cmd.exe returns control early (asynchronous? detached?)

  • Thread starter Thread starter Mark Hanford
  • Start date Start date
M

Mark Hanford

I have a user who has reported strange occurences with a logon batch file
that he needs to run to activate VPN connections and the like.
The script is a simple set of 4 pings and some "net use" statements that run
to "wake up" the VPN tunnels required.

Symptoms:
The script seems to be running the first command then terminating.
Running cmd from the Run dialog pops up then immediately dissapears
Running command from the Run dialog starts a command prompt
Once in command.com, commands seem to be running asynchronously, such as
when a linux command is run with &. I can, for example start a ping -t
somewhere.com and start getting responses, but my C:> prompt returns after
the first result, and if I then enter "dir /s" for example, I see the output
of the ping interspersed with the output from the dir.

This is most strange behavious, any clues as to the reason would be most
welcome :)

Many thanks

Mark Hanford
 
Mark Hanford said:
I have a user who has reported strange occurences with a logon batch file
that he needs to run to activate VPN connections and the like.
The script is a simple set of 4 pings and some "net use" statements that run
to "wake up" the VPN tunnels required.

Symptoms:
The script seems to be running the first command then terminating.
Running cmd from the Run dialog pops up then immediately dissapears
Running command from the Run dialog starts a command prompt
Once in command.com, commands seem to be running asynchronously, such as
when a linux command is run with &. I can, for example start a ping -t
somewhere.com and start getting responses, but my C:> prompt returns after
the first result, and if I then enter "dir /s" for example, I see the output
of the ping interspersed with the output from the dir.

This is most strange behavious, any clues as to the reason would be most
welcome :)

Many thanks

Mark Hanford
Click to expand...

A few observations:
- Please paste your batch file here.
- You seem to be unsure about the command processor you
run. Sometimes you say "cmd", and sometimes you say "command.com".
Which one is it? Why command.com?
- What happens when you start a Command Prompt (by
typing "cmd.exe" into the Run box, then type this line:
\\YourServer\Netlogon\SomeBatchFile.bat
 
Pegasus (MVP) said:
A few observations:
- Please paste your batch file here.
- You seem to be unsure about the command processor you
run. Sometimes you say "cmd", and sometimes you say "command.com".
Which one is it? Why command.com?
- What happens when you start a Command Prompt (by
typing "cmd.exe" into the Run box, then type this line:
\\YourServer\Netlogon\SomeBatchFile.bat
Click to expand...

Hmmm, seems I was a little unclear, sorry. I may have provided to much
"circumstantial" information.
The batch file is largely irrelevant, as I can reproduce the symptoms
manually using just about any other dos commands.
I was quite sure about the command processor; I used cmd first (as usual),
which starts and then dissapears immediately, and then I tried command,
which stays open but exhibits this strange asynchronous behaviour.

Typing "cmd.exe" into the Run box does (as I said above) almost nothing.
The DOS-box appears very briefly then goes away, so I can't run
\\anything\anywhere.
Incidentally, the batchfile is local, but again, that doesn't matter.

Basically, individual commands entered will work fine, although you get
control back as soon as pressing Enter instead of when the command ends. So
a long-running command like a traceroute will start okay, and you will see
results as expected, but I get a C:\ prompt almost straight away and I can
start entering more commands before the trace completes, with the output of
that command intermingled with the trace responses.

thanks,

Mark
 
If you add the /k switch, i.e.,"cmd /k", the command prompt window will remain
open until you enter "exit".
 
Eric McG said:
If you add the /k switch, i.e.,"cmd /k", the command prompt window will remain
open until you enter "exit".
Click to expand...

No it won't :( tried that - I know it "should" do that, but it doesn't.
But then again, just putting cmd into the Run box shouldn't terminate
either - the /k shouldn't be required.
 
If Taskmanager and Regedit also close immediately I'd say you've got a
trojan running.
 
Mark said:
No it won't :( tried that - I know it "should" do that, but it doesn't.
But then again, just putting cmd into the Run box shouldn't terminate
either - the /k shouldn't be required.
Click to expand...

You might want to look in the registry at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun

There might possibly be something bogus in there causing cmd.exe to close.
 
In said:
If Taskmanager and Regedit also close immediately I'd say you've
got a trojan running.
Click to expand...

Concur. OP should A-V, A-T scan and also confirm the cmd.* file
that is actually being run.
 
Interesting. The user in question is a contractor and is not using our
corporate AV product (McAfee) but is using (I think) Norton Desktop
Security.
I have checked with him, and Taskmanager did indeed appear and then close
too. I shall "pull his plug" asap and get him to rescan his system.

A most curious symptom with regard to the CLI seemingly running asynch
though.

Many thanks,

Mark Hanford
 
Very welcome, hope he nails down the problem.

Mark said:
Interesting. The user in question is a contractor and is not using our
corporate AV product (McAfee) but is using (I think) Norton Desktop
Security.
I have checked with him, and Taskmanager did indeed appear and then close
too. I shall "pull his plug" asap and get him to rescan his system.

A most curious symptom with regard to the CLI seemingly running asynch
though.

Many thanks,

Mark Hanford
Click to expand...
 
Hehe - if he doesn't I'll have to nail him down...

He's currently running a full scan using Norton AV, it's found one virus
(doesn't say which one yet, I think it might at the end of the scan).
Hopefully the software will enable him to clean the beast out. At least
with a name I can find out the proper removal instructions.

Mark Hanford
 
Back
Top