cmd is not a valid win32 application

This is the report

You most deffinitely have a virus/spyware problem.

When you ran Ewido, did you tell the programme to clean any infections it found? See HERE.

Go HERE and follow the instructions exactly.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard

reports

here is the reports from Kasperky,hijackthis and ewido.

Do u see anything strange?

I have deleted everything what Kaspersky found.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

1054562.exe
AutoInstall.exe

Close task manager.

Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R3 - Default URLSearchHook is missing

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.skymasters.biz

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c283.cab

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab

O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1054562.exe

O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup145.cab

O16 - DPF: {F9F3920B-2F24-437A-A224-D49F0004A172} - http://www.net-viewer.com/dls/AutoInstall.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{9194E7D4-4748-4D71-A5E9-8EEE1BEEA445}: NameServer = 193.92.150.3 194.219.227.2<Only fix this, if it doesn`t belong to your ISP.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Click on the fix checked button.

Close HJT.

Reboot into normal mode and turn system restore back on.


Regards Howard

ok i did what you told me, but still i get the same error again when i run cmd from STart->Run.

is there anything else??

I read that someone solved that problem by going to the system32 folder and renaming cmd.com.

As an experiment,you could try that.

Hey i found the solution.
I unchecked ""Hide extensions for known files types" and also uncheck the "hide protected operating system files".
Then i found the CMD.COM and regedit.com and i just deleted!

thats all.

Is this ok?

Now i can go to STart-Ran-cmd and the window opens properly.

Is there anything else i have to check ?

Deleting those files would had the same effect as renaming them.
I didn`t want you to do anything to dramatic though.

If regedit and cmd work still work,then no problem.

Have you restarted the computer.? Sometimes deleted files creep back.

Yes, i have restarted my PC since then.
Everything seems to be normal now.

Thanks a lot for the support

Dimitris.