Windows 10: Command Prompt pops up all the time

Thanks a lot guys for your time. what a great community.

 

I have this problem for over a week now. I am new here and i don't know what to do about this.



:)

 

Command Prompt Popping Up

I have posted on a few Antivirus/Security forums about this problem and I was told someone here could help me. I am copying and pasting my original post from there to here so you will know the whole story.

1st post:

A few days ago I attempted to download a freeware program. I don't remember the site it was on. As I was installing it it was taking a long time and I got suspicious so I stopped
it. My suspicions were correct. There was a bunch of new programs installed on my computer. Because of the amount of programs I decided to do a system restore. That got a lot of the junk off my computer. I then ran a full scan with Windows Defender and it
found a trojan which I removed. I then ran a Malewarebytes premium scan and it found a bunch of stuff which I removed. I think most of the bad stuff has been removed but I am still having one issue. Every hour or so two command prompt windows will pop up one
after the other for less than a second. It happens so fast that I am unable to get a screen shot from it or see if anything comes up in task manager when it happens. I did manage to see something one time when it popped up, it said bitsadmn.exe. I searched
for that on google and found that it is a windows process but the file could be infected so I searched my computer for that file but it's not on my computer. I am thinking that it could be something trying to update some of those programs that were installed
but I am not sure and I still want to get rid of it because if it happens while I am playing a game it causes the game to minimize for several seconds and puts it in windowed mode. I am running Windows 10 Version 10.0.14393 Build 14393 on a Lenovo Z70 laptop.
This is kind of embarrassing for me because I am currently studying for my A+ certification and I can't figure this out. I appreciate any help you folks can give me.

------------------------------------------------------------------------------------------------------------------------------------------------

After that post I was instructed to run AdwCleaner and Junkware removal tool. Those are products
from Malwarebytes and both found infections and cleaned them. I was then told to run System File Checker by opening command prompt as administrator and run System File Checker by entering sfc /scannow.
That came back clean. I then decided to download a screen capture program so I could get screenshots of the pop up. I am posting the images below. It appears a file called cmd.exe is the culprit. That file is in my System32 folder and it is 228KB.
As you can see it references Bitsadmin.exe which I have learned is a valid Windows file but when I search my computer for Bitsadmin.exe it says no file with that name exist. I need to know if simply deleting the cmd.exe file will fix my problem or is there
another file or registry entry that is causing that program to be executed. Thanks for the help.

First screenshot

Second screenshot

 

Command Prompt POP-UP

Hi Ashley,



Thank you for posting on Microsoft Communities.



I will be glad to help you with the issue you have with the computer. I understand the frustration when things don't work the way it should.



Did you make any changes on your computer prior to this issue?

Let’s follow these methods & check if it helps.



Method 1

a) You may check in
task manager if there is any process running for command prompt.

b) Under Processes tab if it’s there, select the process & click on ‘End Process’. Thereafter, check if the issue persists.



Method 2

You may configure the computer in clean boot state and then try to install the update. It will start Windows Vista by using a minimal set of drivers and startup programs and helps to eliminate software conflicts.

The following link has steps showing how to perform clean boot: http://support.microsoft.com/kb/929135

Note: Please ensure that the computer is set to start as usual by following the step 7 from the article: How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows7:
http://support.microsoft.com/kb/929135

Hope the information helps. Please post in case you have any further issues, we are happy to help you further.

Thank you.

 

One possibility is that it is the path to malware removed by Windows Defender or your antivirus program. Press the Windows and "R" keys simultaneously, type "taskmgr" into the "Open" box and click "OK". When task manager opens, click on the "Startup" tab and see if it is in there. If so, disable it.

Ben

 

The garbled, nonsensical .exe name almost certainly points to adware related. Run Malwarebytes free or SuperAntispyware free scans and remove. Google to find download sites, if not already installed.

 

I disabled it but the problem persists. I also tried Malwarebytes, it indeed cleaned my pc but the cmd never stops popping and sends that message box

 

Before using Malwarebytes the cmd pops up and opens Chrome auto, after the clean up it only sends that message box over and over

 

You might try the trial version of a commercial antivirus program.

trial version antivirus - Google Search

Ben

 

See if that startup app is sitting in your registry. Look in those locations in your registry. Delete anything that you find in the following folders that have that garbled name in it.

Registry
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\ CurrentVersion\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\ CurrentVersion\RunOnce
• HKEY_USERS\S-1-5-21-1511862805-553653610-1676808964-1001\ SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_USERS\S-1-5-21-1511862805-553653610-1676808964-1001\ SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

 

Nah nothing unusual in the registry. *Sad

 

Do a search in the Registry for: ethwtitd
See if it finds anything.

 

Try to find it in AutoRuns

 

At last, Thanks dude.