Search code examples
windows-7-x64sysinternals

CMD.exe closes immediately after calling (Win7 64)


Has anyone found such behavior when Command Processor (cmd.exe) closes immediately after calling it? I’ve run McAfee AV and Windows System File Check (sfc.exe) and nothing wrong was detected, I’ve even copied cmd.exe file from other win 7 machine and it is still working same way. Strangest thing is – on the windows 7 64 there is also 32 bit version of that file which works perfectly normal.

SysInternals Process Monitor shows that cmd.exe process ends with exit code 0x0... o_O

Also calling commands directly from start menu, like ping, works normal…

Maybe that question is not strictly related to coding but that issue holds me from doing many things related to actual application development and environment check.


Solution

  • Answering all questions:

    • superuser, safe mode, run as admin, changing ownership and permissions - didn't help
    • I was calling by menu start as well as d-clicking cmd.exe with same result,
    • No virsus either malware found by today's scanning with McAfee, Anti-malware, MS Malicious removal... etc

    Finally I got it SOLVED:

    • Run regedit
    • Go to HKLM\Software\Microsoft\Command Processor\ or HKEY_CURRENT_USER\Software\Microsoft\Command Processor\ or HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\

    • For some reason there was AUTORUN key with "EXIT" inside.

    • Remove the AutoRun key and everything should went back to normal.
    • CMD.exe should start to work again.

    Also,

    In some cases, the Command prompt is also opening on Startup, which is when the above solution is applied hangs the system on Command prompt when you logon.

    This can be fixed by using Autoruns, where you need to disable command prompt startup registries on Logon/Startup tab. (there can be more than one entries)

    That one also explains why exit code was 0x0.

    Have no idea what kind of thing set that key up... McAfee showed some activity lat week and I've noticed it last Friday.

    Hope these symptoms and my answer will help someone in future