Express

CMDOW.EXE Virus? Hacktool.HideWindow

23 posts in this topic

Hi All,

Ok here's my problem I have successfully created a unattended DVD installation of XP and Office 2003, there is a cmdow.exe file in $$\System32 that I have been using for the longest I can't even remember at this point what was it for. But in any case yesterday my helpdesk tells me viruses are being picked up from these installs from Symantec.

The "Risk" Hacktool.HideWindow Threat Type Hack Tools the file name as mentioned above is cmdow.exe. Can someone PLEASE tell me whats going on. Like i said I forget what was the purpose of the cmdoe.exe but now its showing up as a virus threat.

Do I need to use CMDOW.exe? Has anyone else have had these issues and what was done to rectify them.

Thanks any help will be appreciated...

EXPRESS

0

Share this post


Link to post
Share on other sites

It (CMDOW.exe) isn't a virus; its purpose is to (as Symantec claims) hide the window of your choice.

Used in such context as CMDOW @ /HID, this command is popular among users making unattended installations of Windows-- that DON'T want to show the end user some ugly DOS box that could be closed with the click of "X".

By the words "help desk," I'm guessing you're in a business and have no choice but to use Symantec products. You have my deepest condolences.

In the event that I'm wrong, may I suggest AVG (the Firewall edition, especially) or Avast! Antivirus: two solutions that won't bring a fresh new processor to its knees.

Unfortunately, I have the job of installing Norton on new computers, but I've never gone the unattended route with strangers' computers, and as such, I've never seen that warning.

But fear none-- you're not being hacked. CMDOW.exe is your friend (just not Norton's).

-L

0

Share this post


Link to post
Share on other sites

Thanks Larson for the prompt reply, you are correct Symantec is our Antivirus product so thats not going to change.

So currently I have it being installed on to the local mahcines when doing the installs can i just not included in there, in other words use it to do the installs then remove the cmdow.exe?

Thanks for you help.

EXPRESS

0

Share this post


Link to post
Share on other sites

Sure, you could leave CMDOW on your install media, you would just need to add the full path to any batch file that you are calling it from. Putting it into System32 makes it simple to just put CMDOW @ /HID at the top of any batch script. If you keep it on your install media, you would just need to change it to something like: f:\Installs\Tools\CMDOW @ /HID (of course the path would be to where you do have it).

0

Share this post


Link to post
Share on other sites

If your running Symantec System Center you can add Hacktool.Hidewindow to the global security risk exclusion list.

On a stand-alone client it's easy too..

Configure> File System Auto-Protect> Actions> Security Risks> Exceptions> Add..

..or you could switch from SAV to AVG.. :blink:

-SteveM

0

Share this post


Link to post
Share on other sites

For my personal unattended installation, I just deleted cmdow.exe. Yeah, now I get the command windows popping up during installation and when I run my file backup command, but for my own personal system I don't really care - plus, I don't think my three-month-old son knows how to use a mouse yet, let alone how to close the command window. :D

0

Share this post


Link to post
Share on other sites

file deleted here too.

false positive , or maybe the antivirus producers know some i dont.

after 18 months on my computer cmdow.exe was

first detected on-line scanning , 4..5 weeks ago, sorry dont remember who/where

and from 2..3 weeks my local bitdefender says same about cmdow.

.. ?

Do I need to use CMDOW.exe?
no you dont. cmdow just hide a .cmd/DOS window.

i prefere to see a dos window vs. an antivirus alert.

especially when i insert my WPI DVD in other computer (friends... !)

0

Share this post


Link to post
Share on other sites

Many good advices, I will have to rethink this. The question mark that ONLESS possed made me think. Hmmm how about if there is something lurking in the background which none of us knows whats going on?

after 18 months on my computer cmdow.exe was

first detected on-line scanning , 4..5 weeks ago, sorry dont remember who/where

and from 2..3 weeks my local bitdefender says same about cmdow.

.. ?

Maybe if I just use it from the cd without copying it to the local computer... mmarable you may have a good idea.

Hey jrf2027 becarefull with your 3 month old, he may not know how to close a dos window but I bet he can drop his bottle on the keyboard :-) ...

Thank you all,

EXPRESS

0

Share this post


Link to post
Share on other sites

I had the same virus detection warning come up today on our SAV Corporate Edition. I'm thinking it's just detected as such because it's in \%SystemRoot%\System32. I bet if it was located somewhere less suspicious like C:\install, it wouldn't be picked up. That's just my conspiracy theory. ;)

0

Share this post


Link to post
Share on other sites
...That's just my conspiracy theory. ;)
like i said : or maybe the antivirus producers know some i dont.

and after 18 months on my computer cmdow.exe...

i realize now than i never copied cmdow in my \%SystemRoot%\System32 ..!

and yes was detected there too...???

i use it since i discover WPI here at MSFN .

maybe WPI copy it there ? i dont think this...

so.. deleted ... and ask help from autoIT to do the job .

0

Share this post


Link to post
Share on other sites

Of late, AntiVirus vendors have been including spyware/malware into their definitions and any program that could be used to support them. CMDOW is such a program. It is not a program, and all it does it hide a window. It's detected because one or two pieces of software could use it maliciously so you don't see what's happening to your computer.

You people are too paranoid.

0

Share this post


Link to post
Share on other sites

People would be suprised how little anti-spyware and anti-viral programs are needed in the home-computing arena when you don't utilize IE & OutLook. Ask staunch Opera users how often they need such tools ;-)

0

Share this post


Link to post
Share on other sites
People would be suprised how little anti-spyware and anti-viral programs are needed in the home-computing arena when you don't utilize IE & OutLook. Ask staunch Opera users how often they need such tools ;-)

Threats are only warranted when the targets a numerous. There's no reason for a hacker to target a browser utilized by a small percentage. Toute all you want about browser security regardless of browser, but if there's little gain for the effort it won't be done. :hello:

0

Share this post


Link to post
Share on other sites

I don't get it. I have been using Outlook and IE for years. I have not seen a virus/trojan/spyware/malware item on my machine in all of that time, and have watched the Firefox/Opera hooplah come and go. I am not impressed.

People who bring their machines to me with problems have been visiting naughty Web sites or clicking silly links or failed to update their OS in all cases. The basics. We all learn, but some learn the hard way.

Maybe they should have, like, a test similar to a driver's license test. If you don't get 17 out of 20 correct, you can't operate a computer. Naaaaah, then my side income would disappear. :P

0

Share this post


Link to post
Share on other sites

It's not a matter of being paranoid, it's a matter of having to change my default settings so that AutoProtect doesn't just delete the file without my permission, which of course become annoying for any other malware that's not CMDOW.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.