Command Processor Autorun Problem

Question

CMD is not working on my PC. I identified the problem but don't know how to solve it.

CMD doesn't work due to command processor's autorun having the data value of:

"@mode 20,5 & tasklist /FI "IMAGENAME eq FirewallModule.exe" 2>NUL | find /I /N "FirewallModule.exe">NUL && exit & if exist "C:\Users\user\AppData\Roaming\Microsoft\FirewallModule\FirewallModule.exe" ( start /MIN "" "C:\Users\user\AppData\Roaming\Microsoft\FirewallModule\FirewallModule.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit )"

This was caused by a data mining malware called SoundMixer.exe which I've deleted all traces of. When I noticed the CMD not working, I found the solution of deleting the autorun from regedit completely (this is a working fix for many people). I tried it and it worked. CMD was working again but when I restarted my PC, I got a black screen with only cmd running. I tried many fixes for this (running on safe mode and running diagnostics, health checks but nothing worked. I had to restore a few days old system backup. Then I tried not deleting the autorun but changing it's data value to blank. Got the same result.

How can I solve this issue?

Answer 1

See if Autoruns can uncover the hijack. Download it from the following link:

https://live.sysinternals.com/Autoruns.exe

Double click to run it and accept the EULA. When it has finished scanning, enter cmd.exe into the Filter box up top.

Are there any entries apart from the SafeBoot/AlternateShell entry?

If there are, post a screenshot of what's found.

Answer 2

Can you try to set Autorun value to="cd /d c:\windows\system32"?

Also, Do you have the Autorun value in HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER?

Let me know the result.

Thanks.

Answer 3

Is this where the command data is located:

HKEY_CURRENT_USER\Software\Microsoft\Command Processor

Also Check the Shell value for the following reg key, it should be explorer.exe:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Shell REG_SZ explorer.exe

Answer 4

Hello Paul, thanks for the reply.

Unfortunately, it didn't help. It still has the same problem.

Answer 5

Hi KUZEYBAYKAL,

I'm Paul, an Independent Advisor. I hope I can help you with your concern

I think it would be fixed if you will perform a repair upgrade.

.

Follow the instructions below.

A. Downloading the Windows 10 ISO file.

1. Download the tool (https://go.microsoft.com/fwlink/?LinkId=691209), and select Run. You need to be an administrator to run this tool.
2. If you agree to the license terms, select Accept.
3. On the What do you want to do? page, select Create installation media for another PC and then select Next.
4. Select the language, edition, and architecture (64-bit or 32-bit) for Windows 10. (Select the same as the currently installed system on your PC)
5. In "Select which media you want to use", Select ISO file then click Next.
6. Select the download location then click Save.
7. Windows 10 ISO file will be downloaded,

B. Repair Upgrade installation.

1. Right-click Windows 10 ISO file and click Mount.
2. Open/run the Setup.exe.
3. The preparation starts
4. To get important updates, select Download and install updates. (Wait while checking for updates).
5. Accept the terms of the license agreement
6. The installation is ready to be applied, verify the information and ensure that "Keep personal files and applications is checked".
7. Click on Install to start the upgrade.

I hope this helps. Feel free to ask back any questions and keep me posted.