I have a 2 part question

[Jo-Ann]

1st one is how do I go on in safe mode ? I just can't remember for the life of me how to do that.

 

2nd I have a windo that popsup when I first boot up.....it saysC:\users\jo\appData\local\temp\system\mapcmdrun.exe

 

and will not go off unless I allow it to run..... when I click run in about 1 sec it is off, but comes right back as soon as I reboot.

 

 

I have tryed to set the recovery date back about a week before I first saw this come on., it will not complete the recovery. It says I have a virus protection plan running. I have turned it off and the same thing it comes back and says the same thing. So to make a long story short I can not get this off at start up nor can I do a recovery. Now what ?? that is why I want to do a scan in safe mode., Norton comes up and says my machine is clean.

 

I have an e-machine with windows 7 it is just about 1 year old. Can you help me at all ? I hope It also tells me to come back and run in the administrator I am the administrator and have never set it any different. I am the only one that uses this computer. Thank you in advance

 

Jo Ann

[Joe C]

1) To get into safe mode, tap the F8 key between the time it first posts and before windows starts up

2) mapcmdrun.exe is windows defender antispyware, you might get that error if you stopped it in the start up list of if you have some kind of malware that's preventing it from starting like it should.

There could also be an issue between Norton and windows defender antispyware

[TomGL2]

C:usersjoappDatalocaltempsystemmapcmdrun.exe

As mapcmdrun.exe is installed to the Program FilesWindows Defender folder, a file of that name located elsewhere is almost certainly bogus and malicious.

 

Start the computer in Safe mode and log on to the "jo" account. While pressing a Windows key (usually labeled with the Microsoft flag or "Start"), tap the R key. A Run prompt should open. Type

shell:Local AppDatatemp

and press Enter. Right-click the system folder and click Delete.

 

Restart the computer normally.

Edited December 3, 2011 by TomGL2

[Jo-Ann]

you must have read my mind..... I wanted to know how to delete this. It is very annoying

[Jo-Ann]

Where do I find the system folder I did the instructions just as above and everything came up asyou said...... but where is the system folder nothing of that kind showed.

[TomGL2]

where is the system folder nothing of that kind showed

It's probably hidden as a tactic to make removal more difficult. To make hidden folders visible –

 

Click the Start button, Control Panel, Appearance and Personalization, and Folder Options. Click the View tab. Under Advanced settings, click "Show hidden files, folders, and drives", then click OK.

 

When done, perform the steps previously described.

[Jo-Ann]

I still can not find the systems folder..... I have tried all the things you have said but it still does not show the systems folder....... I just want to get this window from popping up when I first boot up. it says it is unknown ....... I will get back to you as to who is unknow I have to re-start for it to pop up again.

 

OK here is what the window says....

 

open file security warning unknown publisher

publisher could not be verified: are you sure you want to run this software

 

under all of this is the string. c:usersjoAppDatalocaltempsystemmapcmdrun.exe

Edited December 7, 2011 by Jo-Ann

[TomGL2]

Let's try a more direct approach. While pressing the Windows key, tap R to open a Run prompt, then type

Notepad DELMAPCMDRUN.bat and press Enter. Confirm that you want to create a new file. Copy & paste the following text into Notepad.

 

@Echo off

Attrib -H -S c:usersjoAppData

Attrib -H -S c:usersjoAppDatalocal

Attrib -H -S c:usersjoAppDatalocaltemp

Attrib -H -S c:usersjoAppDatalocaltempsystem

Attrib -H -S -R c:usersjoAppDatalocaltempsystemmapcmdrun.exe

Del /F c:usersjoAppDatalocaltempsystemmapcmdrun.exe

Pause

 

Click File and Save As. In the Save in list, select the Desktop. DELMAPCMDRUN.bat should already be in the file name box — put a quote mark ( " ) before and after the file name. Click Save and close Notepad.

 

DELMAPCMDRUN.bat should be on the Desktop (depending on your view settings, the BAT extension may be hidden). Double-click the file to run. When the "Press any key" prompt appears, note any errors reported, then close the command prompt window.

