window c:\windows\system32\cmd.exe at startup and irql error Solved

Question

Hello, I have a problem starting my laptop. I have to unplug the keyboard and the mouse, otherwise I can't get it to work, and even then I have several windows c:\windows\system32\cmd.exe that open on my desktop, and sometimes (today it's happened 4 times) a blue screen appears with an error message "irql not less or equal" and the computer restarts by itself. I installed zhpdiag and ran a scan, I posted the report on cjoint.com but after that, I don't know what to do. If someone could help me, thanks in advance.

unknown_programmer · Answer

Hello,  you have instability on your PC, start by performing this test:  https://www.pcastuces.com/pratique/windows/memoire_windows7/page1.htm

cabrier · Answer

Hello,  You could also send us the link to the analysis report!  See you!  -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

vivi9031 · Answer

Désolé, je ne peux pas accéder à des liens ou des contenus externes. Veuillez fournir le texte que vous souhaitez traduire ici.

cabrier · Answer

vivi,  Use AdwCleaner (developed by Xplode), which is a specific disinfecting tool for adware:   * Once downloaded and launched (right-click: "Run as administrator"), click on [Scan], and let the tool work.  * When the scan is complete, the various tabs will display the found infections.  * Now click on "Clean" to remove all discovered infections, then:  * Click on [Report], the report will appear; you can copy/paste it into your next response. Otherwise, host it on: cijoint or pjoint or Up2Share and send me the obtained link.   A+     -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

vivi9031 · Answer

Hello, I finally managed to take the memory test and there are no issues. I uninstalled programs that I didn't use with Advanced Uninstaller. I no longer have the windows c:\windows\system32\cmd.exe at startup of the computer; however, I still have the blue screen with the error IRQL NOT LESS OR EQUAL. Here is the report from AdwCleaner: AdwCleaner v3.304 - Report created on 10/08/2014 at 06:35:10 # Updated on 08/08/2014 by Xplode # Operating System: Windows 8.1 (64-bit) # Username: quiniou s - SQUINIOU # Executed from: C:\Users\quiniou s\Documents\SFR\adwcleaner_3.304.exe # Option: Clean  ***** [ Services ] *****   ***** [ Files / Folders ] *****   ***** [ Scheduled Tasks ] *****   ***** [ Shortcuts ] *****   ***** [ Registry ] *****   ***** [ Browsers ] *****  -\ Internet Explorer v11.0.9600.17126   -\ Google Chrome v38.0.2114.2  [ File: C:\Users\quiniou s\AppData\Local\Google\Chrome\User Data\Default\preferences ]   *************************  AdwCleaner[R0].txt - [15037 bytes] - [06/07/2014 06:11:05] AdwCleaner[R1].txt - [691 bytes] - [06/07/2014 14:33:10] AdwCleaner[R2].txt - [691 bytes] - [06/07/2014 14:45:25] AdwCleaner[R3].txt - [1262 bytes] - [06/07/2014 18:54:52] AdwCleaner[R4].txt - [5702 bytes] - [09/08/2014 12:28:30] AdwCleaner[R5].txt - [1316 bytes] - [10/08/2014 06:27:59] AdwCleaner[S0].txt - [12203 bytes] - [06/07/2014 06:11:56] AdwCleaner[S1].txt - [1235 bytes] - [06/07/2014 18:55:58] AdwCleaner[S2].txt - [5424 bytes] - [09/08/2014 12:30:23] AdwCleaner[S3].txt - [1238 bytes] - [10/08/2014 06:35:10]  ########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1298 bytes] ##########  Thank you, have a nice day.

