Command prompt window randomly pops up and turns off

Discussion in 'Windows OS and Software' started by Deks, Sep 6, 2021.

  1. Deks

    Deks Notebook Prophet

    Reputations:
    1,262
    Messages:
    5,189
    Likes Received:
    2,063
    Trophy Points:
    331
    hey guys.
    Need a bit of help with this.

    So, I have a Command Prompt window popping up every time I start up the computer... but it shuts down almost immediately.

    Similarly, throughout my working session, the command prompt window pops up and disappears instantly at random intervals and reads as following:

    C:\Users\Deks Roning\AppData\Roaming\ihruawe

    I don't use Microsoft office.
    I scanned the system using Windows Defended, Avira (just to be sure) and Malwarebytes.

    All came up clean.
    I also ran sfc/scannow and everything is fine (there are no file integrity problems).

    The command prompt window stays open the longest (a couple of seconds) at first reboot after I go to mscconfig>services, press 'Hide all Microsoft services', then 'disable all' and restart the system - without doing so, it opens and closes instantly after a reboot.

    Most often, the command prompt window seems to open and instantly closes when I'm watching videos using say Amazon Prime Video or Pot player (I have the latest drivers - those aren't the problem as the issue didn't exist on my previous Windows install with same drivers) - but it also appears during browsing, etc.

    I could really use some help in identifying why this is happening and how to stop it because this never happened before.

    I did a fresh Windows 10 Home x64 install a couple of days ago seeing as I bought a new 2TB nVme SSD (which is working fine) and have all the updates for it.

    I also uploaded the screenshot of the window in question.

    I tried looking up solutions online, but nothing of relevance showed up.

    EDIT: Tried going into the directory itself and there's nothing named ihruawe related there.
     

    Attached Files:

    Last edited: Sep 6, 2021
  2. N2ishun

    N2ishun Notebook Consultant

    Reputations:
    94
    Messages:
    258
    Likes Received:
    143
    Trophy Points:
    56
    Key word roaming.
    That usually means something is hitting the internet....and it sounds like w/o your permission.
    the word ihruawe returns nothing nor does translate bite on it.
    although there is a down the line link to some online casino....hmm.
    Use file explorer and get to that file, scan that file with defender or whatever you have.
    I B thinkin U B haxored.
     
  3. Tech Junky

    Tech Junky Notebook Deity

    Reputations:
    251
    Messages:
    1,085
    Likes Received:
    392
    Trophy Points:
    101
    I would probably boot into safe mode and then delete that folder. If it comes back then dig deeper into what it's running.

    These sorts of things indicate some sort of spyware being launched periodically. Somewhere you went or something you opened is most likely the source of this.

    While in safe mode you should run another scan to see if you can pick up anything else that's hiding. There are other online scanner apps you can use as well to detect issues.

    https://www.trendmicro.com/en_us/forHome/products/housecall.html
    https://www.eset.com/us/home/online-scanner/

    I don't trust MSFT scanners to pick things up as they false positive on things I don't want them to delete MW bytes isn't too bad but, sometimes does the same thing. Never used avira though.

    I disable all of that stuff anyway and only scan when I see an impact such as bank alerts or increased spam showing up.
     
  4. NeXt3R

    NeXt3R Notebook Evangelist

    Reputations:
    59
    Messages:
    531
    Likes Received:
    92
    Trophy Points:
    41
    open this app-folder
    any **** ,..,malware ? .,.,,. verify folder "next files" or remove this directory !

    folder is hidden "copy this on explorer" appdata - setting for apps
    C:\Users\youraccountname\AppData\Roaming

    //edit
    or open this .BAT or next files in folder "for determine app usage"
     
  5. NeXt3R

    NeXt3R Notebook Evangelist

    Reputations:
    59
    Messages:
    531
    Likes Received:
    92
    Trophy Points:
    41
  6. Deks

    Deks Notebook Prophet

    Reputations:
    1,262
    Messages:
    5,189
    Likes Received:
    2,063
    Trophy Points:
    331
    I actually decided to reset windows by removing all software and data... seems to work fine now (no random command prompt popup).
     
  7. StormJumper

    StormJumper Notebook Virtuoso

    Reputations:
    579
    Messages:
    3,512
    Likes Received:
    480
    Trophy Points:
    151
    Here's the problem too many A/V prevent proper protection. Get rid of Avira and use Defender that is more then sufficient to scan. Also as other mentioned Boot in Safe Mode to find out what should be running and what not. And if you go to remove program and see C:\Users\Deks Roning\AppData\Roaming\ihruawe isn't part of the O/S running then be suspect of it. I seen the CMD popup but that it's loading it's own software as part of the O/S itself.
     
  8. Deks

    Deks Notebook Prophet

    Reputations:
    1,262
    Messages:
    5,189
    Likes Received:
    2,063
    Trophy Points:
    331
    I did a Windows reset while also removing all files from the OS. That got the OS to baseline level (same as when it was clean installed), and now its running fine.
     
Loading...

Share This Page