[Jo-Ann]

nope didn't work either..... I just want this thing gone off my desktop. I can click the run and it turns off ....but a booting up it comes right back. I did everything you said..... I did not get the "press anh key) prompt appear the command prompt window. what I got was what program do you want this to run in....

 

I am feeling crazy and dumb for not being able to delete this thing for good...

 

However the file does show on my desktop like you said.

Edited December 8, 2011 by Jo-Ann

[TomGL2]

nope didn't work either

I can only conclude that there is no such program in that location, and perhaps no system folder.  Try this.

 

Open a Run prompt (tap R while pressing the Windows key), then type Notepad EXISTS.BAT and press Enter.  Confirm that you want to create a new file.  Copy & paste the following text into Notepad.

 

@Echo off

 

Set ChkDir=c:usersjoAppDatalocaltemp

If exist "%ChkDir%" ( Echo %ChkDir% folder is present

) Else ( Echo %ChkDir% folder does not exist)

Echo.

 

Set ChkDir=c:usersjoAppDatalocaltempsystem

If exist "%ChkDir%" ( Echo %ChkDir% folder is present

) Else ( Echo %ChkDir% folder does not exist)

Echo.

 

Set ChkDir=c:usersjoAppDatalocaltempsystemmapcmdrun.exe

If exist "%ChkDir%" ( Echo mapcmdrun.exe is present

) Else ( Echo mapcmdrun.exe does not exist)

Echo.

 

Pause

 

As before, save the file to the Desktop (remember to surround the file name with quotes), then double-click the file to run.  What is reported?

 

By the way, "didn't work" is not a useful response.

[TomGL2]

what I got was what program do you want this to run in

Something has likely meddled with the Windows registry, which controls how most types of files are opened or executed. This is a common malware tactic.

 

Open a Run prompt, type Notepad PgmAssoc.VBS and click OK, then confirm you want to create a new file. Copy & paste this text into Notepad.

 

' Fix some executable associations, enable regedit

 

Set WshShell = WScript.CreateObject("WScript.Shell")

 

FixExt "bat"

FixExt "cmd"

FixExt "com"

FixExt "exe"

FixExt "pif"

FixExt "scr"

 

On Error Resume Next

 

WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"

WshShell.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"

 

Set WshShell = Nothing

 

msgText = "EXE and other executable associations are restored," & chr(13)

msgText = msgText & "Registry Editor restrictions have been removed."

endBox = MsgBox(msgText, 4096, " Done")

 

Sub FixExt(ext)

 

extKey = "HKCR\" + "." + ext + "\"

shellStr = ext + "file"

shellKey = "HKCR\" + shellStr + "\shell\open\command\"

 

If ext= "scr" Then

execStr = """%1"" /S"

Else

execStr = """%1"" %*"

End If

 

On Error Resume Next

 

WshShell.RegWrite extKey, shellStr

WshShell.RegWrite shellKey,execStr

WshShell.RegDelete "HKCU\Software\Classes\" + shellStr + "\"

 

End Sub

 

Save the file to the Desktop as described earlier, then double-click to run. If this latest effort is successful, the effect should be immediate, and all programs should run normally.

[Jo-Ann]

This is what I got a box Wndows Script Host Script: C:UsersJoDesktopPgmAssoc.vbs Line: 5 Char: 1 Error: Type mismatch: 'FixExt' Code 800A000D Source: Microsoft VBScript runtime error is this the error message I should have gotten? If so where do I put the data you said to follow?

 

 

 

I have no idea where to end and begin with you above strings ? nor do I know where to put them ? Are they all one ?? What do I put "on error resume" ??????? I am just confused with this last message. I got everything up to this one. I ended on the first resume.

Edited December 9, 2011 by Jo-Ann

[Jo-Ann]

this still did not work...... however I have no idea where to begin nor where to end with this last string of directions. I have been affraid to put more in not knowing where to do that..... after the first set of on error resume.... do I copy and paste everything the next time of what.

