Command prompt window opening and closing(split second) a few times every hour

Good Ole Spens

Estimable
Aug 31, 2014
5
0
4,520
Best answers
1
So last week, I downloaded something that turned out to be to be pretty nasty and chalk full of malware. I immediately opened up Malwarebytes and Hitman Pro and started cleaning the gunk out, and ran 5-6 followup scans to be extra safe and thorough. I cleaned it up pretty good and eventually the software stopped detecting items. But on the same day after everything was cleaned up, I noticed that 3-4 times every hour, a command prompt window would open up just for a tenth of a second and disappear. I couldn't figure out why the hell it was happening, and then it dawned on me the other day to check event viewer. I noticed that event viewer was logging events for powershell, which I'm pretty sure shouldn't be happening, and the logs were concurrent with the date that I clogged my system with all that malware.

The powershell logs are occurring in a 10-step pattern. I will list them in the order that they occur:

1. Provider "WSMan" is Started (I looked it up, and it's a cmdlet to connect to the WinRM service for a remote computer)
2. Provider "Alias" is Started
3. Provider "Environment" is Started
4. Provider "FileSystem" is Started
5. Provider "Function" is Started
6. Provider "Registry" is Started
7. Provider "Variable" is Started
8. Provider "Certificate" is Started
9. Engine state is changed from None to Available
10. Engine state is changed from Available to Stopped

And that's the pattern the logs are repeating in. Now I could be entirely wrong about these logs, I have no idea what any of those commands represent or do, but it definitely looks suspicious to me. Can anyone shed some light for me?
 

SBMfromLA

Distinguished
Nov 11, 2011
160
0
18,710
Best answers
41
I sounds like something is trying to open up and then promptly closes. Have you looked at either your Startup Program or Task Manager to see if something is trying to run?
 

Good Ole Spens

Estimable
Aug 31, 2014
5
0
4,520
Best answers
1


Alright cool, I'll take a look at that, thanks!

 

CJW1951

Estimable
Aug 13, 2015
2
0
4,510
Best answers
0

Try this. Run your virus check, then Malware Bytes in that order. Shut down your system for at least 10 minuets. If possible also shut down your internet and take the system off line for the same time. Power the systems back up and then immediately run Malware Bytes. Your post is old and I don't see any repost on it so perhaps you fixed the problem.

 

Good Ole Spens

Estimable
Aug 31, 2014
5
0
4,520
Best answers
1


Thanks for the reply, but I actually was able to fix the problem after some extensive research. I was able to get a screenshot of the cmd window that was popping up for a second, and found out that it was being caused by BITSAdmin, which is a component of Powershell I think. There were 2 files(which I'm assuming were malicious) being constantly queued for download by BITSAdmin, but failing to download for some reason, and everytime the files were queued up, it would cause BITSAdmin to open up a cmd window. I had to go into to powershell and run a few commands pertaining to BITSAdmin to remove the files from the queue, which has since fixed the problem completely.

 

Jake_119

Commendable
Jan 11, 2017
2
0
1,510
Best answers
0
Hello, I am having the same problems can you tell me how you managed to screenshot one of them or record what it's saying?
 

chewyalf

Distinguished
Feb 10, 2011
11
0
18,560
Best answers
0
Can you tell me which file was deleted from powershell and how to do this? I'm having the same problem, with BTadmin and those annoying pop-up dos-type windows. Please respond. Thanks!
 

mannyph2003

Prominent
Jun 7, 2017
1
0
510
Best answers
0


I started noticing the same behavior a few weeks ago (around May 29th-31st). I noticed a DOS window opening and closing quickly, too quickly to see what was being done. I noticed that the window would run every hour at the 27th minute of every hour. Upon inspection, I found that I had a bunch of Kaspersky events occurring in the Details section of Task Manager. When I drilled down on the properties and details for those events every one occurred at the 27th minute of the hour. The 27th minute thing is coincidental since it seems I installed Kaspersky's anti-ransomware app on the 27th minute of a specific hour last year, your event might be happening at a different time.

I now know what's causing the window, now I need to figure out why.
 
Thread starter Similar threads Forum Replies Date
MagnaGuard Antivirus / Security / Privacy 1
A Antivirus / Security / Privacy 1
D Antivirus / Security / Privacy 5
N Antivirus / Security / Privacy 2
F Antivirus / Security / Privacy 7
S Antivirus / Security / Privacy 1
H Antivirus / Security / Privacy 2
K Antivirus / Security / Privacy 6
H Antivirus / Security / Privacy 3
D Antivirus / Security / Privacy 3
Z Antivirus / Security / Privacy 6
R Antivirus / Security / Privacy 0
R Antivirus / Security / Privacy 0
G Antivirus / Security / Privacy 1
Z Antivirus / Security / Privacy 1
L Antivirus / Security / Privacy 11
K Antivirus / Security / Privacy 2
P Antivirus / Security / Privacy 2
P Antivirus / Security / Privacy 3
M Antivirus / Security / Privacy 1

Similar threads


ASK THE COMMUNITY