Getting a very fast Command Prompt popping up.


My Computers

System One System Two

  • OS
    Windows 11 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Alienware 18 Area-51
    CPU
    Intel Core Ultra 9 275HX (24-Core)
    Motherboard
    Alienware
    Memory
    64GB DDR5 6400MT/s
    Graphics Card(s)
    NVIDIA GeForce RTX 5080 and Intel UHD Graphics
    Sound Card
    Onboard, Realtek high-performance Audio chips (ALC3329 & ALC1708))
    Monitor(s) Displays
    300HZ 18-inch QHD 500 nit Comfort View+
    Screen Resolution
    2560 x 1600
    Hard Drives
    2TB NVMe M.2 PCIe Gen 5 SSD
    Case
    Magnesium Alloy
    Cooling
    Advanced Cryo-Tech Quad-Fan Cooling system & large vapor chamber
    Keyboard
    Cherry MX ultra low profile mechanical keyboard with per key AlienFX RGB lighting
    Mouse
    Logitech MX Master 4
    Browser
    Vivaldi (main), Firefox, Chrome, Edge
    Antivirus
    MS Defender and Malwarebytes Free
  • Operating System
    Windows 11 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Microsoft Surface Laptop 7
    CPU
    Qualcomm Snapdragon X Elite (12 Core) ARM based CPU
    Motherboard
    Microsoft Corp.
    Memory
    16GB LPDDR5
    Graphics card(s)
    Qualcomm Adreno X1-85
    Sound Card
    Omnisonic speakers with Dolby Atmos spatial sound
    Monitor(s) Displays
    120 Hz 13.8-inch 600 nit PixelSense Flow touchscreen
    Screen Resolution
    2304x1536
    Hard Drives
    1TB NVMe Gen 4 SSD
    Case
    Anodized Aluminum
    Cooling
    Traditional active cooling fan system
    Keyboard
    Mechanical QWERTY, backlit when in use
    Mouse
    Logitech MX Master 4 and Surface Arc Mouse
    Browser
    Vivaldi (main), Firefox, Chrome, Edge
    Antivirus
    MS Defender and Malwarebytes Free
Mooly said:
Curious thought but I wonder if the faster the PC, the less chance you have of seeing them. The Dell laptop I run the standard W11 build on is 13 yrs old now (early i5). I wonder if that could be a factor.
Click to expand...
Possibly, though now that you mention it I don't think I've noticed it on my little Microsoft Laptop yet. I spend a lot more time in front of my Alienware PC which is where I'll occasionally see the quick command prompt window but it's always to fast to read anything. Both are 10th Gen I7 cpu.
 