 

however on the sest top there is a windows system 32 black box..... it says

 

C:usersJoAppDatalocaltemp is present

 

mapcmdrun.exe is present

 

press any key to continue

 

I did that and nothing happens that I know of I don't see anything different. I now have 3 boxes on my desktop one saved to DelMapcmdrun

one saved to prog Assoc

 

and the 3rd one shows gears that is the one with the C:

 

now what??????

[Jo-Ann]

Is Speedy PC any good to try???? I typed in Microsoft defender and that's what came up Speedy PC

[Jo-Ann]

Guess What? I got it off really......... I got it off....... I had spybot, adaware and windows defenders and thought I was in good shape well I guess I wasn't....... I went and scanned my computer with Exterminater 2 the free version, it found the mapcmd.exe file and said it was only a trace left behind. In order to get rid of it I had to purchase the Exterminater 2 but that was just fine. It found the problem and got rid of it.....also I can use the same version on my other 2 computers it says I can use it on up to 5 computers. I don't care I am very very happy that it is gone. I will run the Exterminater 2 at least every week..... I have rebooted my computer about 5 times already and it has not come back....

 

I want to thank you so very much for putting up with me. The last file you wrote I was starting to get scared I had no idea what I was doing. and what if I typed even one thing wrong.... so I am so very happy the price was affordable only $29.99 for 3 computers...

 

Do I still need spybot, adaware, Windows Defender and Exterminator ?? can I delete any of those ??

 

Thank you so very much for helping me......... I am so glad I decided to run that program. Thank you again.

Edited December 9, 2011 by Jo-Ann

[TomGL2]

This is what I got a box Wndows Script Host Script: C:\Users\Jo\Desktop\PgmAssoc.vbs Line: 5 Char: 1 Error: ...

 

I have no idea where to end and begin with you above strings ? nor do I know where to put them ?

In any procedure, it is vital to read through and understand all the steps first, then perform them exactly as given. After opening Notepad with the Run command "Notepad PgmAssoc.VBS", ALL of the text from "Fix some executable..." to "End Sub" should be copied & pasted as instructed — not typed — to the Notepad window in one complete block. If you are unfamiliar with copy/paste operations, just ask (asking when you don't know is also vital).

 

The text block itself was inserted into my reply with a smaller, darker, and different font, to distinguish it from the other text. If all the text appears the same, something is wrong with Internet Explorer (or whichever Web browser you use).

 

Separate and apart from all that, I'm glad you've resolved the problem — but "Exterminator 2"? I can't help but feel that the malware may have been put on your computer just to goad you into purchasing this product. How did you come to learn of it? Perhaps the name is not "Exterminator 2"?

 

That you searched for "Microsoft Defender" and the result was "Speedy PC" is worrisome, suggesting that your searches are being hijacked. Not that SpeedyPC is malware, but it is typical of a class of utilities that promise much more than is delivered. All products that purport to clean, repair, optimize, etc., the system registry should be strictly avoided — nothing they do to the registry will improve performance in the least, and some products cause a variety of new problems.

 

Again, congratulations on ridding your system of the pest.

[Y kawika]

Separate and apart from all that, I'm glad you've resolved the problem — but "Exterminator 2"? I can't help but feel that the malware may have been put on your computer just to goad you into purchasing this product. How did you come to learn of it? Perhaps the name is not "Exterminator 2"?

PC Pitstop Exterminate 2.0 I would imagine: http://www.pcpitstop.com/store/exterminate.asp

 

Y

[TomGL2]

PC Pitstop Exterminate 2.0 I would imagine:

Yup, here's hoping I had a feeling that "exterminatER" wasn't quite right ...

[Jo-Ann]

you were correct again. It was Exterminate.... I purchased it from PC Pitstop

 

Thank you so very very much... I knew I would get the correct answer. I just ran it again it found very very low grade things I just got rid of them too. Thank you Jo Ann