28

Has anyone found such behavior when Command Processor (cmd.exe) closes immediately after calling it? I’ve run McAfee AV and Windows System File Check (sfc.exe) and nothing wrong was detected, I’ve even copied cmd.exe file from other win 7 machine and it is still working same way. Strangest thing is – on the windows 7 64 there is also 32 bit version of that file which works perfectly normal.

SysInternals Process Monitor shows that cmd.exe process ends with exit code 0x0... o_O

Also calling commands directly from start menu, like ping, works normal…

Maybe that question is not strictly related to coding but that issue holds me from doing many things related to actual application development and environment check.

Random
  • 4,519
  • 2
  • 38
  • 46

6 Answers6

108

Answering all questions:

  • superuser, safe mode, run as admin, changing ownership and permissions - didn't help
  • I was calling by menu start as well as d-clicking cmd.exe with same result,
  • No virsus either malware found by today's scanning with McAfee, Anti-malware, MS Malicious removal... etc

Finally I got it SOLVED:

  • Run regedit

  • Go to HKLM\Software\Microsoft\Command Processor\ or HKEY_CURRENT_USER\Software\Microsoft\Command Processor\ or HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\

  • For some reason there was AUTORUN key with "EXIT" inside.

  • Remove the AutoRun key and everything should went back to normal.
  • CMD.exe should start to work again.

Also,

In some cases, the Command prompt is also opening on Startup, which is when the above solution is applied hangs the system on Command prompt when you logon.

This can be fixed by using Autoruns, where you need to disable command prompt startup registries on Logon/Startup tab. (there can be more than one entries)

That one also explains why exit code was 0x0.

Have no idea what kind of thing set that key up... McAfee showed some activity lat week and I've noticed it last Friday.

Hope these symptoms and my answer will help someone in future

Mr_Green
  • 40,727
  • 45
  • 159
  • 271
Random
  • 4,519
  • 2
  • 38
  • 46
  • Interesting thing is when I check the AutoRun Key there wasn' t EXIT inside. After adding EXIT and run cmd.exe, and then remove EXIT from the key, cmd.exe now appear and not disappear anymore. – xgdgsc Jul 16 '15 at 03:52
  • 5
    Thanks! Got Autorun=@mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist " ( start /MIN "" " & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) in HKCU – i.y. Mar 03 '19 at 10:58
  • 1
    I suspect this is a virus. I found an app in C:\Users\{profilename}\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe – Super1337 Dec 22 '19 at 20:00
  • This was a life saver, before finding this Autorun reg key, I wasn't able to use any cli commands. I literally ran `nvm use 13.9.0` and instead of a authorization dialog my explorer opened :O ... Thanks! – Mihail Minkov Mar 03 '20 at 17:19
  • I actually think in my case it was caused by using nvm. Not 100% sure though. – Mihail Minkov Mar 06 '20 at 03:10
  • 4
    I had "if exist" under Autorun instead of "exit". And deleting made the cmd work again. Thanks ! – Metrician Nov 29 '21 at 16:34
3

I had this problem and found something to try that solved my problem.

Investigate registry entry HKLM\Software\Microsoft\Command Processor If there is an "Autorun" key, this key causes the batch file entry in this key to run at the beginning of the command prompt execution. You can try to skip this execution to test the solution using RUN cmd.exe /d

If the problem is user specific, check HKCU\Software\Microsoft\Command Prompt for this key. The current user entry mixes in with the local machine entry so if the key exists in the current user registry then it will try to execute the listed batch file. On my computer the key was there but empty. If there is a batch file in this key then figure out what that batch file is doing and if you want it there. I deleted the key all together and the problem went away.
On my computer the key was present in current user but not in local machine.

Somehow some virus probably put this key in the registyr but since it is a valid key, it is hard for malware detectors to find this.

I didn't find any other solutiosn to this problem on the web so please let others know if this works for you. I never post on forums but saw a bunch of questions about this and on good solutions so I thought I had to post.

I got the idea about this solution from this link.
http://software.oberberger.com/2008/09/interesting-stuff-about-cmdexe.html

Good luck.

Relieved
  • 31
  • 1
2

I suspect this is a virus called vmprotected cryptocurrency miner.

I found an app in C:\Users{profilename}\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe

Also: The follow values were modified Also there are two main keys you need to modify

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

The shell key should have a value of explorer.exe and it was changed to %Comspec% which causes the command prompt to execute on login.

I would highly recommend you run a full virus scan and ensure the keys and executables are removed

Super1337
  • 226
  • 1
  • 8
  • The OP's question is from early 2011. Cryptocurrency was barely a thing back then. Doubtful the virus you're referring to existed almost 9 years ago. – David Makogon Dec 23 '19 at 19:37
1

I've had similar problem - cmd.exe was closing immediately after starting. I was able to keep it running by executing cmd.exe /K cmd.exe, but it was closing after any invalid command. I've found out that my problem was caused by non default code page:

C:\>chcp
Active code page: 65001

To fix the problem I've removed registry entry:

[HKEY_CURRENT_USER\Console\%SystemRoot%_system32_cmd.exe]
"CodePage"=dword:0000fde9

Another solution is to change cmd.exe font from raster fonts to a true type one.

Zsolt Botykai
  • 50,406
  • 14
  • 85
  • 110
yachoor
  • 929
  • 1
  • 8
  • 18
  • This one works for me for the exact same symptoms. `cmd.exe` was closing immediately after starting and by executing `cmd.exe /K cmd.exe` the console keeps open and closing after any invalid command. Removing the `CodePage` key under `HKEY_CURRENT_USER\Console\%SystemRoot%_system32_cmd.exe` fixes the problem. Many thanks bro. – TwystO Oct 25 '14 at 16:13
0

This is a shot in the dark, but I have seen problems like this in the past when incorrectly specifying a debugger via Image File Execution Options. You might check to see if there's an entry for 'cmd.exe' there.

paulcam
  • 884
  • 5
  • 14
0

Answering in case anyone else still runs into this problem. I have recently experienced same issue, and the reason for that was a bitcoin mining malware. I used Malwarebytes to scan the computer and remove the malware, which immediately resolved the problem.

Ach113
  • 1,775
  • 3
  • 18
  • 40
  • The OP's question is from early 2011. Cryptocurrency was barely a thing back then. Doubtful the bitcoin mining malware you're referring to existed almost 9 years ago. – David Makogon Dec 23 '19 at 19:37
  • @David I understand that, but many people who stumble upon this post are ones (like me) who are experiencing same issue and are looking for solution. So I posted this just in case – Ach113 Dec 23 '19 at 19:42
  • Except that wasn't the issue the OP was having. They already posted their solution. And... this question, as written, isn't even on-topic for Stack Overflow anymore (the question would now fit on SuperUser). Guidelines were very different 9 years ago. – David Makogon Dec 23 '19 at 19:44