Weird little DOS windows appearing and disappearing on my computer!!!!!

[DungeonmasterCal]

In the last few days, when I'm on my PC (running Windows XP Professional) I'll notice a very very brief DOS window appear and disappear in a fraction of a second. This happens every few minutes. I ran my antivirus scan and detected nothing, and ran my anti-spyware, which did nothing to alleviate this issue.

Can anyone tell me what is going on? There's nothing in the window that I can see, but it's really distracting and I'm sure indicative of something not good. It happens when I'm running Internet Explorer and Firefox.

Please please please tell me I'm not facing another hard drive backup and reformat!!!! I'm not versed enough in computer arcana to hunt and peck in the registry or other code to fix things, so hopefully this is something that is an easy fix.

Thanks, ENWorld!

 

[Seravin]

Hate to say it, but it sounds like spyware; unfortunately not all spyware is detectable by all (or even any) anti-spyware utilities. At a guess, you have a service running that's running something that requires a cmd window. If you're lucky, you might be able to get rid of this by deleting downloaded files (in IE - Tools - Internet Options - General Tab - Delete Files Button).

Since not all anti-spyware programs are 100% effective, you should probably download at least one other antispyware utility and run it also (I like AdAware and Spybot). Ditto with the anti-virus. McAfee and I think TrendMicro will do an over the net scan of your pc.

Alternative:
If you're lucky and/or fairly observant, you might be able to isolate the service in the Task Manager - assuming it's only on the list when the cmd window launches.
Right Click on the task bar and choose Task Manager. Under the Process tab, click on the left most title (Image Name) to sort by name. Then wait. When the cmd window opens, the process should appear. If it doesn't, click the title name again to sort in reverse order and wait again. You might be able to google the name of the process and get an answer on how to remove.

Hope that helps...

 

[dvvega]

Apart from spyware ... Windows (Microsoft) itself runs little dos box stuff as well.

For example SQL Server has a dos window (normally too quick) in some of its start up.

You may never haev seen them before due to many reasons - two of the most common
1. your computer has slowed down (getting too full, disk fragmentation, etc)
2. you have a lot of startup stuff that just slows the machine down and things now show

But I would check everything of course. I believe AdAware is pretty up to date with all spyware so try that out.

D

 

[DungeonmasterCal]

Thanks a lot! I'll take some time and look into the suggestions. I do have Spybot and Ad-Aware, but have only had time to run Spybot thus far.

Thanks!!

 

[andargor]

Thanks a lot! I'll take some time and look into the suggestions. I do have Spybot and Ad-Aware, but have only had time to run Spybot thus far.

Thanks!!

One way of finding out what is being executed is monitoring file activity, assuming that an executable gets launched from disk. You can use the free Filemon utility for that, available here.

This, however, will produce huge logs. But it may be the only way you can spot what is going on. Just quit every application, launch Filemon, and wait until the strange box appears, then stop logging. Don't do anything else, as that will get logged and just clutter up everything.

There might be some other activity going on, which is probably normal. Just wait for the right time.

HTH,

Andargor

EDIT: Look in the utilities section of that site, there is also RegMon which monitors registry activity in real time.

 

[bullseye]

There's a utility called HijackThis which does a pretty solid job of telling you everything which runs at startup that isn't part of the standard windows load (and a few things that are but are suspect). If you don't have any idea what you're looking at when you run it, you can have it save a log and there are a number of forums out there where you can post the logs and someone will tell you which thing(s) to get rid of. I use it all the time at work to clean users systems, since I know what's supposed to be on them and I can't lock them down as tightly as I'd like. It's free, too.

 

[RuminDange]

There's a utility called HijackThis which does a pretty solid job of telling you everything which runs at startup that isn't part of the standard windows load (and a few things that are but are suspect). If you don't have any idea what you're looking at when you run it, you can have it save a log and there are a number of forums out there where you can post the logs and someone will tell you which thing(s) to get rid of. I use it all the time at work to clean users systems, since I know what's supposed to be on them and I can't lock them down as tightly as I'd like. It's free, too.

A co-worker linked me up with a site for those that don't want to post the log file from HijackThis on a forum and wait for someone to tell them what to do, you can go to hijackthis.de and paste the log file and this site will attempt to analyze it and tell you what is good / bad / or unknown.

RD

 

[Darth K'Trava]

Thanks a lot! I'll take some time and look into the suggestions. I do have Spybot and Ad-Aware, but have only had time to run Spybot thus far.

Thanks!!

Also, if you have norton antivirus, run that too. It can find files those miss but, don't ask why, won't delete them. That is the only gripe I have about that.

 

[MerakSpielman]

Remember to run all the spyware removal software in Safe Mode. If you run it in a normal boot it can't remove everything.

And it can't hurt to go thorugh your directories manually and see if you can spot anything suspicious.

 

[thatdarncat]

The same guy who wrote hijackthis also wrote a utility called startuplist. You'll find a link here. http://www.spywareinfo.com/~merijn/downloads.html