Cmd.exe Troubles - What's happening?

[Sturmgewehr_44]

For a little under a month, I've been having these seemingly sporadic cmd.exe pop ups. A few minutes after start up, cmd would very briefly "flash" open and then close again, and 10-15 seconds later, it would do it again. I found this very peculiar. Even worse, it also can happen again, even after hours of leaving my PC running. Often, it occurs again when I'm playing a game, and the cmd pop up forces me out of it, like I am Alt-Tabbing out. For these reasons, whatever it is, is very frustrating.

I found out what is causing it however. With the help of a friend, I discovered that it seemed to be my network adapter renewing/releasing my IP on startup, for whatever reason, and then doing it occasionally afterwards to renew the DNS. I did some research, and nothing close to what I'm experiencing shows up.

I still don't have this problem fixed, and I have a few things I can possibly blame for it. It might not even be my adapter, because I got a new one (both of them are Asus adapters), and it still occurs just as it were before. I suspected it could be my router (Linksys EA3500), but I reset it to default and disconnected it and the cmd popups still happened. I've noticed that renew/releasing my IP from the Linksys Control Panel, as well as doing it in the Adapter control centre (the adapter is an Asus PCE-AC68) causes a cmd window to pop as it does when this issue happens as well. Is this supposed to happen when renewing an IP? Either way, I don't like my config suddenly renewing/releasing at random, and causing these issues, which are not harmful, but very aggravating. My old adapter (which I replaced with the AC68) was a PCE-N15 and had none of these cmd problems until around four weeks ago. I reconfigured it and none of the issues stopped. I uninstalled it's drivers and disabled the card itself, and it seemed like that prevented the cmd window from appearing twice. However, with my new card, I uninstalled the drivers and disabled the card, as I did with my old adapter, and it still appeared? Curiously, the cmd window only flashes once without an active Internet Connection. When the connection is restored, it flashes twice as it usually does.

This really does not seem harmful, and I monitored it closely, but it is annoying because of the disruption it can cause. It is 100% related to my wifi. I have no idea why it suddenly appeared. After all the testing I have done, I have but one left to blame. On the same week this started to happen, Windows installed several updates. I uninstalled them and tested, and it still appeared. However, is it possible this is a bug or conflict or compatibility issue as a result of one of these updates changing something that could have caused this?

Recent Observations:

Today, I installed Process Explorer in hopes of identifying the issue further. I discovered a few suspicious things. Conhost.exe always activates when the cmd.exe pops up. There are also three copies of Conhost, and another is made when the cmd windows appears. Is that normal?

I also disabled Mobsync, because I originally thought it caused it, but it doesn't seem like it. I disabled both UNS.exe and LMS.exe as well. I thought they were being started by Google Update and causing the popups, but that didn't fix it either. The only file that seems like it is the cause is Conhost.exe, and for several reasons, disabling it would't be a useful idea. Conhost.exe is necessary for cmd. What is causing Conhost to activate though? The only thing I can really say right now is that it really has to be a Windows Update, or related to it, that changed these settings and is causing the popups. I suspect Intel Management Engine could be a reason, or .Net Framework. Could these trigger the cmd trough ipconfig and renew/release however?

I very much look forward to ridding myself of this issue. It does not seem harmful, but is bloody aggravating, as I said before. I would greatly appreciate any help I can get. Would a video of it in action help paint a picture?

[SLOWPOKE]

Okey?

[Sturmgewehr_44]

İlk olarak SLOWPOKE tarafından gönderildi:

Okey?

Alright. I understand I got a giant wall up there, but please read the whole thing. It would help to understand my situation a bit more.

[Muppet among Puppets]

Are you sure its no virus?

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

Are you sure its no virus?

No, I'm not, but I'm pretty sure it's related to my wireless config. I've discovered more information that could definitely make it seem like a virus. I have not seen anything that appears malicious, just annoying. I'm still unsure.

[Muppet among Puppets]

DONT erase by pure guess, but read and check.

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

DONT erase by pure guess, but read and check.

It's difficult to, because everywhere I look, no one has the same problem.

[Muppet among Puppets]

Check if conhost is where it should be.
Do you have a virus scanner running?

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

Check if conhost is where it should be.
Do you have a virus scanner running?

Yes. I scanned with Malwarebytes several times after this started to occur. Nothing significant came up, except old Adware files from a while ago. If Conhost wasn't where it was supposed to be, wouldn't cmd not work in the first place? Where ideally should it be?

[Muppet among Puppets]

It would be malware on another place.

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

It would be malware on another place.

So the other copies of Conhost could be malware? Where is Conhost located?

[Muppet among Puppets]

C:\Windows\System32
in win7, i guess...... but read yourself

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

C:\Windows\System32
in win7, i guess...... but read yourself

Checked again. All copies of it are in the same location. If it is a normal .exe, what could be triggering it to activate?

[Muppet among Puppets]

What happened when it started to happen?

[Sturmgewehr_44]

İlk olarak Muppet among Puppets tarafından gönderildi:

What happened when it started to happen?

What do you mean? When the Conhost was triggered?

[Muppet among Puppets]

İlk olarak Sturmgewehr_44 tarafından gönderildi:

Checked again. All copies of it are in the same location.

You need to check where the RUNNING conhost is located