1

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on.

I've also downloaded the necessary software for development: Java, Adobe programs, FTP clients etc. I didn't install any free-ware software, so I don't think I have some malware that came as a bundle with a freeware app.

Recently I've noticed that time to time the Command line application would open for just a split-second.
This is definitely non-expected behavior as none of my applications are supposed to do that. Using Windows defender didn't show any malware, but I'm afraid it's too limited of a search.

I'd like to know if there's a way to see what cmd executable was launched. Is there a log file somewhere that would tell me what was opened or maybe start tracking the activity. Or, at least, disable cmd's ability to auto-close the window after execution?

My steps so far:

  • Checking the activity manager for suspicious tasks/opened applications.
  • Using Windows Defender scanning
  • Set Windows firewall to highest security setting in hopes to prevent malware to upload info from my PC.
  • Is Java installed? I've seen that behaviour in the past from the Java updater getting confused due to, well, practically anything. It is easily confused. Else try the Sysinternals Process Monitor and Process Explorer tools: technet.microsoft.com/en-gb/sysinternals/bb795533 – Matthew Jan 27 '16 at 9:14
  • Yes, Java is installed, actually. I wonder is that's the case because I've installed the latest version ( I always used 6th version for work ) that does this. – Creative Magic Jan 27 '16 at 9:19
  • It's very annoying. Worth checking though - at a previous job, whenever I accessed some online admin systems for specific tools, I would get a flash of Java command line. – Matthew Jan 27 '16 at 9:25
  • Related question on SU: 2013-06-03: Does Windows log programs that have been run/called? – StackzOfZtuff Jan 27 '16 at 10:28
1

According to this answer, there is no way the history is written down somewhere on the system natively.

But I am sure that you will find a tool that can track when what process was started like one of these:

0

You can investigate it by doing some prefetch analysis. In windows, you have something known as prefetch files located under directory 'C:\Windows\Prefetch'. This creates a .pf (prefetch file for every process launched on your system even if launched once). There are many tools to analyze prefetch files (like WinPrefetchView). In the below image you can see for all the processes run in the past it has created a cache which maintains like last run time, no. of times run etc. By looking at all the *.pf files last run time, you can check if any suspicious application ran after you logged in ;) Hope it helps!!

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.