thx for help

del cmd.exe
del net.exe
???? oO whats your problem...please describe your problem the next time

You won't need to delete cmd.exe and net.exe if you properly secure the machine.

It's a very bad idea to del anything on a computer you have compromised. In fact it completely sux because you are destroying datas that dont belong to u and more the system can be totally (filtered) up. Nasty, too bad. NEVER DO THAT !

Anyway and for educationnal purpose only : ms windows has a copy of each important files in %SYSTEMROOT%/system32/dllcache and will copy from this dir a file which has been deleted from system32 for example. Using the | between 2 del command will defeat this protection.

won't net.exe and cmd.exe be restored by windows if you delete them?
well, i suppose you are asking this in a hacker case.
I'm aspecting that you are wanna know this because you don't wanna be hacked yourself, and won't use it to secure you hacked servers.
well, no need to delete them..
Just block the for users with SYSTEM rights, since almost all exploits will spawn a shell with SYSTEM rights

omg deleting windows system files...how lame.

im guessing this is a kiddie netbios scanner who is worried the owner might type net stop servu

Guys, I have the habit of RENAMING those files.. You dont need to delete it m8..!! Just rename it to "What a stupid file.exe" ...!!

Manu

To delete them its a long process, here is how:
http://www.winguides.com/registry/display.php/790/

You have to disable windows file protection then you may do it(on Windows XP). But renaming them, hmm that might work never tried it. I wish there was a quick script to disable windows file protection. But I have not come accross one. And it would be quite hard for me to code one because I do not have a lot of programming experience.

I could think of no other reason than the one's that had allreaby been brought here.

but still...

I think booting in safe mode would allow you to delete those files.
altought I'm not sure

dont delete the files
juste remplace
del c:\winnt\system32\ftp.exe <= No !!
copy c:\winnt\system32\cmd.exe ftp.exe <= Yeah
and for secure a serveur u don't need to del cmd.exe :s

try this:
del c:\winnt\system32\dllcache\cmd.exe
del c:\winnt\system32\cmd.exe

del c:\winnt\system32\dllcache\net.exe
del c:\winnt\system32\net.exe

note:
1. You must logged on as administrator
2. first you del on c:\winnt\system32\dllcache\
3. second del on c:\winnt\system32\
4. if you del cmd.exe, you must del from explorer, if you del from command prompt it's will not work, access denied (i think you know why)

i'v try on windows 2000 maybe work on win XP

Good Luck

only thing i do is disabling echo in cmd.exe ....... install some backdoors and then you hold most of the re-hackers out.....

Like someone has already stated that if done properly you wont need to delete anything, just close the hole that you originally got onto the machine with.

Unless you are using lame techniques like looking for weak passwords, etc...

May I ask, why mess with cmd.exe? I mean couldn't someone just restore it after uttering only a couple wtf's? Besides, I reiterate, why?

first way is 2 close the hole u get in :
*change password
*patch the hole

then bring the pc 2 an updated version (patches)

then restrict some SYSTEM privileges --> access denied on ftp.exe & ....