command prompt popping out in the middle

[richard_das1]

hi
i am encountering the same problem of cmd popping out in the middle and found out the culprit program by screen capturing which is none other than c:\windows\system32\ipconfig.exe.....now what to do, please guide me.

 

[Kijubei]

Hi richard.

I have the same issue. Ipconfig pops up in a cmd window excatly every minute. I tried serval anti-Vir tools, including Windows-Defender (nothing found), Malwarebytes (found stuff, didn't fix the problem) and Sophos. Sophos found a threat in C:\Users\{yourname}\AppData\rundir\skud.exe that may or may not be related.

It would be nice if you could navigate to C:\Users\{yourname}\AppData\rundir\ and look if there is any suspicius looking file, Richard. Please keep in mind, that AppData is hidden, so you have to set your options accordingly.

If you have indeed the same file there, I will investigate on this file some more.

 

[hang-the-9]

Need more details here, "same problem" does not explain what is going on. When did this start, did you try doing something before the issue started? ipconfig is just a command to get your network information.

 

[Kijubei]

The cause of the problem remains unkown. I would assume it is a virus of some sort.

The problem itself is that a cmd windows pops up exactly every minute and ipconfig is run in it. It closes instant so you have to use some kind of screen capturing method to even know what is run in the cmd. What happens with this information is also unkown. But is reveals information about the network you are in, like you said, and I think that is enough to be worried.

And if you google a bit around, this problem occours quite a lot recently. So whatever virus this is, it seems to be a recent one and I couldn't find a fix, yet.

 

[Kijubei]

Good news.

I think I fixed it for good now. After updating Malwarebytes I ran a scan again (this time with free premium access granted by the update, not sure if that made a difference). And, like before, it found quite some stuff that I got rid off, but this time it seems to be gone! No more command windows poping up every minute and the file at C:\Users\{yourname}\AppData\rundir\ doesn't apear anymore as well.

So in conclusion:
* Update Malwarebytes
* Delete directory at C:\Users\{yourname}\AppData\rundir\
* Scan with Malwarebytes
* Restart as instructes by Malwarebytes

Hope this helps.