Question Is my PC safe?

[aymanfarshid94]

Hello everyone, for the last few months I have noticed that whenever I boot/restart my pc, right after the log on screen right when the desktop appears, there’s a cmd window that pops up and closes in less than a second. Since a couple of days back now, out of the blue a windows powershell window and a cmd window both appear upon log on on the desktop screen and disappear within a few seconds before I could notice anything specific written to describe.

I don’t have security or virus issues usually and don’t show a lot of concerns because it’s been that way for years but this has started to bother me a little mostly because of what I have heard about how a pc can be used for mining remotely thru a random hidden program.

Things I have tried -

1. I am an advocate myself for using windows defender only and I have it updated and running but no threats detected
2. I checked startup apps and found neither cmd nor powershell enabled (not sure if they even can be) but some reason edge and edge updated were enabled without my knowledge
3. Sigh, shamelessly for a second opinion I downloaded panda security and ran a full scan overnight and just found one file detected as a Trojan which was a iw4x sp file from a pirated cod mw2 game I have downloaded. I deleted it from quarantine and need to check if the problem has been rectified but it still hasn't
4. I used rkill and malwarebytes, it deleted something but no changes as they pop up again during restart

Things I have to try -

1. Check windows event viewer to see what’s happening
2. See if those apps are listed in windows scheduler
3. If all else fails, reset pc and hope it goes away

Thanks for your suggestions in advance

 

[velocityg4]

Some app is just issuing a shell command at startup. It's not that unusual. It could be anything really. I know this can happen a lot with HP network printers. Sometimes some installer or uninstaller that's executing at startup but never completing or did complete but the one time process never deleted itself.

I'd just note the exact time it pops up. Then look in Event Viewer. To see exactly what command is being executed. But this sort of thing is pretty normal. Since the scans showed nothing. I wouldn't be very worried. Just confirm what it is.

 

[Ralston18]

Event Viewer - yes.

Hopefully there is some informational event event being captured. But take a close look at any errors or warnings that were captured just before or at the time of the Command Windows' appearance and disappearance.

However, also look in Task Manager > Startup and also in Task Scheduler.

Run all with with Admin rights.

In Task Manager also check the other tabs for something you do not recognize or expect. Do not immediately disable or terminate anything without learning what it may really be and what it does.

Resource Monitor may also pick up on some change that occurs when the Command Window appears and disappears.

You can also use Process Explorer (Microsoft, free) to learn more about what is going on in the background.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer