd most likely it will have other extension issues.  If the virus was this extreeme the best solution is a rebuild.  

Just saying
0
 

Author Comment

by:sfcanderson
ID: 35085834
Downloaded your file, which ran successfully but did not fix the problem.

We're actually trying to remove this server, but it's the only domain controller so we have to get the new one running before we can demote this one. The new server is Windows 2008, so we have to get to the command line to prep the domain before we can proceed.
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35085960
I have talked with our systems engineer and he had the same idea as me.  Sorry but this is beyond me without having it sitting here.  

0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:sfcanderson
ID: 35085985
Ugh, we restarted into safe mode but the problem is still occurring. Any more thoughts on how to get into the command prompt?

Are there any other ways to upgrade AD without using the command prompts?
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35086191
What is it you need to run on the bad server?  Maybe I can help with that part.
0
 

Author Comment

by:sfcanderson
ID: 35086296
We're trying to run ADprep and forestprep to get the new Windows 2008 server in.
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35086672
can you try running the following.  see if command prompt fixes

Open Start >> Run and type the following command ( or just copy it )  


REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f

this should reset command prompt for logged in user...




still looking into vbscript to run adprep  will let you know if I can get it to work in our test environment.
0
 

Author Comment

by:sfcanderson
ID: 35086848
Thanks for continuing to try, but that command didn't fix it either!

If we can run the domainprep and forestprep from the Run command (or a VMScript) then we should be OK. Let me know if you find anything out, otherwise we'll try it again at the end of the day, which is the next time we have cleared for downtime.
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35087472
I am unable to get it to work without error in VB

I will keep trying and let you know if I can get it to go.
0
 

Author Comment

by:sfcanderson
ID: 35087488
Actually, I think we've found a solution. we use a managed services application that gives us command line access through a remote app, which seems to be working. We're going to try that in a few minutes and see if it's functonal.
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35087555
Good luck!  hope it works
0
 

Accepted Solution

by:
sfcanderson earned 0 total points
ID: 35132920
Well, none of that worked so we ended up going with a new domain. This was a pretty small company, so eventually we decided that it would take less time to join a few computers to the domain rather than continue troubleshooting. Thanks for all of your help, though. They were great suggestions.
0
 

Author Closing Comment

by:sfcanderson
ID: 35171009
Expert's solutions were excellent, but did not fix the problem.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now