Question CMD issue - Windows 10

[A.Essam]

Hey everybody,

Today i tried to open my PC and i was facing this problem that i have faced many years ago, back then i had to setup a new windows copy for it to be fixed, the problem is:

When i boot up the system, the CMD window appear for 1 second nothing major is written there, then it automatically minimize and stay for a split second and totally disappears, also with that, i tried to open CMD myself after booting the system, and the same thing happened i'm not able to stay in the CMD window and it does the same thing, flashes and close automatically

These are some photos of the problem i tried to capture while booting :

https://ibb.co/fNNQJyz

IMG-20220804-203052

Image IMG-20220804-203052 hosted in ImgBB

ibb.co

Side question : I searched about this problem the now and the first time, but none had a complete answer, so my question wether if this is a malware/virus of some kind, or this is a corrupted system files that lead to this happening, Thanks in advance.

 

[Colif]

Try this:

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

if it won't work in normal mode, try it in safe mode

1. go to settings/update & security/recovery
2. under advanced startup, click restart now button
3. this restarts PC in a blue menu
4. choose troubleshoot
5. choose advanced
6. choose startup options
7. click the restart button
8. choose a safe mode (it doesn't matter which) by using number associated with it.
9. Pc will restart and load safe mode

if you haven't before, try running trial of this on PC = https://www.hitmanpro.com/en-us

also possibly a start up program to blame
Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't physically remove anything, all it does is stops programs loading with windows at startup, easily reversed.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

 

[A.Essam]

Try this:

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

if it won't work in normal mode, try it in safe mode

1. go to settings/update & security/recovery
2. under advanced startup, click restart now button
3. this restarts PC in a blue menu
4. choose troubleshoot
5. choose advanced
6. choose startup options
7. click the restart button
8. choose a safe mode (it doesn't matter which) by using number associated with it.
9. Pc will restart and load safe mode

if you haven't before, try running trial of this on PC = https://www.hitmanpro.com/en-us

also possibly a start up program to blame
Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't physically remove anything, all it does is stops programs loading with windows at startup, easily reversed.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

Thank you, i'm trying it right now and will tell you what happened. Thanks

 

[A.Essam]

Try this:

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

if it won't work in normal mode, try it in safe mode

1. go to settings/update & security/recovery
2. under advanced startup, click restart now button
3. this restarts PC in a blue menu
4. choose troubleshoot
5. choose advanced
6. choose startup options
7. click the restart button
8. choose a safe mode (it doesn't matter which) by using number associated with it.
9. Pc will restart and load safe mode

if you haven't before, try running trial of this on PC = https://www.hitmanpro.com/en-us

also possibly a start up program to blame
Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't physically remove anything, all it does is stops programs loading with windows at startup, easily reversed.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

Hey,

Soo, i tried all those options, none of them worked for me unfortunately, and i tried to do a full scan using my antivirus (Norton), in safe mode, and nothing showed up, are there any recommendations?

Also, i was considering downloading this application called (rkill) supposedly it is a malware removal tool, but i haven't hear of it before, so i was asking for your opinion on it.

Thanks in advance.

 

[Colif]

you could try it but hitman pro should have found anything if you had anything

https://www.majorgeeks.com/files/details/rkill.html

did the cmd window show in safe mode?

I assumer this isn't it - https://forums.tomshardware.com/threads/command-prompt-after-logon-screen.3587303/

 

[Colif]

see the answer here for the mode 20,5 thing CMD is showing - https://superuser.com/questions/571...rnal-or-external-command-operab/571717#571717

 

[A.Essam]

No it didn't, the same problem that happened in normal windows happened in safe mood, with CMD flashing at the start of booting and whenever i try to open CMD on my own, it flashes and closes as before.

 

[Colif]

did you see my last answer? did that help?

 

[A.Essam]

see the answer here for the mode 20,5 thing CMD is showing - https://superuser.com/questions/571...rnal-or-external-command-operab/571717#571717

Yes, i checked this one a minute ago and i had this autorun with a different name than shown in this article, it was
Mode 20,5 soundmixer, as shown in the picture :
https://ibb.co/Jmy0ZWK

Do i delete it as they say?

 

[Colif]

malware

Try the advice here: https://answers.microsoft.com/en-us...-problem/cefbcd06-edcb-4388-bf8b-52d21e61d6e5

show screenshots of results.

what anti virus do you have?

could try running https://www.bitdefender.com.au/solutions/free.html and see if it finds anything.

seems its a cryptominer

https://www.file.net/process/soundmixer.exe.html

 

[A.Essam]

malware

Try the advice here: https://answers.microsoft.com/en-us...-problem/cefbcd06-edcb-4388-bf8b-52d21e61d6e5

show screenshots of results.

what anti virus do you have?

could try running https://www.bitdefender.com.au/solutions/free.html and see if it finds anything.

