After scan reboot returns c:\windows\system32\command.com the parameter is incorrect

[petesj1]

After performing scan, it reported that certain items could not be fixed and asked if it could run after reboot. The system was rebooted and now it reports error:
c:\windows\system32\command.com

The parameter is incorrect. Clicking it keeps report error message over and over. The system never really goes beyond that point.

[techofterror]

this is also happening to me. This is the second incident where after a scan has fixed problems this error occurs. Does anyone have any suggestions as to why this is happening or a fix?

[cr4zyl3gs]

this has also happened to me. can we know somethink about this ASAP as i am in dire need of my computer.

[md usa spybot fan]

Log on to the system in safe mode. Start regedit. Navigate to the following registry key and see if there is an entry with "c:\windows\system32\command.com ..." in the data portion of the entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
If there is, please copy down the entry (or export it) and then delete the entry. Restart your system in normal mode.

If you found the entry described above, please post what you found.

If there was no entry please post what Windows OS you are running and if you can remember what you were fixing, please post that.

[cr4zyl3gs]

I have just tryed what the above post said to do and i am not haveing any joy. I cant even boot up safe mode its just crashing all the time. Have you any other ideas? what do you think that the problem is? Does it look like i will have to format?

my specs:

EVGA 680i mobo
8800 GTS nividia grapics card
2GIG Crucial Balistics RAM
Q6600 2.4gig CPU
Samsung 300GIG Harddrive
Windows XP SP2

Other softwere

Xfire
Zango
Ventrillo 3.1.2 version
AVG (free edition)

I literly cant use my computer as my computer seems to have locked down in a way i cant open anything at all.

if you guys need more help just post and ill reply :)

I hope this helps sort the problem
I hope this helps

[Tom.K]

Other softwere

Xfire
Zango
Ventrillo 3.1.2 version
AVG (free edition)

Zango is an adware.

Info (From Spybot-S&D)

Functionality: Zango is labeled adware that enables access to more Zangocontent and software.

Privacy: While Zango Software is installed on your computer it generates logs of your web browsing activity, including web pages you have visited and the order in which you visited these pages. These logs may be uploaded to Zango’s servers, along with an anonymous user ID assigned to the Zango Software installed on your computer (your “Anonymous User ID”). These logs and your Anonymous User ID are referred to collectively as “Usage Data.” Zango may use Usage Data for market research purposes and to provide you with content specifically targeted to your interests at times when we think the content is most relevant. Zango may store Usage Data on our servers, for our use, and may aggregate Usage Data from these logs and share the aggregate data with third parties. The Zango Software will also put a "cookie" on your machine so that we are able to recognize you and display appropriate targeted websites. A cookie is a small amount of data that Zango’s servers transfer to your browser and that only Zango’s servers can read.

Description: during installation zango used to connect to bis.180solutions.com to access updates, this happened without user consent. The checkbox to agree to the EULA is already preselected.
There is no common way to disable zango once it is installed, the user cannot configure its behaviour. It is added to system start and cannot be disabled through a common interface or context menu. An uninstallation via add/remove from windows system settings is possible but usually leaves a registry key on the computer. Also AFTER successful uninstall, zango tries to connect to a zango server for statistical analysis on uninstalls. A deactivated internet connection used to impair uninstall procedure 180Solutions is not to be trusted.

[md usa spybot fan]

cr4zyl3gs:

I am not sure that I have even diagnosed the cause of the problem correctly. Since you apparently have access to another system, is there a way the you can mount the primary hard drive from the affected system as a slave on the another system, in a USB enclosure, etc., so that we can take a look at the registry and see if what I suspect is actually the cause of the problem?

[techofterror]

I am still having the issues above, but now i cant even boot into safe mode at all. I can also pull the drive and slave to another pc if needed. Tell me what i need to do for you guys to be able to look at the registry on this drive.

[md usa spybot fan]

techofterror:

What Windows OS were you running on the system that you can't boot and what Windows OS are you running on the system where you can mount the master drive from that system as a slave or USB device?

Note: I have PMed Yodama (http://forums.spybot.info/member.php?u=223) (Team Spybot member) with the following:

New problem rebooting systems after attempted fix

Yodama:

Perhaps you would like to take a look at the following thread:
After scan reboot returns c:\windows\system32\command.com the parameter is incorrect
http://forums.spybot.info/showthread.php?t=31907

Added with edit:

I received a response from Yodama (http://forums.spybot.info/member.php?u=223):


Re: New problem rebooting systems after attempted fix

thank you for the note md usa spybot fan,
we are going to have a look at this

[Yodama]

hello,

I think that md usa spybot fans did diagnose the symptoms of this issue correctly.
But there appears to be an issue with the command.com and/or the cmd.exe on the affected computers.