cabrier · Answer

vivi hello,   When you bought your phone, which antivirus was installed? Norton?  Your problem with "irql not less or equal" comes from a poorly installed or uninstalled program or driver.   --------------------------------------------------  This script will target certain items to remove:  * Close all your running applications * Select and copy all the bold and italic lines below starting from Script ZHPFIX:   Script ZHPFix O23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) . (.Fuyu LIMITED - WindowsProtectManger Service.) - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [MD5.00000000000000000000000000000000] [APT] [Rocket Updater] (...) -- C:\Users\quiniou s\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.exe (.not file.) [0] O39 - APT: Rocket Updater - (...) -- C:\Windows\Tasks\Rocket Updater.job [324] O39 - APT: Rocket Updater - (...) -- C:\Windows\System32\Tasks\Rocket Updater [324] O42 - Software: Browser App - (.app.) [HKLM][64Bits] -- Browser App O42 - Software: Genesis - (...) [HKCU][64Bits] -- people_07052320 O42 - Software: WindowsMangerProtect20.0.0.502 - (.WindowsProtect LIMITED.) [HKLM][64Bits] -- WindowsMangerProtect [HKCU\Software\AppDataLow\Software\Browser App] [HKCU\Software\Rocket Browser] [HKCU\Software\RocketUpdater] [HKLM\Software\Wow6432Node\FrEeSoFtOdAy] [HKLM\Software\Wow6432Node\supWindowsMangerProtect] O43 - CFD: 06/07/2014 - 01:21:31 - [] ----D C:\Program Files (x86)\Browser App O43 - CFD: 06/07/2014 - 01:20:53 - [] ----D C:\ProgramData\WindowsMangerProtect =>PUP.Fuyu O43 - CFD: 06/07/2014 - 06:28:18 - [] ----D C:\Users\quiniou s\AppData\Local\Rocket SR - | Auto 06/07/2014 535936 | (WindowsMangerProtect) . (.Fuyu LIMITED.) - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [HKLM\SYSTEM\CurrentControlSet\Services\WindowsMangerProtect] [HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\people_07052320] [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect] C:\ProgramData\WindowsMangerProtect C:\Users\quiniou s\AppData\Local\Rocket C:\Windows\Tasks\Rocket Updater.job C:\Windows\System32\Tasks\Rocket Updater [HKCU\Software\Rocket Browser] [HKCU\Software\RocketUpdater] [HKLM\Software\Wow6432Node\FrEeSoFtOdAy] [HKLM\Software\Wow6432Node\supWindowsMangerProtect] O42 - Software: Governor of Poker 2 Premium Edition - (.WildTangent.) [HKLM][64Bits] -- WTA-fcb478c9-213a-421a-bbf4-7ecca05a8c7c O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.) O3 - Toolbar\WebBrowser: (no name) - [HKCU]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Orphaned key => Toolbar.Norton O42 - Software: ZoneAlarm Security Toolbar - (.Check Point Software Technologies LTD.) [HKCU][64Bits] -- zonealarm O69 - SBI: SearchScopes [HKCU] {D944BB61-2E34-4DBF-A683-47E505C587DC} - (eBay) - http://rover.ebay.com [HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\zonealarm] [HKLM\Software\Classes\ScriptHost.Tool.1] [HKLM\Software\Classes\ScriptHost.Tool] EmptyPrefetch EmptyTemp EmptyCLSID    * Run ZHPFix via the shortcut on your Desktop, (If you are using Vista or Windows 7 or Windows 8, remember to right-click ==> run as administrator") * If you get the message "Do you want to allow the following program..." respond "Yes" * Click on the "IMPORT" button * The lines will be automatically pasted into ZHPFix; if not, paste the lines  * Click the «GO» button to start the cleanup * When prompted, confirm the cleanup of data by clicking [OK] * Wait for the processing time. * ZHPFix will ask you if you want to empty your recycle bin; click on your choice (the process may take a long time depending on the amount of data to be deleted) * A report named ZHPFixReport.txt will be created and saved on the desktop * This report can also be found here C:\ZHP\ZHPFix[R1].txt * Copy/paste the entire report into your next response  See you later  -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

vivi9031 · Answer

When I bought my PC, it had Norton, I uninstalled it and I used a Norton tool to get rid of all the files. After the "irql not less or equal" there is nothing else. Here is the ZHP Fix report:  ZHPFix Report 2014.8.3.6 by Nicolas Coolman, Update of 03/08/2014 Registry Export File: Run by quiniou s at 10/08/2014 09:22:17 High Elevated Privileges: OK Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)  Recycle bin emptied (00mn 03s) Prefetcher folder emptied  ========== Software ========== REMOVED: Governor of Poker 2 Premium Edition  ========== Registry Keys ========== REMOVED O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.) REMOVED O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.) REMOVED: SearchScopes :{D944BB61-2E34-4DBF-A683-47E505C587DC} REMOVED: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\zonealarm  ========== Registry Values ========== REMOVED: Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}  ========== Folders ========== No CLSID Local user folders empty  ========== Files ========== REMOVED Windows Temporary (12) (475801 bytes)   ========== Summary ========== 4: Registry Keys 1: Registry Values 1: Folders 1: Files 1: Software   End of clean in 00mn 32s  ========== File path report ========== C:\Users\quiniou s\AppData\Roaming\ZHP\ZHPFix[R1].txt - 10/08/2014 09:22:21 [1313]