My Computers

System One System Two

  • OS
    Windows 11 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Alienware 18 Area-51
    CPU
    Intel Core Ultra 9 275HX (24-Core)
    Motherboard
    Alienware
    Memory
    64GB DDR5 6400MT/s
    Graphics Card(s)
    NVIDIA GeForce RTX 5080 and Intel UHD Graphics
    Sound Card
    Onboard, Realtek high-performance Audio chips (ALC3329 & ALC1708))
    Monitor(s) Displays
    300HZ 18-inch QHD 500 nit Comfort View+
    Screen Resolution
    2560 x 1600
    Hard Drives
    2TB NVMe M.2 PCIe Gen 5 SSD
    Case
    Magnesium Alloy
    Cooling
    Advanced Cryo-Tech Quad-Fan Cooling system & large vapor chamber
    Keyboard
    Cherry MX ultra low profile mechanical keyboard with per key AlienFX RGB lighting
    Mouse
    Logitech MX Master 4
    Browser
    Vivaldi (main), Firefox, Chrome, Edge
    Antivirus
    MS Defender and Malwarebytes Free
  • Operating System
    Windows 11 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Microsoft Surface Laptop 7
    CPU
    Qualcomm Snapdragon X Elite (12 Core) ARM based CPU
    Motherboard
    Microsoft Corp.
    Memory
    16GB LPDDR5
    Graphics card(s)
    Qualcomm Adreno X1-85
    Sound Card
    Omnisonic speakers with Dolby Atmos spatial sound
    Monitor(s) Displays
    120 Hz 13.8-inch 600 nit PixelSense Flow touchscreen
    Screen Resolution
    2304x1536
    Hard Drives
    1TB NVMe Gen 4 SSD
    Case
    Anodized Aluminum
    Cooling
    Traditional active cooling fan system
    Keyboard
    Mechanical QWERTY, backlit when in use
    Mouse
    Logitech MX Master 4 and Surface Arc Mouse
    Browser
    Vivaldi (main), Firefox, Chrome, Edge
    Antivirus
    MS Defender and Malwarebytes Free
I've never seen this happen on "My Computer" below. I've been a OneDrive user since 2007. I'm a Microsoft 365 subscriber which includes 1TB cloud OneDrive.
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell XPS 16 DA16260
    CPU
    Intel Series 3 Core Ultra X9 388H
    Memory
    64GB LPDDR5x 9600 MT/s
    Graphics Card(s)
    Intel Arc graphics B390 Panther Lake
    Monitor(s) Displays
    16" 3.2K Tandem OLED Infinity Edge
    Screen Resolution
    3200 x 2000 16:10 236 PPI
    Hard Drives
    1 Terabyte M.2 PCIe NVMe SSD
    Case
    Black Anodized Aluminum
    Cooling
    Vapor Chamber Cooling
    Mouse
    None
    Internet Speed
    942 Mbps Netgear Mesh + 2 Satellites
    Browser
    Microsoft Edge (Chromium)
    Antivirus
    Windows Security (Defender)
    Other Info
    NPU delivering 67 TOPS
    Microsoft 365 subscription
    Microsoft OneDrive 1TB Cloud
    Microsoft Visual Studio
    Microsoft Visual Studio Code
    Microsoft Sysinternals Suite
    Microsoft BitLocker
    Microsoft Copilot
    Dell Support Assist
    Dell Command | Update
    Macrium Reflect X subscription
    1Password Password Manager
    Amazon Kindle for PC
    Lightroom/Photoshop subscription
    Interactive Brokers Trader Workstation
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Microsoft Surface Laptop 7
    CPU
    Snapdragon® X Elite (12 Core) with Hexagon NPU delivering 45 TOPS
    Memory
    32GB LPDDR5x 8448 MT/s
    Graphics card(s)
    Integrated Adreno GPU
    Sound Card
    Omnisonic speakers with Dolby Atmos spatial sound
    Monitor(s) Displays
    13.8″ PixelSense Flow touchscreen 120 Hz 600 NIT
    Screen Resolution
    2304 × 1536 (201 PPI), 3:2 aspect ratio
    Hard Drives
    1 TB PCIe NVMe Gen 4 SSD
    Case
    Black Anodized Aluminum
    Cooling
    Vapor Chamber Cooling
    Mouse
    None
    Internet Speed
    942 Mbps Netgear Mesh + 2 Satellites
    Browser
    Microsoft Edge (Chromium)
    Antivirus
    Windows Security (Defender)
    Other Info
    Microsoft 365 subscription (Office)
    Microsoft OneDrive 1TB Cloud
    Microsoft Visual Studio 2026
    Microsoft Visual Studio Code
    Interactive Brokers Trader Workstation
    Lightroom/Photoshop subscription
    1Password Password Manager
    Microsoft Sysinternals
    Amazon Kindle for PC
    Microsoft BitLocker
    Microsoft Copilot
I get a command window flash as well, but it is from the 8Gadget pack. One of the gadgets calls a command window on startup. Other than that one, I see no others.
 