seems its a cryptominer

https://www.file.net/process/soundmixer.exe.html

I downloaded autoruns installed and i searched for CMD in the filter as was described, here it is in a screen shot

https://ibb.co/G72KkpP

Another thing caught my mind, is that the thing written in the autorun in registry was written in the autoruns and had the same 20,5 description, as shown in the screenshot.

https://ibb.co/X7ThpMr

 

[A.Essam]

malware

Try the advice here: https://answers.microsoft.com/en-us...-problem/cefbcd06-edcb-4388-bf8b-52d21e61d6e5

show screenshots of results.

what anti virus do you have?

could try running https://www.bitdefender.com.au/solutions/free.html and see if it finds anything.

seems its a cryptominer

https://www.file.net/process/soundmixer.exe.html

I have norton premium version as my anti-virus, i don't know how did this happen, but do you advice me to download

Hitmanpro, malwarebytes pro, or bitdefender, so i can go ahead with it now?

 

[Colif]

with the entries in the Image hijacks area, right click them and select check Virustotal

I don't have anything in that section so all 3 are suspect.

Also, if you untick them they shouldn't run with windows and show at startup... but better to remove them.

i would use bitdefender free over norton.

 

[A.Essam]

with the entries in the Image hijacks area, right click them and select check Virustotal

I don't have anything in that section so all 3 are suspect.

Also, if you untick them they shouldn't run with windows and show at startup... but better to remove them.

i would use bitdefender free over norton.

I tried disabling both of them as you mentioned, to make sure that they are the problem and when i tried to reboot the system. the cmd froze instead of flashing and letting me use the device, as shown in the screenshot :

https://ibb.co/jJqmPHZ

It doesn't go away, and i'm froze in the same position, are there any solutions?

 

[Colif]

I would try safe mode.

is that after the logon screen?
if so, on logon screen, click the power button
while holding left shift, click restart button
this opens windows in a blue menu

1. choose troubleshoot
   
2. choose advanced
   
3. choose startup options
   
4. click the restart button
   
5. choose a safe mode (it doesn't matter which) by using number associated with it.
   
6. Pc will restart and load safe mode
   

hopefully error doesn't repeat.

If both are stuck
restart PC and retrace steps to blue menu
choose troubleshoot
choose advanced
choose system restore.
Hopefully a recent date you can roll back to, that will reset startup so the error is back again, but it doesn't freeze.

I wasn't expecting it to freeze like that.

 

[Colif]

We need to remove virus, no point just trying to stop it.

 

[A.Essam]

I would try safe mode.

is that after the logon screen?
if so, on logon screen, click the power button
while holding left shift, click restart button
this opens windows in a blue menu

1. choose troubleshoot
2. choose advanced
3. choose startup options
4. click the restart button
5. choose a safe mode (it doesn't matter which) by using number associated with it.
6. Pc will restart and load safe mode

hopefully error doesn't repeat.

If both are stuck
restart PC and retrace steps to blue menu
choose troubleshoot
choose advanced
choose system restore.
Hopefully a recent date you can roll back to, that will reset startup so the error is back again, but it doesn't freeze.

I wasn't expecting it to freeze like that.

Will do that, and will get back to you, hopefully it works :fingers crossed:

 

[A.Essam]

Heyy, So I think the issue is kinda fixed, here is what I have done, if someone else is having the same problem.

So First of all, thanks @Colif for the continuous help.

Second of all, what I did is that I searched for a recovery point and recovered to it, so I can access the device after I was locked out of the device due to CMD freezing on startup, So what I came out of this experience is that deleting/disabling the malware from regedit or autoruns, may cause the CMD to freeze at startup, blocking you from using the actual system.

After that, I downloaded Malwarebytes the free trial version, and I started a full scan on all drives, it took a lot of time to scan, and it didn't even finish, it was so slow, but the upside is that it caught the malwares in the first hour or so, after 17 hours of scan using Malwarebytes, I had to terminate the scan, and fortunately i was able to quarantine the malware after terminating the scan, so I did, and i rebooted the device and it was okay.

My question here, is how is possible that when i made a full system scan using a well-known software as Norton life lock 360, nothing showed up/detected, and i had to download a third party anti-virus as Malwarebytes, that apparently fixed the issue.

Also, the second question, is am I good to go, or should I give my system a format still? and how to know if I'm good to go?

 

[Colif]

So what I came out of this experience is that deleting/disabling the malware from regedit or autoruns, may cause the CMD to freeze at startup, blocking you from using the actual system.

My mistake for telling you to stop them in autoruns, I should have known a virus wouldn't like that.

After that, I downloaded Malwarebytes the free trial version, and I started a full scan on all drives, it took a lot of time to scan, and it didn't even finish, it was so slow, but the upside is that it caught the malwares in the first hour or so, after 17 hours of scan using Malwarebytes, I had to terminate the scan,

How many drives do you have on your PC? I never did ask what your PC was, it wasn't really necessary knowledge for a software problem.
17 hours scan of malwarebytes? that seems way too long. But then I can find 10 hours and one guy had 150+ hours, so it can depend how many files you have.

My question here, is how is possible that when i made a full system scan using a well-known software as Norton life lock 360, nothing showed up/detected, and i had to download a third party anti-virus as Malwarebytes, that apparently fixed the issue.

Norton isn't what I would use. They haven't been one of the better ones for years, they just appear to be offered free with everything so its why they well known.
I don't trust any AV company that includes a crypto miner in their software - https://support.norton.com/sp/en/aa/home/current/solutions/v138473899

Its why I suggested Bitdefender as its ability to identify viruses is much better than Nortons. Bitdefender & Kaspersky are often rated in top 3 of Virus scanners. Due to a current conflict, many steer away from Kaspersky.

Also, the second question, is am I good to go, or should I give my system a format still? and how to know if I'm good to go?

I don't know. You stopped scan before it finished, so we don't know if its fixed everything. I would run it again and just let it finish
or you can run it on one drive at a time - just right click a drive in file explorer and choose malewarebytes scan. Can reduce amount of resources it uses.

Its probably gone since you quarantined it. I would just run a scan of C drive to be sure.

 

[A.Essam]

My mistake for telling you to stop them in autoruns, I should have known a virus wouldn't like that.

It's okay, you helped a lot though fr, thanks.

How many drives do you have on your PC? I never did ask what your PC was, it wasn't really necessary knowledge for a software problem.
17 hours scan of malwarebytes? that seems way too long. But then I can find 10 hours and one guy had 150+ hours, so it can depend how many files you have.

I have 1tb HDD, split into 3 drives, I think this was the problem with the long time.

Norton isn't what I would use. They haven't been one of the better ones for years, they just appear to be offered free with everything so its why they well known.
I don't trust any AV company that includes a crypto miner in their software - https://support.norton.com/sp/en/aa/home/current/solutions/v138473899

Its why I suggested Bitdefender as its ability to identify viruses is much better than Nortons. Bitdefender & Kaspersky are often rated in top 3 of Virus scanners. Due to a current conflict, many steer away from Kaspersky.

I see that, but the thing that is making me wonder, is that i searched for a lot of comparing services and videos, to come up with a good understanding of which app is capable of which things, and 90% of the time the reviewer/article, suggest Norton over all of them, with Bitdefender as the second as you mentioned, so this is why I was wondering, how Norton's scan rate for malwares is 9/10 comparing to Malwarebytes that is rated 5/10 in malware detection and still caught it and Norton didn't.


Sorry, Another question. If I used an antivirus in this case Malwarebytes and I quarantined the malware using this application, after that I deleted the anti-virus software in this case Malwarebytes, does the Malware escape again into the system? or quarantine is equivalent to deleting the Malware file?

 

[Colif]

how old is your computer? 1tb hdd shouldn't take that long to scan. How full is it?

I see your point about Norton, short search shows it as 2nd on a few charts. Its also a question of knowing who to trust. Some sites are nothing more than adverts.
Norton not as high on this test - https://www.av-test.org/en/antivirus/home-windows/

Sorry, Another question. If I used an antivirus in this case Malwarebytes and I quarantined the malware using this application, after that I deleted the anti-virus software in this case Malwarebytes, does the Malware escape again into the system? or quarantine is equivalent to deleting the Malware file?

Quarantined items remain in quarantine even after uninstall. If you did a clean uninstall using the MB-Clean.exe tool then the quarantined items would have been removed/deleted. The only way a previously quarantined item gets restored is if you visit the Quarantine tab in Malwarebytes and deliberately restore the item yourself.

What happens to quarantined items after uninstall?

I recently uninstalled Malwarebytes 3, but a few days before that, I did a Threat Scan and it found a threat (called Trojan-something...) so I quarantined it. Then I forgot about it, and uninstalled Malwarebytes 3, and re-installed it. I did another Threat Scan and no threats were detected. So my...

forums.malwarebytes.com

 

[A.Essam]

how old is your computer? 1tb hdd shouldn't take that long to scan. How full is it?

I see your point about Norton, short search shows it as 2nd. Its also a question of knowing who to trust.
Norton not as high on this test - https://www.av-test.org/en/antivirus/home-windows/

What happens to quarantined items after uninstall?

I recently uninstalled Malwarebytes 3, but a few days before that, I did a Threat Scan and it found a threat (called Trojan-something...) so I quarantined it. Then I forgot about it, and uninstalled Malwarebytes 3, and re-installed it. I did another Threat Scan and no threats were detected. So my...

forums.malwarebytes.com

Yes it is quiet an old build, it is 2011 build.

 

[Colif]

it could be fixed. All you can do is wait and see if you get other weird problems.

If you do, I would clean install windows to make sure its gone.

 

[A.Essam]

it could be fixed. All you can do is wait and see if you get other weird problems.

If you do, I would clean install windows to make sure its gone.

Will do, Thanks alot!