CMD.exe closes immediately after calling (Win7 64)

Question

Has anyone found such behavior when Command Processor (cmd.exe) closes immediately after calling it? I’ve run McAfee AV and Windows System File Check (sfc.exe) and nothing wron

Answer 1

I suspect this is a virus called vmprotected cryptocurrency miner.

I found an app in C:\Users{profilename}\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe

Also: The follow values were modified Also there are two main keys you need to modify

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

The shell key should have a value of explorer.exe and it was changed to %Comspec% which causes the command prompt to execute on login.

I would highly recommend you run a full virus scan and ensure the keys and executables are removed