I noticed that a random command prompt opens and closes on my system. How should I remove this malware?
Maybe I am just being paranoid but I suspect malware or maybe a bitcoin miner. Command Prompts opens at random intervals and I notice random FPS drops while gaming (10-20 seconds long). I'm using a HP-15 Windows 10 x64 System and have Quick Heal AntiVirus (Paid Version) installed. Intel 4005U 1.7Ghz and Nvidia 820M .Full System scans yielded no results. System also feels a bit unresponsive. This and FPS drop might be due to heat but that still doesn't explain CMD's behaviour. No other unusual behaviour or change in system file was noticed. What steps do I need to take and can I log what CMD is doing?
If a random command prompt opens and closes, you must try to know if your version of Windows allows you to run Local Security Policy or Local Group Policy editor, you can enable advanced audit logging of process start and stop in the system, and the next time it occurs, look in the Security event log to see what process was launched.
To do this, run Local Security Policy editor (in "Control Panel"->"Administrative Tools") as Administrator (right-click on its icon and select "Run as Administrator"), and expand the left-hand tree "Advanced Audit Policy Configuration"->"System Audit Policies"->"Detailed Tracking". Select "Detailed Tracking", and on the right-hand side, double-click on "Audit Process Creation" to bring up the properties dialog. Tick "Configure the following audit events:", and "Success", then click on [OK] to save the setting. It should take effect immediately.The next time the window appears briefly, record the system time (not the time on the clock on the wall), run Event Viewer (in "Control Panel"->"Administrative Tools") as Administrator (see above) and expand "Windows Logs" to select "Security". You should see a number of events; you're interested in the ones with Task Category "Process Creation" with Event ID 4688, at about the time that you recorded. You'll probably see a few events; look at the General tab in the details. You're interested in the Process Information bit, specifically the New Process ID, New Process Name, Creator Process ID and Creator Process Name. There should be a "C:WindowsSystem32conhost.exe" process, which is the Command Prompt window that you see. Its Creator Process Name value will tell you how it was launched. Look at the following events to find one whose Creator Process ID is the same as the conhost's New Process ID. That's the program that actually ran in the Command Prompt.