Basic DOS commands

Occasionally on your Windows computer, you may need to perform a procedure by typing in
commands at the 'Command Prompt'. Entering commands in this way allows you to bypass the
Windows graphical user interface and communicate directly with the operating system. You are
most likely to need to work in this way if you get an infection and have to disinfect your
computer from the command line, for example, using one of the Sophos Resolve tools, or
SAV32CLI or SWEEP.EXE.
To communicate through the Windows command line, you will need to use MS-DOS
commands. This article lists some basic DOS commands that you are likely to find useful when
working from the command line, but there are many more available. To find out more about MSDOS, consult a book, online dictionary or encyclopedia, or other specialist publication.
Command and Usage

Examples

ATTRIB

ATTRIB -R -A -S -H <VIRUS.EXE>

Change file attributes. '+' adds an attribute, '-'

removes it. Attributes are: A=archive; R=read
only; S=system; H=hidden.

All these attributes will be removed from

virus.exe.

C:

C:

Go to the C: drive. Similarly A: and D: etc.

CD

CD\

Change directory. When you change directory,

the prompt changes, showing the path of the
directory you are currently in.

CD..

takes you to the top of the directory tree

(typically to C:) .
moves you one level up the directory
tree (i.e. up towards the root directory).

Note, directory is the term used by DOS for what

Windows calls a folder.
CD <DIRECTORYNAME> takes you to that
directory. You can use one or more
subdirectory names, separated by \ e.g.
CD WINNT\Media takes you to the directory
C:\WINNT\Media
To change to another path, type the full path
with slashes. e.g.
CLS

CD \WINDOWS\SYSTEM
CLS

Clear the screen.

DEL

DEL <VIRUS.EXE>

Delete one or more files in the current directory.

Can be used with the '*' and the '?' wildcards.

DEL *.JPG

deletes virus.exe

will delete all files with the

extension JPG.

DEL *.*

will delete ALL files in the current

directory, USE WITH CAUTION.

DEL MY*.*

(Note: DEL cannot be used to delete directories.

Use RD to remove a directory.)

DEL MY??.*

will delete all files beginning

with MY and with any extension.

will delete files that are 4

characters long and begin with MY and with
any extension.
DIR
DIR displays all files and folders in the
Displays the contents of a directory (folder).
current directory. Folders are indicated in the
list by <DIR>.
Note, directory is the term used by DOS for what Files are usually listed by name.
Windows calls a folder.
DIR /P displays the contents a page at a time,

These switches can be combined, so DIR /W /P i.e. as many as will fit in your command line
will return multiple rows listing a page at a time. window. Press any key to display the next
page.
You can use the '*' and the '?' wildcards to search
for a particular file. The ? character represents
DIR /W displays the files/folders in multiple
ONE character, and the * character represents
rows. This view gives less information per
multiple characters.
file.
DIR *.*

lists all the files in a directory.

DIR *.JPG

displays all files with the

extension JPG in the current directory and all
subdirectories.
DIR MY??.*

displays all files beginning with

MY, exactly 4 characters long, and with any
extension.
DIR /S

lists the contents of all subdirectories.

DIR /AH

displays all hidden files.

EDIT <VIRUSLOG.TXT> opens the file
Runs DOS EDIT (a simple text editor). Useful for viruslog.txt and allows you to edit it.
editing batch files and viewing logs. This
command requires QBASIC.EXE to be present. EDIT <NEWFILE.TXT> creates a new file
called newfile.txt and opens it up for you to
edit.
HELP
HELP DIR displays information on the DIR
Displays DOS Help. For help on an individual
command.
command, type HELP then the command for
which you want more information.
MD
MD <NEWDIR> creates a new directory called
Make directory. Creates a new directory below
Newdir.
the current one. (The command can also be
written as MKDIR)
EDIT

PRINT

PRINT <LOGFILE.TXT>

Prints the specified file (if the printer is supported

in DOS - many are not).
Prints LOGFILE.TXT
RD

RD <DIRECTORYNAME>

Remove directory. Removes a subdirectory of the

current directory. The directory you want to
remove must be empty of all files. (The command
can also be written as RMDIR)
RENAME

RENAME <OLDNAME.EXE> <NEWNAME.EXE>

Rename a file. You must use the full file name

including the suffix.
TYPE

TYPE C:\README.TXT|MORE

Displays the contents of a file on the screen. If

you use this command on a file which is not a text
file, the display will be unintelligible. Use with
"|MORE" to display the text on a page by page
basis, and prevent it scrolling off the screen. "|" is
a pipe character.
>

COMMAND > FILENAME.TXT

When you run a DOS command, output is usually

sent to the screen. Use > to redirect output from e.g. SWEEP > REPORT.TXT The details of
the screen to a file. It runs the command
any infected files reported by SWEEP are sent
preceding the >, creates a file in the current
to a file called REPORT.TXT.

directory with the name you specify, and sends

the information/output returned by the command,
to that file.

Accessing the command prompt from Windows

To access the command prompt from Windows (a 'DOS box'), do as follows:
1. At the taskbar, select Start|Run.
2. Type
CMD

or on some versions of Windows

COMMAND

3. Click 'OK'.
A command prompt will open.

Accessing the command prompt in safe mode

For Windows NT/2000/XP/2003, see the knowledgebase article on removing files with
SAV32CLI.
For Windows 95/98/Me you can boot from a startup disk, or use MS DOS mode
1. At the taskbar, select Start|Shut dows.
2. Select 'Restart in MS-DOS mode'.
3. Click 'OK'.