Hi guys.
I noticed the other day , while i was doing nothing on the pc , my hard drive was being access every couple of seconds..
I had a look in task manager at the processess that were running and noticed that the second item using CPU was cmd.exe..
This seemed strange to me because it was under my user name.. I thought that this programe resided in the system32 folder..
I ended the process tree and saw absolutely nothing seemed to happen.. since then i have been checking the task manager when the pc
does something it shouldn't and every time this cmd.exe is running...
Any ideas on what it could be
TIA

Is cmd.exe a virus? No, it is not. The true cmd.exe file is a safe Microsoft Windows system process, called "Windows Command Processor". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. PE_VIRUX.A-4 or PE_VIRUX.E-1 (detected by TrendMicro), and W32.Virut.CF or Downloader (detected by Symantec).
To ensure that no rogue cmd.exe is running on your PC, click here to run a Free Malware Scan (it's free, and easy to uninstall after the scan is done ;-).

How to recognize suspicious variants: If cmd.exe is located in a subfolder of C:\Windows\System32, the security rating is 71% dangerous. The file size is 23,040 bytes (72% of all occurrences) or 36,864 bytes. There is no file information. The program has no visible window. It is not a Windows core file. The application uses ports to connect to a LAN or the Internet.

If cmd.exe is located in a subfolder of C:\Windows, the security rating is 31% dangerous. The file size is 301,568 bytes (40% of all occurrences), 648,192 bytes, 187,519 bytes or 318,976 bytes. The program has no visible window. Cmd.exe is a trustworthy file from Microsoft. cmd.exe is able to monitor applications, record inputs and hide itself.

If cmd.exe is located in a subfolder of "C:\Program Files", the security rating is 22% dangerous. The file size is 388,608 bytes (50% of all occurrences), 401,920 bytes or 399,360 bytes.

If cmd.exe is located in the folder C:\Windows, the security rating is 80% dangerous. The file size is 86,016 bytes (50% of all occurrences) or 16,896 bytes.

If cmd.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 60% dangerous. The file size is 25,604 bytes (50% of all occurrences) or 36,868 bytes.

Important: Some malware camouflages itself as cmd.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the cmd.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security

its probably running some cmd or bat file, check task sched and run msconfig to see whats running

Thanx for the replies
I have right clicked on cmd.exe within task man adn opened file location..it sends me to the system32 folder... I have tried to delete it but It wont allow me to change the permissions on this file
Any Ideas

DO NOT DELETE IT! thats what people are saying, it's a legitimate process (it's the command line/DOS prompt) - of course Windows won't let you delete a critical system file.

Now, something could be using it - again legitimately and many processes do and in my Task Manager i've got one running right now.

If you're that concerned, Install Malwarebytes, update it then run a full scan in safemode, see if it finds anything

Originally Posted by Emmvee

Thanx for the replies
I have right clicked on cmd.exe within task man adn opened file location..it sends me to the system32 folder... I have tried to delete it but It wont allow me to change the permissions on this file
Any Ideas