Random CMD.exe popping up

[jhock2012]

Okay so I migrated to an SSD yesterday and am now getting random cmd screens flashing up. No commands as you can see in screenshot I got with Snagit. It flashes for literally one frame. Also with ProcMon I for these processes coming up at the time it flashes. Any help is appreciated!

 

[UsernameIssues]

Filter Process Monitor to only show Process and Thread Activity.




We want to see what is starting what and we want to see the command line info in the details section. After gathering the data, select the first line, press Ctrl + F and search for cmd.exe. Soon after the line that the search finds, there should be an Operation called Process Start.




Double click on that Process Start line and show us a screen shot of the command line details:



The screenshot above is just Explorer.exe starting cmd.exe. The command line for that event won't have any info after cdm.exe.

BTW, Snagit's slow frame rate makes it hard to see stuff like this. I use an old version of CamStudio (version 2) installed in the root of the OS drive to capture events like these. Then I use Media Player Classic to step thru the video frame by frame.

 

[jhock2012]

Okay here ya go!

 

[UsernameIssues]

Interesting.


I should have also asked for the first row where the Ctrl + F search finds cmd.exe. That should be a Process Create operation. What is the process in the column named Process Name? In other words, what process starts cmd.exe?

Here is my example of Explorer starting cmd.exe:

 

[jhock2012]

Okay here is where the process is created and the command line details.

 

[UsernameIssues]

I have no idea why that service is starting cmd which starts regsvr32 and does something with a tmp file.

Let's see if other forum members have a clue.

 

[NoelDP]

All I can think of is malware!
- and possibly a Task Scheduler?

 

[GokAy]

All I can think of is malware!
- and possibly a Task Scheduler?

Scan with Malwarebytes Anti-malware free.
Perform a clean startup http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[Layback Bear]

jhock2012 do you have or have you ever had any products or programs by IObits on this computer??