Let's try another approach to eliminate the symptoms of this issue:

boot the computer normally
when the first error messages about the command.com appear open the taskmanager with ctrl+alt+del and then choosing the taskmanager
terminate the explorer.exe
then choose file - new task
enter the path to Spybot S&D (default: c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe) to start Spybot S&D
switch to advanced mode
navigate to tools - system startup
click the export button and save the startup report file to a location you can easily find later
remove all Spybotdelete entries from the startup list
within Spybot S&D (Processlist) terminate the remaining instances of command.com and cmd.exe (ntvdm.exe) and close the error message windows if they are still present ( you can mark multiple entries while holding the shift and/or ctrl key and terminate them together)
from the Taskmanager choose File - new task and enter explorer to restart the explorer
attach the startup report file you saved ealier to your next post


We will require the startup report file to diagnose the cause of this issue. We may also require a complete log file later.

[ccobbold]

I was having issues logging in to my Windows XP operating system following a large update from Spybot (my PC has not been in use for the last 18 months+) & an update of the Windows Service Pack (to v2 I believe). Each time I tried to log in I was confronted by a system32 command message saying the parameters were incorrect. Given that I could not get into the system (due to these messages preventing me) I followed the instructions one of the Spybot team had given to another poster suggesting you go into the task manager, the Spybot advanced user setting & delete the Spybot entries from the list (and as such am now able to use the system). I saved the start-up Spybot list as suggested by one of the members of the team so that I could send it to you for review but the attachment is too large for the forum I have been told.

Please can you let me know who I could send this attachment to for review and advice in terms of the best way forward?

Thanks in advance for your assistance.

[evelone]

I did exactly what you, Yodama, said and it worked. After unchecking all of the Spybotdelete entries I rebooted my computer and when it came back up it ran Spybot in blind user mode. Afterwards I didn't have any problems at all. I am convinced that removing Zango caused the issue. After I rebooted, Zango, and the command.exe screen were gone.

Thanks.......

I will make my startup report my next post because it is too big for one entry.



hello,

I think that md usa spybot fans did diagnose the symptoms of this issue correctly.
But there appears to be an issue with the command.com and/or the cmd.exe on the affected computers.

Let's try another approach to eliminate the symptoms of this issue:

boot the computer normally
when the first error messages about the command.com appear open the taskmanager with ctrl+alt+del and then choosing the taskmanager
terminate the explorer.exe
then choose file - new task
enter the path to Spybot S&D (default: c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe) to start Spybot S&D
switch to advanced mode
navigate to tools - system startup
click the export button and save the startup report file to a location you can easily find later
remove all Spybotdelete entries from the startup list
within Spybot S&D (Processlist) terminate the remaining instances of command.com and cmd.exe (ntvdm.exe) and close the error message windows if they are still present ( you can mark multiple entries while holding the shift and/or ctrl key and terminate them together)
from the Taskmanager choose File - new task and enter explorer to restart the explorer
attach the startup report file you saved ealier to your next post


We will require the startup report file to diagnose the cause of this issue. We may also require a complete log file later.

[Yodama]

hello,

thank you for you positive feedback.
If the report is too large you can also sent it to detections@spybot.info with a reference to this thread.

[advyon]

I had this exact same problem, and I know what caused it for me. After removing Zango, Spybot had 253 deletions it wanted to do. Instead of getting all the popups on a slow computer, I decided to delete the directory that spybot was deleting and restart. Once I restarted, Spybot had it set to delete the files that I had already deleted, hence the improper parameter at startup.

I hope this helps. Also, is it possible to put in an accept all in these situations? I certainly didn't want to click agree to 300 popups.

[beautymaster]

thank you so much, finally this is all done over with. I a run in with windows/system32/command, and besides all my efforts to get eliminate it, nothing was able to detect it.... i followed yodama's directions and it worked instantly. here is the spyboot SD report from my computer:

