CMD.EXE disappearing

[Dkcode]

My colleague has a problem with his Windows XP laptop:

When he opens command prompt, as soon as there is any input from the keyboard, the windows instantly shuts off. Task manager still has cmd.exe process running.

We are running a Windows domain and our user accounts have administrator privileges locally.

I have tried:

Copying cmd.exe from my laptops system32 directory to his.
Logging in as local admin.
Upgrading .Net framework to 3.5 SP1

I don't really know what else to try other than to format and start again, but if there is a solution to fix this it will save us a lot of time.

 

[Dkcode]

Malwarebytes found problems and fixed them.

Log:


Scan type: Quick Scan
Objects scanned: 57865
Time elapsed: 7 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\lsass.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Microsoft\services.exe (Trojan.Agent) -> Delete on reboot.

Now it works.