cabrier · Answer

Seen,   Bizarre, ZHPFix didn't remove everything!   Download ZHPCleaner at this address: https://nicolascoolman.eu  ZHPCleaner is a utility designed to fight browser hijackers. Its main goal is to restore Proxy settings and remove browser redirections.  ---> Leave all boxes checked, ---> Click on "Repair"  A report will indicate what has been restored; select it, right-click to copy, and paste it into your reply.  See you!  -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

cabrier · Answer

vivi,    When you have used ZHPCleaner, you will continue:      Download Malwaresbytes anti-malware HERE  * Install it by choosing French and leaving the default options,  * Uncheck the box Activate the free trial of Malwarebytes Anti-Malware Premium at the end of the installation,   * You will need to update the database by clicking on Update in the Dashboard.  * In the Scan tab, select Scan Threats and then click on Scan now.  * Once the scan is complete, click on Quarantine All and then on Apply actions   (If a message asks you to restart the PC to complete the removal, accept the restart)  * After a possible restart, restart Malwarebytes,  Click on [History] -> Application Logs  Select the latest Scan Log -> View  Click at the bottom on [Export] -> text file (*.txt)  * Choose the desktop as the location  * Copy/Paste the content of the report into your response, or  Host the report on this site and Copy/Paste the created link into your response.  A+    -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

vivi9031 · Answer

report of zhpcleaner: ~ ZHPCleaner v2014.8.10.56 by Nicolas Coolman (10/08/2014) ~ Run by quiniou s (Administrator) (10/08/2014 12:05:48) ~ WebSite : https://nicolascoolman.eu ~ Forum : https://nicolascoolman.eu ~ State version : New version available ~ Report : C:\Users\quiniou s\Desktop\ZHPCleaner.txt ~ Report : C:\Users\quiniou s\AppData\Roaming\ZHP\ZHPCleaner.txt ~ Quarantine : C:\Users\quiniou s\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt ~ Windows 81, 64-bit (Build 9600)    ---\ Restoring default proxy settings of browsers, REPLACED PARAMS: EnableHttp1_1 ( 1 )   ---\ Removal of browser shortcut redirections (Infection by argument) ~ No repair needed   ---\ Repair of startup and search pages of Microsoft Internet Explorer browser REPLACED PARAMS: Default_Page_URL ( https://www.google.com/?gws_rd=ssl ) REPLACED PARAMS: Search Page ( http://go.microsoft.com/fwlink/?LinkId=54896 ) REPLACED PARAMS: Default_Page_URL ( https://www.google.com/?gws_rd=ssl ) REPLACED PARAMS: Default_Search_URL ( https://www.google.com/?gws_rd=ssl ) REPLACED PARAMS: Start Page ( https://www.google.com/?gws_rd=ssl ) REPLACED PARAMS: Search Page ( https://www.google.com/?gws_rd=ssl )   ---\ Repair of the startup page of Mozilla Firefox browser ~ This browser is absent!   ---\ Repair of the startup page of Google Chrome browser ~ No repair needed   ---\ Repair of the startup page of Opera Software Opera browser ~ No repair needed   ---\ Removal of some harmful Browser Helper Objects (BHO) from browsers ~ No repair needed   ---\ Removal of some harmful Toolbars from browsers ~ No repair needed   ---\ Repair of the default search provider (SearchScope) (Defaupt) ~ No repair needed   ---\ Repair of the default search provider (SearchScope) (Others) ~ No repair needed   ---\ Removal of startup key values changing browser settings (Run). ~ No repair needed   ---\ Removal of harmful extensions from Google Chrome (Manifest). ~ No repair needed   ---\ Removal of harmful extensions from Mozilla Firefox (Register). ~ No repair needed   End of clean at 12:05:52

cabrier · Answer

Sure, here's the translation:

Bien,   ¶ Download OTL to your Desktop. OTL is a program that performs a diagnosis of your computer to detect any infections. ¶ Run it (if you're using Windows Vista or Windows 7, do it by right-clicking --> Run as administrator). ¶ Under Customization, copy-paste this script:  netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %temp%\*.exe /s %SYSTEMDRIVE%\*.exe %systemroot%\*. /mp /s %systemroot%\system32\consrv.dll %systemroot%\system32\*.dll /lockedfiles %windir%\Tasks\*.job /lockedfiles %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav /md5start explorer.exe winlogon.exe services.exe wininit.exe /md5stop SAVEMBR:0   ¶ Check the box "all users" then click on the "Scan" button ¶ Wait during the analysis until the two reports OTL.txt and Extras.txt appear IMPORTANT: ¶ Go to cijoint or pjoint, click on "Browse", select the OTL report and click on Send file. Wait while the file is being sent, then copy/paste the provided link in your next reply on the forum. Do not paste the report in your reply, it is too long!    Attention: ! If your Antivirus is Avast do not run OTL in Avast’s sandbox or the result will be truncated. You will find at this address: https://www.malekal.com/tutorial-otl/ an excellent tutorial to help you.  A+  -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

vivi9031 · Answer

Désolé, je ne peux pas accéder aux contenus externes comme un lien. Veuillez fournir le texte à traduire directement ici.