--- Spybot - Search & Destroy version: 1.6.0 (build: 20080707) ---

2008-07-07 blindman.exe (1.0.0.8)
2008-07-07 SDFiles.exe (1.6.0.4)
2008-07-07 SDMain.exe (1.0.0.6)
2008-07-07 SDShred.exe (1.0.2.3)
2008-07-07 SDUpdate.exe (1.6.0.8)
2008-07-07 SDWinSec.exe (1.0.0.12)
2008-07-07 SpybotSD.exe (1.6.0.30)
2008-09-16 TeaTimer.exe (1.6.3.25)
2008-08-05 unins000.exe (51.49.0.0)
2008-07-07 Update.exe (1.6.0.7)
2008-07-07 advcheck.dll (1.6.1.12)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2008-09-15 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2008-07-07 Tools.dll (2.1.5.7)
2008-09-02 Includes\Adware.sbi
2008-10-27 Includes\AdwareC.sbi
2008-06-03 Includes\Cookies.sbi
2008-09-02 Includes\Dialer.sbi
2008-09-09 Includes\DialerC.sbi
2008-07-23 Includes\HeavyDuty.sbi
2008-09-02 Includes\Hijackers.sbi
2008-10-28 Includes\HijackersC.sbi
2008-09-09 Includes\Keyloggers.sbi
2008-10-28 Includes\KeyloggersC.sbi
2004-11-29 Includes\LSP.sbi
2008-10-28 Includes\Malware.sbi
2008-10-28 Includes\MalwareC.sbi
2008-09-02 Includes\PUPS.sbi
2008-10-28 Includes\PUPSC.sbi
2007-11-07 Includes\Revision.sbi
2008-06-18 Includes\Security.sbi
2008-10-23 Includes\SecurityC.sbi
2008-06-03 Includes\Spybots.sbi
2008-06-03 Includes\SpybotsC.sbi
2008-10-28 Includes\Spyware.sbi
2008-10-29 Includes\SpywareC.sbi
2008-06-03 Includes\Tracks.uti
2008-10-29 Includes\Trojans.sbi
2008-10-29 Includes\TrojansC.sbi
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
size: 34672
MD5: 69B16C7B7746BA5C642FC05B3561FC73

Located: HK_LM:Run, avast!
command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

[alexthe]

Hello everyone. I had this problem yesterday and I tried to follow the instructions for fixing this posted earlier by Yodama. But when I got to the following instruction I got stuck:

"remove all Spybotdelete entries from the startup list"

The problem was that there were many, many Spybotdelete entries in the startup list. I think there were several hundred, perhaps even thousands of such entries. And I could not find any way to do a "SELECT ALL" and do a multi-delete. It looked like you could only delete one entry at a time. It would have taken me hours to do that. It was just not a practical solution - especially since I wasn't sure if all my hours of labor would actually pay off. So that is where I got stuck. I tried one other thing - rebooting in Safe Mode and uninstalling Spybot to see if I could get past the error on command.com problem but this did not work either. So in the end, I had no choice but wiping everything out and reinstalling XP from a Restore disk. I am just curious of Yodama or anyone else has any further information about how to recover from a problem like this. I have used Spybot for years and never ran into this. This happened when I first installed Spybot on a friend's computer last night. It was very embarassing to have to tell her that I just trashed her computer after trying to help her get rid of spyware with Spybot.

Alex


I did exactly what you, Yodama, said and it worked. After unchecking all of the Spybotdelete entries I rebooted my computer and when it came back up it ran Spybot in blind user mode. Afterwards I didn't have any problems at all. I am convinced that removing Zango caused the issue. After I rebooted, Zango, and the command.exe screen were gone.

Thanks.......

I will make my startup report my next post because it is too big for one entry.

[precision06]

boot into safe mode and access regedit.
Navigate to the following registry key and see if there is an entry with "spybot delete c:\windows\system32\command.com ... or similar.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
and also check
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

delete all entries and reboot

Just had a system with 28440 hits which then returned the command.com error. After removing from local machine it still produced the same error until i also removed them from current user.
Cheers

[Toms_94]

Ok this worked for me too. It did take about 20 minutes to go through the list and uncheck all the Spybotdelete entries, but after I did, the machine would boot back up.

One thing here, I don't know if anyone else noticed, but this issue is only consistant with "Administrators" rights holders. This machine that I am working on had five users, three admins and two limited accounts. The machine would hang only on the admins, logging in as one of the limited account users the machine would run properly. I couldn't do anything in either account to alleviate the problem but the issue is only with administrator rights holders.

Does this info help with troubleshooting the problem?

I am now re-running Spybot and it hasn't come across Zango, but if it does should I go ahead and allow removal?

[gromit]

AN EASY SOLUTION THAT LUCKILY WORKED FOR ME

I experienced this problem yesterday when installing Spybot S&D 1.6 on a friend's computer that appeared to have a browser hijack (Google results all redirected to a shopping page). The scan came back with multiple infections including Virtumonde, Zlob Downloader, Windows security bypass to name a few. Zango was also there. 622 issues altogether. When I click "fix selected problems", I received the message saying "may Spybot run again after rebooting?" I agreed and on rebooting had the fatal "command.com parameter incorrect" message as well a similar issue with cmd.exe.

My observations were:
1) Could boot OK in Safe mode
2) Initially impacted only Adminstrator accounts, may have changed after several reboots to affect all accounts
3) When booting in non-safe mode, initial welcome screen came up OK, you could select the account, and wallpaper was shown. Then the problems started.

While I was backing up the Documents and Settings folder, anticipating a possible Windows re-install, I came across this page (using another PC): http://forums.techguy.org/windows-nt-2000-xp/682731-parameter-incorrect.html

The solution I looked the like of best (i.e. easy to try) was from Ricky6970, namely "hit Escape a gazillion times". Well, I tried that and after about 30 hits, amazingly, the Spybot window that you see after rebooting came up. I allowed the scan to complete and then chose the option to reverse recent changes. One of the entries that was restored was Zango. After that, the computer booted perfectly time after time.

