Windows 10: Bitsadmin pops up randomly and immediately disappears.

Where should I use this line?

"Get-BitsTransfer -AllUsers | select -ExpandProperty FileList | Select -ExpandProperty RemoteName"

Enter to cmd? or where? Sorry, I'm a beginner.

Thanks

 

I think you would right-click on the Start button and select Command Prompt (Admin). Then type in (or copy) this code:

Code: Get-BitsTransfer -AllUsers | select -ExpandProperty FileList | Select -ExpandProperty RemoteName[/quote] Then press ENTER.

 

Please, find attached screenshot

 

click start - type powershell - right-click it - run as administrator.

 

Hmmm .. looks like cloudfront.net is the issue... I'm not familiar with that but see if this helps.
http://answers.microsoft.com/en-us/p...3b6b4e2?auth=1

Note: you can get rid of the (non-Windows update downloads) by using :
Get-BitsTransfer -AllUsers | Remove-BitsTransfer

or this in command prompt:

Code: @echo off net stop BITS ipconfig /flushdns del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr0.dat" del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr1.dat" net start BITS net stop wuauserv net start wuauserv[/quote]

 

CMD did something

 

OK, that gives you a clean queue - if it returns there may be an app. that's putting those in there and that app needs to be removed.

Good luck.

 

[/quote]

Thanks @Superfly.
@tkrisz0403 Cloudfront.net is part of AWS (Amazon Web Services), but has been used by the bad guys in the past. If the problem reappears, we'll need to perform some malware removal steps. Please leave the thread open for a few days to see if all is well. If not, post back and we will begin trouble-shooting. If all is good, you can mark the thread as solved.

Cheers!

 

You're welcome budette, as you say, we won't know if that is in fact the cause until @tkrisz0403 reports back how things go - hopefully it's not malware and merely a once-off glitch with AWS.

 

Thanks guys, I'll let you know the result but have not popped up, yet.

 

You're welcome... glad we have made some progress - Holding thumbs, buddy!

After a couple of days run the powershell command again, even if just to check what's happening in the background.

@Hydranix - nice idea - but I think BitsAdmin will always have cmd.exe as parent - maybe the bits service itself may have a calling property... something we could look into.

 

No, not always. Good call on that powershell command by the way.

Run bitsadmin.exe from the start menu and you'll see the parent is explorer.exe. Same goes for CreateProcess(), the parent being the process which called the function (which is what I was hoping for). The fact that a shell was invoked, then bitsadmin.exe was executed in the context of that shell makes me think that maybe the function system() (or similar) was used to execute bitsadmin. It would make sense as you cannot hide the command prompt when using system(), and the only software bad enough to use it would be malware. It could also be a script or something similar.

I do know that nothing in Windows 10 or even from Microsoft would be calling bitsadmin.exe for any reason, especially since it's deprecation. Those links that the powershell command returned look dubious as well.


tkrisz0403, I'd recommend that you don't put any personal/financial information through this computer until you're certain it's safe to do so.

 

If you want to check for malware, let's do this:

Download and run ADWCleaner. Do the scan, save the log and post it here. Do not "clean" until we have evaluated the log. The log can be found at C:\Adwcleaner.
Once we've reviewed the log, we will determine if everything it flagged should be cleaned, or if some are FPs (false positives).

If we find problems, we may then want to run an ESET Online Scan.
Detailed instructions on how to run and manipulate the ESET scan can be found in this thread:
BSOD after boot up, during login or right after, (bad spool header?) Solved - Page 3 - Windows 7 Help Forums

.

 

Hi guys,


Bitsadmin did not pop up since I used @Superfly code. I just run a PowerShell command again, and I also attached the ADWCleaner log screenshot.


Let me know your thoughts *Smile Thanks