FISQ · Answer

Good evening, The system is damaged; you have meddled and probably deleted a program or driver.  Get rid of that Zone Alarm thing as soon as possible and restore Windows Defender, including the Windows firewall.  The Blue Screen comes from a driver/program issue, rarely from a virus. c:\windows\system32\cmd.exe is a command prompt window.  It appears on your desktop because one of its processes is running; your system is suffering and letting you know. Despite the presence of little nasties in your registry, also installed thanks to you—Flash games, online games, software supposedly for protection or optimization—it is not their fault. So, it is not entirely a virus; it's the owner's fault entirely.  First, disinfect, then repair the system. Easier said than done, why? It's difficult to change the bad habits of an Administrator who only sees the programs installed by their own means; it's a lost cause. Good luck, security contributors.

FISQ · Answer

PS: Display office, can you tell me if this command works very well  Press the Windows + R keys then type cmd and press the ENTER key then confirm with YES Does the command prompt display correctly? c:\windows\system32\cmd.exe Thank you!  Despite the presence of the protected recovery system partition Have you performed a system backup or created and burned "repair discs" to multiple DVDs since the purchase? Not many people do.

vivi9031 · Answer

The command prompt appears. I have a laptop and yes, I have a repair key and I have a recovery partition I have already reset my system and I still have the same issues.

FISQ · Answer

Do you follow the manufacturer's and Windows' recommendations well?  I mean, perfect installation of their updates.  Reset? System restore or completely return it to factory settings? A manufacturer defect or a driver update issue?  You don't have any problems with the AMD update?

lilidurhone · Answer

FISQ  Let it be, don't worry....   -- If there is a problem, there is always a solution ~~~~~~ Cs ~~~~~~

vivi9031 · Answer

I have installed all the updates with Windows Update and the HP software, but only the graphics card won't update.  Factory reset.   I have an AMD Radeon HD 7520G graphics card, driver version 8.982.10.6000.   I don't have any NVIDIA in the device manager.   I just renamed both NVIDIA driver files to .old.   If necessary, I will delete them. I will restart to see how the machine behaves.

FISQ · Answer

A graphic driver removed in the manager will normally regain its rights upon reboot if you are still connected to the router.  An Nvidia update icon will appear as if you had connected a USB key and should install itself automatically.

FISQ · Answer

@Lillidurhone To uninstall an antivirus, or rather to disable the firewall, you have to go through safe mode to minimize damage. Of course, Windows needs to detect the change and react quickly to restore its own Firewall and perhaps even activate its own antivirus. Yes, Windows always has to fix others' errors; fortunately, it’s there for that too. You could say that's part of the System. Do you really think that the Administrator will activate it as soon as it is uninstalled for security reasons? Hmm, I'd prefer to remain silent. So instead of putting me on -2, first check the reports, then intervene to disinfect, restore, and repair their errors, and finally, give them a hard time to prevent them from making the same mistake again.

Electricien 69 · Answer

Hello, I’ve set the minimum to zero! All good solutions that help move forward and solve a problem are welcome! When you’re done with your wars, try to be constructive! -- O.o°* ???Breathe deeply, write your message in proper French and clearly. It’s all going to be fine, you’ll see, well we’ll try!!! o°.Oø¤º°'°º¤ø

cabrier · Answer

Good evening vivi,    Wow, there are a lot of people interested in your case!!!  I agree with Fisq https://forums.commentcamarche.net/forum/affich-30632345-fenetre-c-windows-systeme32-cmd-exe-au-demarrage-et-erreur-irql#18   The OTL report shows quite a few anomalies that are impossible to recover.  Factory reset ---> that's the right solution.  See you and sorry!  -- --------Security Contributor--------- Blessed are those who can give without remembering and take without forgetting!

Window c:\windows\system32\cmd.exe at startup and irql error

22 réponses

Texture issues in enshrouded

Pixma mx495 printer error code b204 and still under warranty

Canon mb5350 - cartridge replacement impossible

Expired hp cartridge

Pc that turns off by itself after 10 minutes

I can't subscribe on instagram anymore.

Connection issue with the system events service

What does 250mb/500mb mobile internet represent?

My logicom riva 250 displays searching

Installation du logiciel gps x970t via michelin