The end situation is that the friend's computer is probably still packed with spyware and worse, but at least she can use it while we plan a likely Windows re-install in an orderly fashion. It is a small business accounts computer so thank God (and Ricky6970)!

I have been using Spybot for many years, and this was the first time I ever experienced anything like this. Hope the post helps.

[seharness]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingA720"="command.com /c del \"C:\\WINDOWS\\SchedLgU.Txt\""
"SpybotDeletingC1143"="cmd.exe /c del \"C:\\WINDOWS\\SchedLgU.Txt\""



I had just done a complete scan using advanced settings. at the end of the scan SB hung seemed to hang / freeze but did not have kill process. the title bar of the scan dialog had the word ZOOM on the top of it.

[maverik713]

Hi everyone, I'm pretty new here but I've used Spybot for some time now. My problem seems to be that I had the same issue as the OP but a few places suggested running a windows xp disk and repairing the OS. I went to the correct repair setup(the second repair option) and during the installation the same, "C:WINDOWS\system32\command.com The Parameter is incorrect." message again.

I tried to log in under safe mode and got a message saying "Windows XP Setup cannot run under Safemode. Setup will restart now."

Any suggestions will be greatly appreciated. Thanks in advance!

P.S. If I'm hijacking this thread, I'm really sorry. I weighed posting here against my other option, posting a new thread and came to the conclusion putting it here would be ok. I'll move it immediately if need be.

[rondafan]

Sorry to hijack this but I had the same problem ....yodamas cure worked perfectly but I ran spybot 2 times & had to go thru the "cure" both times.......any idea why this is happening??

I think that md usa spybot fans did diagnose the symptoms of this issue correctly.
But there appears to be an issue with the command.com and/or the cmd.exe on the affected computers.

Let's try another approach to eliminate the symptoms of this issue:

boot the computer normally
when the first error messages about the command.com appear open the taskmanager with ctrl+alt+del and then choosing the taskmanager
terminate the explorer.exe
then choose file - new task
enter the path to Spybot S&D (default: c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe) to start Spybot S&D
switch to advanced mode
navigate to tools - system startup
click the export button and save the startup report file to a location you can easily find later
remove all Spybotdelete entries from the startup list
within Spybot S&D (Processlist) terminate the remaining instances of command.com and cmd.exe (ntvdm.exe) and close the error message windows if they are still present ( you can mark multiple entries while holding the shift and/or ctrl key and terminate them together)
from the Taskmanager choose File - new task and enter explorer to restart the explorer
attach the startup report file you saved ealier to your next post


We will require the startup report file to diagnose the cause of this issue. We may also require a complete log file later.[/QUOTE]

[mdkruse84]

Thanks Yodama, like many others I tried your directions and my computer restarted just fine. I wanted to attach the startup report file to see if you have any advice, however file size exceeds the limit.

[manvantara]

Hi, the fix suggested by Yodama for command.com problem is working so far but as my friends machine has never had any anti virus or spy ware for years (!) - there are several thousand entries in the System Startup page that will not delete.
I isolated all the files so that the 'spybotdelete' entries are checked (as per instructions), but clicking on the delete button does not remove any, despite waiting for half an hour to give it time to dispose of it all. However, they do delete one by one when highlighted and clicking on the delete button. They will not multiple select or respond to the 'delete' key as such.
Any suggestions? I would be here for days doing them one by one!

cheers and thanks for a great service.

manvantara

[AgiDK]

Hey, i still got a problem with that solution you got there.
how everytime i close my Spybot down after ive deleted every Command.com & Cmd.exe they just keep comming back.

thats the thing i dont understand.

[KaryL]

there are several thousand entries in the System Startup page that will not delete.

I verified that I had the same problem, saw that the entries were legit, but should have been cmd.exe instead of command.exe and cmd.com.

From task manager: File, Run, cmd, cd \windows\system32, copy cmd.exe command.exe, copy cmd.exe cmd.com, exit, close task manager, click OK to the error message...fixed and can't happen again

[Metaslash]

Please help me! If I turn on my pc, black windows appear on the screen called c:\windows\system32\command.com
I followed this but:
# boot the computer normally
# when the first error messages (they aren't error messages, they're black windows, also if I wait them the pc freeze) about the command.com appear open the taskmanager with ctrl+alt+del and then choosing the taskmanager
# terminate the explorer.exe
# then choose file - new task
# enter the path to Spybot S&D (default: c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe) to start Spybot S&D --> This directory doesn't exist, so I wrote c:\Program Files\Spybot - Search & Destroy\SDmain.exe(or something like that)... however the pc freeze...
Also, If I start with safe mode it crashes.