Lost Echo. (Resolved)

[Woodman]

Win XP Home. SP.3

For no apparent reason I've lost the use of Echo. in batch scripts or at the command prompt.  This occurred today without warning and with no changes to software or hardware.  This is the only command which does not perform (so far).  I get the message that Echo. is not recognised as an internal or external command, operable program or batch file.  Echo works just fine.

To add to the confusion, booting from a backup hdd which was cloned two weeks ago brings up the same error although I have used Echo. in that time.

So far have run SFC and have expanded CMD.EX_ from the I386 folder on my genuine full install disk.

I'm guessing that there's nothing wrong with the file but what else could cause such a problem?

Thanks

[Dias de verano]

A corrupted or hacked cmd.exe would do this. Or a worm. For example W32.Picrate.B@mm is a worm that sends copies of itself to instant messenger contacts and drops a variant of W32.Spybot.Worm. You say you have expanded cmd.ex_, and still the problem persists, which (to me) suggests maybe your system is infected. Certain worms do this by dropping .com exectables such as cmd.com which intercept calls normally answered by the proper .exe file. If the ping, netstat and tracert commands are also broken, this would definitely point that way. Check your system for presence of cmd.com (and ping.com etc). If they show up, delete them and run a full virus & spyware check. Do that anyway! Also maybe do sfc /scannow and have Windows CD and any Service Pack CDs handy.

The above worm drops these files

    * %System%\netstat.com (a corrupt executable file)
    * %System%\ping.com (a corrupt executable file)
    * %System%\tracert.com (a corrupt executable file)
    * %System%\tasklist.com (a corrupt executable file)
    * %System%\taskkill.com (a corrupt executable file)
    * %System%\regedit.com (a corrupt executable file)
    * %System%\cmd.com (a corrupt executable file)
    * %System%\wini.exe (a copy of the W32.Spybot.Worm variant)
    * %System%\xtc.tmp (a copy of the worm)
    * %System%\Download.zip (a Zip archive of the worm)
    * %System%\bszip.dll (a legitimate DLL used to handle Zip archives)
    * %System%\ANSMTP.DLL (a legitimate DLL used for mail functionality)

%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).



If you find hints that this is the case, post again in the malware section of Computerhope.

[Woodman]

Thank you Dias.
I searched and scanned many times without finding any trace of the files you mentioned or any other malware.  I did a Repair install on my cloned backup (Slave) hard drive and the problem disappeared when booting from that drive.  Decided to do some more investigating on the main (Master) drive and was advised to search for a file named Echo, with or without an extension, on my Path.  MS Search, Dir and Explorer revealed no trace.

Finally I installed a search program named Locate, the two versions of which run in Windows or from the Command Prompt.  Locate32 run in Windows revealed nothing.  However Locate.exe run from the Command Prompt revealed a 0-byte file named Echo in the root of C: without a creation/accessed or modified date or times, and with the Attrib of only A(rchive).  Del deleted this file and Echo. is now back to normal.  As already stated Echo has always worked, only Echo. was a problem.

This resolved the problem but raises lots of queries for me:
1. What created the Echo file?
2. Why did a Repair install remove it, Repair is not supposed to remove or replace non-system files.
3. How can a file, even an empty file, be created without dates?

I know, or think I know, that you won't have answers but thank you for your interest.

W.