Computer help forum: System32\cmd.exe Runs on Startup

My favorite tools for looking for the causes are HIJACKTHIS and AUTORUNS. (use google to find them and discussions about use.)
Bob

Your answer was a big help. It saved me a reformat job.

As one can imagine, Google searching this turned up many different thoughts, ideas and mostly scares entertaining this command being a virus or a keylogger. No matter how dedicated we are to our diligence of browsing habits, pc protection and maintenance, we do, at times, wonder if something got 'slid past the goalie'.

For the last two weeks, I've been seeing this flash screen at startup for the c:\WINDOWS\system32\cmd.exe and was starting to wonder if this was an infection of some sort. Picking your advice spots on the internet can be as troublesome as the alleged trouble source you're seeking to fix. Thank goodness for Grif's post.

Alas, your directions were correct. It further completed the piece of the puzzle I was missing. I can only speak for myself but this startup screen was generated from an AMD Vision Driver Download update. I had recently upgraded to a larger video graphic card and ran the initial CD whereas two weeks ago (consistent with this flash startup problem) my first update was installed. It all made sense once you pointed me in the right direction. If you actually mouse over the full command line name in the UNCHECK window, you can see its full name and that AMD generated it. I unticked the startup box for c:\WINDOWS\system32\cmd.exe and no longer see it at startup.


Thank you, Grif.

I have the same problem he had. However when I go to msconfig, I see two c:\windows\system... I did attempt to update my video card, too. I'm working on my knowledge-base on computers. However I did not choose unclick either of the two boxes. They are: NeroCheck, and cftmon. I have an emachines P.C., I run XP, and updated my AMD 64 Athlon Video Card. Location for both are HKCU\SOFTWARE\Microsoft/Currentver...

NeroCheck has a location of HKLM\SOFTWARE\Microsoft\Windows\CurrentVer..., and cftmon has a location of HKCU\SOFTWARE\Microsoft\Windows\CurrentVer...

If there are two listings of "c:\WINDOWS\system32\cmd.exe" in "msconfig", then UNCHECK them both... Nero Check (part of Nero burning software) and "cftmon" which is part of MS Office probably aren't causing the issue you mention.. Still, it is possible you have spyware or viruses on the machine.. Be sure to run scans with a good anitivirus (a number are available and you haven't indicated which you are running) and spyware removal tool such as Malwarebytes or SuperAntispyware.

You may also need to check the registry at the two "run" locations to see if any inconsistencies are seen.

Hope this helps.

Grif

Hi, It is a kind of script writing by a third party.

Just do this to get rid of this

Start menu -Run-cmd and in the command prompt that opens type netsh winsock reset and it will reset the winsock. Just reboot to see that cmd.exe box appearing has gone. Hope this helps

Although this particular thread is quite old, your advice will NOT fix the issue that was originally posted.. Resetting winsocks tends to correct a faulty internet connection and allow a computer to join the net (such was NOT a problem stated by the posters above) but it won't fix a problem where a command window is loading at startup caused by the faulty program installations mentioned in their posts.

You might want to re-think your incorrect answer.

Hope this helps.

Grif

Hi,
I had this problem and after surfing thro the net, tried this command and it fixed the problem.. the fixes given in the microsoft is elaborate , but this solution at command prompt really saved me. I could not log on to my google account even when all the modem connectivity could be established. I got rid of the problem. The link is here pl
http://www.antionline.com/showthread.php?273632-cmd.exe-boxes-flashing-around-screen-on-startup/page2. Hope this helps the user

Difficulty connecting to the internet was NOT mentioned by the original poster and is not a normal consequence of seeing a command prompt at startup. Glad it solve your situation but logging on to the internet was not the original poster's, or any of the other's, issue. I'm glad it solved yours.

Unfortunately, that's the problem with jumping into an old thread which doesn't entirely fit your problem.

Hope this helps.

Grif

System32\cmd.exe Runs on Startup

by caseycoughlin - 4/24/11 7:35 AM

Hello all. I have an HP Mini laptop with Windows XP that when every time I start it, it runs c:\WINDOWS\system32\cmd.exe. How can I stop this from running on startup?

Theres nothing in the startup folder.

Thanks!
Casey
This is the thread to which i gave ananswer.Thank you

...in the original thread starter.....and no mention of internet connection problems which YOU had along with the command prompt popping up at startup.. The original poster had no such logon problems.... And there was also no mention of a malware issue by the original poster which is the underlying cause in the link you provided earlier.

By the way, you DID NOT reply to the original poster. You replied to ME, Grif Thomas, in your original response after I had answered questions by members in 2012 ... Your first post at the link below was approximately TWO YEARS after the thread started.

http://forums.cnet.com/7726-6122_102-5436170.html

So again, thanks for posting the information as it may help someone else, but as I said before, "Glad it solved your situation but logging on to the internet was not the original poster's, or any of the other's, issue. I'm glad it solved yours."

'Nuff said...

Grif

I have the same issue as caseycoughlin, namely c:\WINDOWS\system32\cmd.exe runs on startup. I am using Windows 7, 64 bit. I tried the solutions you suggested but in none of the places you mentioned, namely the startup tab under System Configuration or two HKey folders in the registry editor under ...\CurrentVersion\Run is there a c:\WINDOWS\system32\cmd.exe file which I can uncheck. Is there another way to find where the cmd.exe is kicking in? Thanks.

You said you can uncheck but never wrote you did. In fact, there is no reason for that entry at all so why didn't you remove it?
Bob

To clarify, there is no box to uncheck in any of the places mentioned by Grif, because the c:\WINDOWS\system32\cmd.exe file is not in any of those locations.

I'd start your own to avoid any confusion and if you can, click on my name and email the HIJACKTHIS log file for me to take a look.
Bob

Although there are lots of possibilities here, (Bob requested a Hijackthis log to verify), in the meantime, did you try the regular startup folder by clicking on the Start button, choose "All Programs", then click on the "Startup" folder listing.. Some of the programs that run at startup are listed there.. If you don't need them to run at startup, delete them and if the "...system32\cmd.exe" is listed there, remove it as well.

Checking for it at the locations below might help as well:

Your personal startup folder should be C:\Users\<user name>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

The All Users startup folder should be C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

Hope this helps.

Grif

Hi, Avorkink

Did you try my solution. It will work perfectly. Give it a try and then write to me. You have mentioned that you have the problem still. Try the solution first. I have given this reply as i had the problem and solved thro this command. How to know the kind of entries in the default winsock is not the concern. I am concerning only about the flashing of cmd exe.