PDA

View Full Version : SpyBotDeleting



tommy2k8
2009-01-30, 12:19
After putting SpyBot on a client laptop, I ran a SpyBot scan, which came up with 273 pieces of spyware! However, when I restarted the computer, I got lots of 'SpyBotDeleting' alerts popping up, along with the error message 'MS-DOS subsystem cannot find command.com and autoexec.nt. I clicked on Close multiple times and eventually they went.
I looked up the MS-DOS subsystem error message on Google, and downloaded three DOS files that I needed to extract to the system32 folder. So I did, and restarted. I only got one command.com box empty Command Prompt-style box, which went away after a couple of seconds.
Is that message relating to SpyBot, and why does it do it?

md usa spybot fan
2009-01-30, 12:34
tommy2k8:

A "SpybotDeletingxnnnn" runonce process is generated by Spybot S&D if it encounters a file that cannot be deleted during a "Fix selected problems" because the file is locked by other processes. The "SpybotDeletingxnnnn" processes normally run at system startup and attempt to delete those files.

tommy2k8
2009-01-30, 12:40
Is that the reason I get those error messages?

md usa spybot fan
2009-01-30, 13:37
tommy2k8:

After downloading the programs, are you still getting error messages? If so what are they.

tommy2k8
2009-01-30, 13:49
The error message is:

16-bit MS-DOS Subsystem
command.com and autoexec.nt: these commands are not valid DOS files

Dialog boxes with nothing in them appear, and then I click Close, and they disappear again!

md usa spybot fan
2009-01-30, 14:59
tommy2k8:

The only thing that I can suggest is that you check the attributes of the files that you downloaded against a known valid copy for your Windows OS.

On my Windows XP SP3:
File: C:\WINDOWS\system32\command.com
Size: 50620
CRC-32: 2164D90B
MD5: BE67D29CA914DE072D9971E3FFFC4050
SHA1: 3C57A09706D1791EF7CDBE65E62649E52C014E0F
Date modified: Wednesday, July 16, 2003 3:25:40 PM
File: C:\WINDOWS\system32\AUTOEXEC.NT
Size: 1688
CRC-32: FAC26ED7
MD5: 30475F091008E24550523515A023270D
SHA1: D101605BAAA6B2B4A86E62ACB45F8C8B5057DF58
Date modified: Wednesday, July 16, 2003 3:24:36 PM
You didn't mention the third file. If it was CONFIG.NT, here are the attributes I have for that file:
File: C:\WINDOWS\system32\CONFIG.NT
Size: 2577
CRC-32: D2C181AE
MD5: 01C47C2ECED034EF6F8C1552A97CFF00
SHA1: C22E71E5F684D32E1703C676C70A985A47DEE41C