Only cmd.exe shows up on Windows 10 Startup

[cox5]

Hello to all, 

I encountered a problem couple of weeks ago since I realized I couldn't open cmd.exe ( once I open it, it automatically closes). I ran a MalwareBytes scan and found a malware marked as Hijack.AutoRun,  in registry value of a Command Processor

Specificly:

Hijack.AutoRun, HKU\S-1-5-21-2923880554-3555040517-45539607-1001\SOFTWARE\MICROSOFT\COMMAND PROCESSOR|AUTORUN, No Action By User, [14778], [245417],1.0.3222

So, naturally, I removed the malware and after I restarted my PC, the only thing that showed up is plain cmd.exe window without any background and icons in Windows. So I had to restore the quarantined malware in order to get my background and icons back the next boot. So I decided to manually edit the registry value (make it blank)  from regedit on that same Command Processor/Autorun and the same thing happen, only cmd.exe shows up. 

The value from Autorun in regedit is:

@mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & start /MIN "" "C:\Users\MyName\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & explorer.exe & exit

 

I'm not sure what to do next. I just don't have the time at the moment to reinstall Windows 10, but I want this problem resolved as quick as possible because it's just bothering me.  If you guys have a solution for this problem, that would be perfect. I read about this online and haven't found anything similar so I had to create a new topic. 

Thanks very much!

Edited November 15, 2017 by cox5

[kevinf80]

Hello cox5 and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

[cox5]

Hi, 

I followed the instructions and here are my logs.  By the way, don't you think that these .txt files tell too much personal info? 

 

 

Addition.txt

FRST.txt

[kevinf80]

Thanks for those logs cox5, continue as follows:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please open Malwarebytes Anti-Malware.   On the Settings tab > Protection Scroll to and make sure the following are selected: Scan for Rootkits Scan within Archives   Scroll further to Potential Threat Protection make sure the following are set as follows: Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended) Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended)   Click on the Scan make sure Threat Scan is selected, A Threat Scan will begin. When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab If asked to restart your computer to complete the removal, please do so When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more to retrieve the log. To get the log from Malwarebytes do the following:   Click on the Reports tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Let me see those logs in your reply, also let me know if there are any remaining issues or concerns... Thank you, Kevin...

 

fixlist.txt

[cox5]

Kevin, I'd like to thank you very much, this fix worked like a charm. 

After I rebooted PC, desktop showed up, everything was normal. Malwarebytes scan showed no threats, as well as AdwCleaner. 

For the logs, I saved them anyway so I'll post them here. 

 

Fixlog.txt

summary_after_fixlist.txt

[kevinf80]

Thanks for the logs/update cox5, if no remaining issues or concerns run the following to clean up:

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!