My Computer

System One

  • OS
    Win 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self build
    CPU
    Intel i7 13700KF
    Motherboard
    Gigabyte Z790 UD AC
    Memory
    32 GB Team Group DDR5 - 6000 CL 30
    Graphics Card(s)
    ASUS TUF GAMING RTX 3070 Ti
    Sound Card
    On board Realtek
    Monitor(s) Displays
    ACER 34 inch
    Screen Resolution
    4K
    Hard Drives
    1 TB Samsung 980 Pro Nvme, 1 TB Samsung 970 EVO Nvme, 2 x Samsung 970 2TB SSD SATA
    PSU
    EVGA 1000Q
    Case
    Rosewill something or other
    Cooling
    Noctua NH-D15. A whole schwak of Noctua case fans. $$$
    Keyboard
    Logitech G815
    Mouse
    Logitech G502 Hero
    Internet Speed
    700 up, 600 down
    Browser
    Firefox
    Antivirus
    MalwareBytes
In this video, i will show you how to use a powerful application like Autoruns to manage your Windows start up programs, processes and other entries.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Pavilion
    CPU
    AMD Ryzen 7 5700G
    Motherboard
    Erica6
    Memory
    Micron Technology DDR4-3200 16GB
    Graphics Card(s)
    NVIDIA GeForce RTX 3060
    Sound Card
    Realtek ALC671
    Monitor(s) Displays
    Samsung SyncMaster U28E590
    Screen Resolution
    3840 x 2160
    Hard Drives
    SAMSUNG MZVLQ1T0HALB-000H1
pseymour said:
As TraderGary mentioned, Process Monitor can help a lot here, but it's a bit noisy. There's a filter for ProcMon in my post here to help filter out a lot of the noise and just show processes starting and stopping.
Click to expand...
Hey pseymour, I don't see the link with the zip for the procmon filter you created. I'm also having command prompts appear before entering certain windows environments (windows RE, windows installation, and a few during restoring an image from a backup with macrium reflect) and suspect that there is a UEFI Firmware rootkit. The command prompt appears and disappears so fast that only sometimes am i able to make out the text at the top of the prompt by recording with my phone and screenshotting. I made out the words winpeshl.exe once and am further investigating into this file but after looking through windows, does not note this file anywhere.

Thanks
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    Samsung/Galaxybook NP950XDB KC5US
At the top of ProcMon, turn off the three things in the red... uh... whatever shape I made there. Then in the Operation column, right click on a few things to exclude them; they're handy sometimes, but for this type of sleuthing, they're a lot of noise.
  • Load Image
  • Thread Create
  • Thread Exit

View attachment 168931
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
pseymour said:
At the top of ProcMon, turn off the three things in the red... uh... whatever shape I made there. Then in the Operation column, right click on a few things to exclude them; they're handy sometimes, but for this type of sleuthing, they're a lot of noise.
  • Load Image
  • Thread Create
  • Thread Exit

View attachment 168931
Click to expand...
I enabled boot logging and generated thread profiling events every 100 milliseconds but I'm wondering if Process Monitor is able to log the events if I hold shift before pressing restart to enter into Windows Recovery Environment and then once I'm in the Recovery Environment, pressing continue into windows 10? As the command prompts don't appear before a normal restart and only occur in other environments aforementioned. Is this first event in my log the entering into the RE? So it wasn't able to capture the winpeshl.exe command prompt that occurred before this?

Edit: I just turned the filters back off and I have a little bit of events that occur before this. Does anything look suspicious?
 

Attachments

  • Screenshot (8).webp
    Screenshot (8).webp
    397.6 KB · Views: 3
  • Screenshot (10).webp
    Screenshot (10).webp
    515.5 KB · Views: 2
  • Screenshot (11).webp
    Screenshot (11).webp
    482.6 KB · Views: 1
  • Screenshot (12).webp
    Screenshot (12).webp
    487.2 KB · Views: 1
Last edited:

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    Samsung/Galaxybook NP950XDB KC5US
Create cmd.bat with:
Code: 
@echo off
echo CMD was launched with arguments: %*
pause
cmd_original.exe %*

Go to C:\Windows\System32\cmd.exe
Rename cmd.exe to cmd_original.exe

Move your .bat file into C:\Windows\System32\

This will make any cmd use the .bat instead of the .exe and will pause it after execution so it will stay open and you can see what it is



Revert to normal: Delete the .bat and restore the original cmd.exe naming
 

My Computer

System One

  • OS
    Windows 11 Pro
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom