Weird Cmd.exe Behaviour

[Sturmgewehr_44]

For the past week, or at least several days, I've been getting this unusual behaviour from cmd.exe.

I very rarely touch cmd, but have before. Not recently. Recently, however, I have had an issue related to Geforce Experience (which was fixed with the next version of the software), where a cmd error message would appear when I shut down, and delay shutting down by a few seconds. Maybe this is related?

Anyway, a few minutes after startup, the cmd dialog box pops up briefly. It blinks twice, the second one around 10-15 seconds after the first. The box that pops up doesn't say anything. It seems to be blank, however, it is definitely running something in the background. I have no idea what. I thought it could be a virus, but I doubt that. I've had no other suspicious symptoms, and no performance issues. The chances it seems of contracting a virus like that without me knowing are pretty unlikely. The annoyance here is that, I don't usually see this happen, and it also forces me out of whatever application that I am running at the time.

My best guess is that it is an incompatibility with Geforce Experience with the latest Windows 7 updates, released a few days ago. The issue might be caused by Geforce Experience downloading optimised settings (which I never use), although I'm unsure. This has happened I belief every start up now for probably a week, and I'm wondering what it is. I've scanned with Microsoft Security Essentials and Malwarebytes. Nothing besides a bunch of old adware files came up.


A new Nvidia driver and an update for Geforce Experience were released yesterday. I installed both, and did a clean installation for the driver. I don't think it fixed the bug, or whatever it is, but over the past two days, it is occurring less, and sometimes doesn't happen at all. Sometimes it can be prompted a few hours after leaving the PC on, and doesn't necessarily happen a few minutes after booting into Windows 7. I still have no clue what is causing this. I've installed nothing that could really cause it. I think maybe the Microsoft updates. A week ago, they were set to install automatically, and still are, however, they don't install automatically for me now, and I have to select and install them manually. Did a recent Windows update change that for me? If so, maybe it also caused this cmd bug?

[_I_]

try this

https://www.malwarebytes.org/mwb-download/
install mbam
run mbam, let it update, and full scan
fix all problems
reboot in safe mode
run mbam, let it full scan
fix all problems
reboot

[Sturmgewehr_44]

_I_ の投稿を引用：

try this

https://www.malwarebytes.org/mwb-download/
install mbam
run mbam, let it update, and full scan
fix all problems
reboot in safe mode
run mbam, let it full scan
fix all problems
reboot

I've already ran Malwarebytes.

Will safe mode cause any issues? I forget, how would I boot in it in Windows 7?

[Bad 💀 Motha]

As any Windows OS; F8 upon startup gets you to the Windows Boot Options screen.

The only normal reasons I could think of CMD running in background is when .NET Framework is updating and/or rebuilding it's database.

Normally CMD shouldn't just be sitting in Processes. If Malwarebytes comes up with nothing, then try other known good scanners; such as Spybot S&D 2.xx (do not install TeaTimer), SuperAntiSpyware, ESET Free Online Scanner. With ESET make sure you enable options such as; Stealth Scan, Scan for Unsafe Apps, Scan Archieves, but de-select Remove Threats. Reason to not auto-remove threats is so u can see them first, then assess the threats that come up before removing them.

Install in Normal Mode as an Admin; then run them and Update them. Then reboot into Safe Mode and run full scans. If something malicious is able to run in Safe Mode, reboot and select Safe Mode w/ Command Prompt. When in this mode, then press CTRL+ALT+DEL > Task Manager > New Task > Explorer to gain access to normal desktop. Or you can simply run just the scanning apps u want via that New Task option in Task Manager.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

As any Windows OS; F8 upon startup gets you to the Windows Boot Options screen.

The only normal reasons I could think of CMD running in background is when .NET Framework is updating and/or rebuilding it's database.

Normally CMD shouldn't just be sitting in Processes. If Malwarebytes comes up with nothing, then try other known good scanners; such as Spybot S&D 2.xx (do not install TeaTimer), SuperAntiSpyware, ESET Free Online Scanner. With ESET make sure you enable options such as; Stealth Scan, Scan for Unsafe Apps, Scan Archieves, but de-select Remove Threats. Reason to not auto-remove threats is so u can see them first, then assess the threats that come up before removing them.

I updated .net frameworks a few days ago I think. I hoped it would fix it, guess not.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

As any Windows OS; F8 upon startup gets you to the Windows Boot Options screen.

The only normal reasons I could think of CMD running in background is when .NET Framework is updating and/or rebuilding it's database.

Normally CMD shouldn't just be sitting in Processes. If Malwarebytes comes up with nothing, then try other known good scanners; such as Spybot S&D 2.xx (do not install TeaTimer), SuperAntiSpyware, ESET Free Online Scanner. With ESET make sure you enable options such as; Stealth Scan, Scan for Unsafe Apps, Scan Archieves, but de-select Remove Threats. Reason to not auto-remove threats is so u can see them first, then assess the threats that come up before removing them.

Install in Normal Mode as an Admin; then run them and Update them. Then reboot into Safe Mode and run full scans. If something malicious is able to run in Safe Mode, reboot and select Safe Mode w/ Command Prompt. When in this mode, then press CTRL+ALT+DEL > Task Manager > New Task > Explorer to gain access to normal desktop. Or you can simply run just the scanning apps u want via that New Task option in Task Manager.

F8 did bring up boot options. I clicked on my SSD (boot drive) and it still sent me to normal Windows 7, not safe mode. Do I select "Setup" instead?

Can Safe Mode be harmful?

Is there a log I can access to determine what's triggering a line(s) from cmd?

[Bad 💀 Motha]

If you are not allowing Windows to be idle long enough, then it can take quite some time for .NET Framework to complete it's operations in background.

To force .NET to finish it's operations; do the following...

- Winkey+R (Run) then type CMD, click OK.

- type cd/ (enter key) (this should have u at C:\ now)
- type cd windows/microsoft.net/framework/v4.0.30319 (enter key)

Once at this location in CMD, now check Task Manager > Processes for instances of .NET Framework. However since u yourself are running CMD, do not close CMD out. If anything .NET is running there in Task Manager, force them closed.

Then quickly switch back to your CMD window
- type ngen executequeueditems (enter key)

This will allow .NET Framework to complete it's rebuilding of databases. It can take 5-30 mins sometimes to complete, based on how much needs to be done and how slow/fast your system and OS drive is. So just allow it to finish. It will return to "c:/windows/microsoft.net/framework/v4.0.30319" prompt when it has completed.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

If you are not allowing Windows to be idle long enough, then it can take quite some time for .NET Framework to complete it's operations in background.

To force .NET to finish it's operations; do the following...

- Winkey+R (Run) then type CMD, click OK.

- type cd/ (enter key) (this should have u at C:\ now)
- type cd windows/microsoft.net/framework/v4.0.30319 (enter key)

Once at this location in CMD, now check Task Manager > Processes for instances of .NET Framework. However since u yourself are running CMD, do not close CMD out. If anything .NET is running there in Task Manager, force them closed.

Then quickly switch back to your CMD window
- type ngen executequeueditems (enter key)

This will allow .NET Framework to complete it's rebuilding of databases. It can take 5-30 mins sometimes to complete, based on how much needs to be done and how slow/fast your system and OS drive is. So just allow it to finish. It will return to "c:/windows/microsoft.net/framework/v4.0.30319" prompt when it has completed.

If true, why exactly is this happening so suddenly??

I get pretty cautious about cmd. I don't like to get near it. It's so unfriendly looking.

[Bad 💀 Motha]

You hit F8 too early; if you got a Drive selection screen, that was your Motherboard BIOS Boot Options screen, not the OS Boot Options screen provided by Windows.

If you can't get the timing just right, after choosing your SSD from Boot Options, then be ready to quickly hit F8 again as soon as select your Windows OS boot drive.

Safe Mode is just that, SAFE. It can be a way to access error logs and run scans in an environment free of any conflicting software, drivers, and malicious software running in the background due to what may or may not have been added to the Startup of your Normal OS boot process.

As for CMD, u can't really go wrong in CMD unless u actually use commands you are unsure of what they do. Everything I've stated won't stear u wrong; other techs here can easily verify that much for you.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

If you are not allowing Windows to be idle long enough, then it can take quite some time for .NET Framework to complete it's operations in background.

To force .NET to finish it's operations; do the following...

- Winkey+R (Run) then type CMD, click OK.

- type cd/ (enter key) (this should have u at C:\ now)
- type cd windows/microsoft.net/framework/v4.0.30319 (enter key)

Once at this location in CMD, now check Task Manager > Processes for instances of .NET Framework. However since u yourself are running CMD, do not close CMD out. If anything .NET is running there in Task Manager, force them closed.

Then quickly switch back to your CMD window
- type ngen executequeueditems (enter key)

This will allow .NET Framework to complete it's rebuilding of databases. It can take 5-30 mins sometimes to complete, based on how much needs to be done and how slow/fast your system and OS drive is. So just allow it to finish. It will return to "c:/windows/microsoft.net/framework/v4.0.30319" prompt when it has completed.

Are you sure this error or cmd.exe appearing is due to .net framework? If so, why didn't updating it work? What triggered that cmd.exe error?

[Bad 💀 Motha]

If it IS due to .NET Framework, then u should see instances of .NET Framework (in the processes description area) running within Task Manager > Processes

If that is not the case for you, then it could be something else. But that doesn't mean it is malicious. But again that is why it can help to run antivirus/antispyware types of apps to help rule that out.

If you recently did Windows Updates, CMD is often used to then trigger something WU is updating in order for it to complete it's task(s) at-hand.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

If it IS due to .NET Framework, then u should see instances of .NET Framework (in the processes description area) running within Task Manager > Processes

If that is not the case for you, then it could be something else. But that doesn't mean it is malicious. But again that is why it can help to run antivirus/antispyware types of apps to help rule that out.

If you recently did Windows Updates, CMD is often used to then trigger something WU is updating in order for it to complete it's task(s) at-hand.

I went into Safe Mode. I don't think it occurred at all. Could I test this in normal Windows with Task Manager?

I run Microsoft Security Essentials and Malwarebytes relatively frequently. When I ran Malwarebytes yesterday, it found nothing more than usual. Just old junk files from adware I long since got rid of.

I have a long list of processes running right now. It would not be easy to determine what is triggering cmd. I should boot into Safe Mode again to check.

[Bad 💀 Motha]

Well whatever is triggering CMD in Normal mode is more then likely never going to occur in Safe Mode; that is the point of Safe Mode, is a safe means of ensuring nothing extra runs.

I'd start by looking at the Windows Event Viewer > Windows Logs; to see if anything suspicious is listed there that can help point in the right direction and narrow down what it could be.

I'd also scan with other well-known scanners like I mentioned above. They are manual scanners so they won't conflict with your Realtime scanner, like MSE.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

Well whatever is triggering CMD in Normal mode is more then likely never going to occur in Safe Mode; that is the point of Safe Mode, is a safe means of ensuring nothing extra runs.

I'd start by looking at the Windows Event Viewer > Windows Logs; to see if anything suspicious is listed there that can help point in the right direction and narrow down what it could be.

I'd also scan with other well-known scanners like I mentioned above. They are manual scanners so they won't conflict with your Realtime scanner, like MSE.

Where are the Windows logs located?

[Bad 💀 Motha]

Within EVENT VIEWER

A simple search via Start Menu or navigation to Control Panel > Admin Tools u will see that app.

[Sturmgewehr_44]

Bad-Motha の投稿を引用：

Within EVENT VIEWER

A simple search via Start Menu or navigation to Control Panel > Admin Tools u will see that app.

Yep. I found some very disturbing results there. Under "System".

As it turns out, a bunch of errors occuring since the 21st (probably around the time the cmd thing started) were under there. They mentioned a few IP addresses, and something called "Workgroup" could not be registered and would not connect to the computer.

Some of them had a different message, about drivers not being loaded at boot. All of them had the name "NetBT" to them. Not sure what that is. The first errors (as I check back) of this kind(s) started a week and a half ago, which I believe is a bit before I started experiencing the cmd.exe errors I described. Coincidence? I'm a bit creeped out. That IP Address message seemed like something of a Trojan, but who knows...