Psychic debugging: Why does opening a command prompt always print a weird error message?


Every so often, somebody reports that whenever they open a command prompt, they get a weird error message between the version banner and the prompt.

Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
The filename, directory name, or volume label syntax is incorrect.

C:\>

Where is that message "The filename, directory name, or volume label syntax is incorrect" coming from?

My psychic powers tell me that it's coming from AutoRun.

AutoRun is a hidden gotcha of the command processor which lets you set a registry key to inject a command into every command prompt as soon as it starts up. And I'm guessing that there's a rogue AutoRun entry that is doing something which is generating that message.

For example, I was able to reproduce the message by doing this:

reg add "HKCU\Software\Microsoft\Command Processor" /v AutoRun /d \"C:|

After running this command, open a command prompt, and you'll get that same error message.

And before you forget, run this command to get rid of the bogus AutoRun:

reg delete "HKCU\Software\Microsoft\Command Processor" /v AutoRun /f
Comments (13)
  1. The MAZZTer says:

    You can do some pretty neat things with your own autorun script. I have one that hooks the drive letter changes and cd/chdir/pushd/popd commands with doskey. Whenever I change directory, I update the title of the window to reflect it.

    Of course, such scripts need to be created carefully. Any app that tries to funnel commands through cmd.exe will end up invoking this script, so it could break things if it changes something like the working directory.

    1. D.R. says:

      I’d suggest to not use AutoRun at all, as the file is more often executed than you can think. See e.g., the following https://stackoverflow.com/questions/35991722/how-to-specify-d-in-for-command – you cannot really specify /D in FOR loops, which runs the AutoRun very often if you do a FOR /F %%i IN (‘mycmd’) DO …

    2. Joshua says:

      cmd /k is your friend.

    3. skSdnW says:

      I actually had to stop using doskey to create aliases because doskey in AutoRuns sometimes crashes when cmd.exe is started by some 3rd-party apps. Probably because stdin was not hooked up or a strange stdout pipe? This was back in the XP/Vista days so it might be fixed by now. I must have reported it hundreds of times over the years with Dr. Watson before I gave up and wrote my own alias.exe helper.

  2. GWO says:

    Everyone who’s every edited a “~/.profile” knew where this one was going!

    1. Joshua says:

      It’s more like .kshrc

  3. morlamweb says:

    I remember one time years ago when I was madly troubleshooting a database update script, running through the command line, that failed only on my machine. The culprit was an AutoRuns key that I had set years earlier and had long since faded from my memory. Boy, was I embarrassed when I had to recall that bug report…

  4. Zuba Dalama says:

    Want *nix-like prompt every time you start cmd.exe?
    Put this in your AutoRun:
    prompt %USERNAME:$=$$%@%COMPUTERNAME%$S$P$_§$S

    1. skSdnW says:

      Too much wasted space for my taste. Put the computer name in the titlebar and make the colors red on white if the user is elevated.

  5. Wizou says:

    Sounds to me like a security issue !
    A non-admin program can quietly set HKCU\Software\Microsoft\Command Processor\Autorun to run malware
    And next time you open a cmd.exe with admin rights, the malware command gets executed

    1. D.R. says:

      Note that the HKCU is a different one for the Administrator account, so this isn’t a problem.

      1. Wizou says:

        It doesn’t look like it.
        For example, from a normal command prompt I tested: reg add “HKCU\Software\Microsoft\Command Processor” /v AutoRun /d “regedit”
        When I open a new normal cmd.exe, it starts and I get also prompted to run regedit with admin rights (that’s expected)
        When I open an admin cmd.exe (From start menu “cmd” + Ctrl-Shift-Enter), I get prompted to run cmd with admin rights (that’s expected), and then regedit is launched without further prompting.
        That means the same HKCU Autorun was used for normal & admin cmd.exe and a malware can setup a sneak attack through this, waiting for the user to open a cmd with admin rights.
        IMO, cmd.exe (signed by MS authenticode) should be entrusted to be run safely as admin at any time and not execute commands from HKCU.

      2. Wizou says:

        Note that my case was about an account that can elevate with admin rights through UAC prompts, not about a different Administrator account.

Comments are closed.

Skip to main content