CMD runs automatically and uses too much Memory

Question

CMD runs automatically and uses too much Memory

Sughosh S V 40

Sometimes out of nowhere the command propmt pops up and runs for few second and closes soon before closing it manually, and sum times the CMD will be runnning as a background process and will be using around a GB of RAM.

I had similar issue with windows powershell, turned out to be kind of malicious thing, have posted the issue here --> https://learn.microsoft.com/en-us/answers/questions/1349917/windows-powershell-suddenly-pops-and-uses-too-much

I suspect the same thing here but not sure what is causing the issue.

I have attached the task manager image and also the autorun log file(drive link --> https://drive.google.com/drive/folders/1kmL9-wC785d25ML3XW5hI2TS-GjuejLl?usp=sharing), please go through that.

Accepted answer

0 additional answers

Your answer

Answer 1

MotoX80 36,291

I don't see anything in your autoruns files that stands out as questionable.

I assume that you've run Defender/MRT/Malwarebytes scans and nothing was detected.

Download and run process Monitor.

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

In the Filter menu add an include entry for process name is cmd.exe.

User's image

Trace the issue and look for the process. Double click on an entry. Does the command line entry point to some .bat file? What's in that file?

Note the parent PID. That will help you find out how/what launched cmd.exe. Use the task manager to find that PID.

User's image

Sughosh S V 40 Reputation points

2024-05-01T02:17:34.0566667+00:00

I ran MRT took about 3 hours but it didn't find anything
I've included the screenshot of the process moniter and also the log file.

log file --> https://drive.google.com/drive/folders/1kmL9-wC785d25ML3XW5hI2TS-GjuejLl?usp=sharing

I couldn't find the parent PID in the task manager (also added the screenshot).
Also couldn.t find anything leading to a .bat file
MotoX80 36,291 Reputation points

2024-05-01T10:38:44.7733333+00:00

Does the name malta1564.startdedicated.com mean anything to you?

Cmd.exe should not be issuing any TCP calls. But the call stack in the trace only shows Microsoft dlls.

You didn't capture process startup, so if its been running for a while, it might be that PID 3088 has already terminated.

Try running a Defender offline scan.

https://www.thewindowsclub.com/offline-scan-using-windows-defender

Start the procmon trace as soon as you log in after a reboot. See if that catches the cmd startup, and if the parent PID is still running.

Did you try scanning with Malwarebytes?
Sughosh S V 40 Reputation points

2024-05-01T15:17:30.6166667+00:00

I dont know what this "malta1564.startdedicated.com" is...
I ran the Malwarebytes and it detected 5 malwares, i've attached the log --> https://drive.google.com/drive/u/1/folders/1kmL9-wC785d25ML3XW5hI2TS-GjuejLlall of the results looked like pointing to microsoft.
MotoX80 36,291 Reputation points

2024-05-01T16:19:42.1066667+00:00

Its pointing to this file.

C:\USERS\SUGHOSH_SV\APPDATA\LOCAL\UPDATES\WINDOWSSERVICE.EXE

What other files are in that folder? See if you can rename that .exe to something like .xxx so it can't run. And move the file to some other folder.

Then reboot and see if the file reappears. If it does, then you have another malware program somewhere that is maintaining the infection.

If the program doesn't reappear, watch cmd.exe and see if acts the way it did. Maybe trace it with procmon and see if connects to .startdedicated.com.

The timestamp on that file is Sat Mar 23 11:52. Do you remember installing or running something on that day?
Sughosh S V 40 Reputation points

2024-05-01T17:31:07.7366667+00:00

Actually in this folder --> C:\USERS\SUGHOSH_SV\APPDATA\LOCAL\UPDATES there is no exe fil,and when I put the whole address(C:\USERS\SUGHOSH_SV\APPDATA\LOCAL\UPDATES\WINDOWSSERVICE.EXE) in the address bar it says windows cant find this...

addeed the files I found in that folder to the drive --> https://drive.google.com/drive/folders/1wP7Flu6uj0HWQY4ciJX6CbgDAHGPPQ6W?usp=sharing

I dont remeber the day 23rd March other than installing qbittorrent and I suspect I downloaded a movie from Tamil.mv site.... that day
MotoX80 36,291 Reputation points

2024-05-01T17:38:12.7833333+00:00
What's in the .txt and .log files?

Open a command prompt with "run as administrator". Cd to the folder and look for hidden files.

cd C:\USERS\SUGHOSH_SV\APPDATA\LOCAL\UPDATES dir /a

If you don't see any other files, then rename and move the .bin file.
Sughosh S V 40 Reputation points

2024-05-02T02:21:43.2466667+00:00

I've uploaded those files here --> https://drive.google.com/drive/u/1/folders/1wP7Flu6uj0HWQY4ciJX6CbgDAHGPPQ6W

It looks loke those files contain some hash values or some kind of keys.

couldn't get to see the cmd running again since Malwarebyte scan. Also ran Defender offline scan, where can i see the logs of Defender offline scan?
MotoX80 36,291 Reputation points

2024-05-02T12:19:43.32+00:00

See https://serverfault.com/questions/816870/where-are-windows-10-defender-offline-scan-logs-results

The resource.bin file looks like it is encrypted. There are no text strings visible. The other files don't have anything useful.

I'd suggest zipping up those files and save the .zip file in some other folder. Mainly in case you need to submit it to some malware analysis site. Then delete that Updates folder. And delete the scheduled task too.

Maybe reboot and run another Malwarebytes scan. See if cmd.exe still acts up.
Sughosh S V 40 Reputation points

2024-05-03T01:44:53.8+00:00

How can I check the scheduled task?
MotoX80 36,291 Reputation points

2024-05-03T11:10:24.7166667+00:00

Use computer management.

Look for this.
Sughosh S V 40 Reputation points

2024-05-04T04:03:39.7433333+00:00

Looks like malwarebytes did the job. Couldn't find anything after the scan.CMD not running as a background process now, everthing looks normal thanks for the assistance
MotoX80 36,291 Reputation points

2024-05-04T12:57:33.0733333+00:00

You might want to be more careful about the programs that you download and run.

Share via

CMD runs automatically and uses too much Memory

0 additional answers

Your answer