Windows 7: Old version of command prompt and cannot run scannow

jtkm · 07 Apr 2013

Greetings!
I found this forum because of multiple, random BSOD screens related to athr.sys
BSOD at random intervals arthr.sys?

Now when I open the comand prompt, the version is old, I have it - but without the capacity to
'Run as Administrator'. And I still cannot run scannow.

UsernameIssues · 07 Apr 2013

While we are waiting for a trained malware expert to help you, please consider running a full scan via WDO:
What is Windows Defender Offline?

Also, could you post a screenshot of the cmd prompt window that you see:
Screenshots and Files - Upload and Post in Seven Forums

::goes back to lurking::

Anak · 07 Apr 2013

Until you get this straightened out, you should be seeing C:\Users\(Your user name)> at your unelevated CMD prompt.

At the end of that prompt, type/copy/paste: cd\Windows\system32 then touch enter or return.

You should then see: C:\Windows\System32> which is the elevated CMD prompt.

Information

The elevated CMD resides in the System 32 folder as C:\Windows\System32\cmd.exe

The cd\ CMD signifies Change Directory, and Windows\System32 tells windows where to look.

Going to C:\Windows\System32\, and left clicking on cmd.exe should also result in an elevated prompt.

I be interested to know if you do go to C:\Windows\System32\, if you right click on cmd.exe; would "Run as Administrator" be in that context menu?

Code:

C:\Users\(Your user name)>cd\Windows\system32

Touching enter or return results in:

C:\Windows\System32>

EDIT:

jtkm, I have posted a link to this thread back at BSOD at random intervals arthr.sys?

jtkm · 07 Apr 2013

THANKS for the f/u to this thread and please tell me if you want to take the discussion back to the OT - I'm here because I was redirected here.

To open an unelevated command prompt I go to start/programs/accessories

To get to the elevated prompt I type 'command prompt' into the search bar - the only way I can get to it.

Screenshots attached.

I did run an offline Windows Defender - a short scan reveals a clean system

Anak · 08 Apr 2013

Quote: Originally Posted by jtkm

THANKS for the f/u to this thread and please tell me if you want to take the discussion back to the OT - I'm here because I was redirected here.

Your welcome.

No we can stay here. I believe you were redirected here so as not to distract attention from your problem in the other thread.

By the way.... Is f/u shorthand for follow up?

Quote: Originally Posted by jtkm

To open an unelevated command prompt I go to start/programs/accessories

To get to the elevated prompt I type 'command prompt' into the search bar - the only way I can get to it.

So you can get to an elevated prompt, but it doesn't look right, it looks like an older x86 version?

Reference to Noel's post about an odd CMD prompt: BSOD at random intervals arthr.sys?

Quote: Originally Posted by jtkm

Screenshots attached.

I did run an offline Windows Defender - a short scan reveals a clean system

I must apologize, when I made my earlier post I thought you were only having trouble reaching an elevated CMD prompt and didn't realize this thread tied into your other thread.

I'm going to ask one of our malware gurus to take a look at both threads to get some history of what's going on, but in the meantime I would like you to see this post in this thread: Windows Firewall Disabled Code 5
And only follow the instructions to download and run the Farbar Service Scanner then post the results (FSS.txt file) here in this thread.

cottonball may also want you to download and run Windows Repair, but we'll leave that up to him, he has more experience with that utility than I do.

cottonball · 08 Apr 2013

jtkm,

Per Anak's instructions:

Quote:

...in the meantime I would like you to see this post in this thread: Windows Firewall Disabled Code 5
And only follow the instructions to download and run the Farbar Service Scanner then post the results (FSS.txt file) here in this thread.

Please post an updated Farbar Service Scanner, and, at this time, please do not use Windows Repair.
If used, we may need additional options that were not presented on the thread referenced.

>>Also if you ran TDSSKiller, by default, the tool outputs its log to the disk with the Windows operating system, normally C:\).

Logs have a name like:
C:\TDSSKiller.X.X.X_08.04.2012_15.31.43_log.txt (X = a number)

Please, also provide this log in your reply.

jtkm · 08 Apr 2013

YES, "f/u" = "follow up"

Both FSS and TDSS killer find nothing.
as a BTW, the firewall IS working again as is WUpdate which automatically launched itself this morning
even though it wouldn't launch for me the other day.

Farbar Service Scanner Version: 03-03-2013
Ran by BuddhaT00 (administrator) on 08-04-2013 at 17:20:00
Running from "C:\Users\BuddhaT00\Desktop"
Windows 7 Starter Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

Kaspersky TDSS killer log attached - it was too long to paste.

cottonball · 08 Apr 2013

jtkm,

Hmmmm...so far, so good.

Let's see what your system shows with the following short scan...

Please download RogueKiller:
Tlcharger RogueKiller (Site Officiel)

When you get to the website, go to where it says:
(Download link) Lien de téléchargement:

Select the version for your 32-bit system. (The button without x64.)
Click the dark-blue button to download.
Save to the Desktop.

Close all windows and browsers.

Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the Desktop: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

Anak · 08 Apr 2013

Lurking and learning guys. I'll stay outa' your way unless I have a question.

whs · 08 Apr 2013

If I understood your initial question right, you cannot run cmd as admin. Did you try to run it from the system32 folder? The path is:

C: > Windows > System32 > cmd.exe > right click on that