About a minute after I start my Windows PC, a Command Prompt window flashes on-screen for less than a second, and then the display goes black. I suspect malware, but I don't see anything unusual in the Startup Apps list. Windows Defender's quick scan is also taking a long time. What steps should I follow to diagnose and remove it?
3 Answers
If the screen still goes black in Safe Mode or scans can’t complete, use a clean Windows installation USB to access recovery tools and scan the drive offline. Back up only essential personal documents, then consider reinstalling Windows from trusted installation media if the infection can’t be removed. A full clean reinstall is safer than a factory reset that might preserve compromised files, and you should change important passwords from a different, clean device afterward.
Start Windows in Safe Mode, where most third-party programs and malware won’t load. From there, run a full scan with Microsoft Defender, not just a quick scan. You can also run an offline scan from Windows Security so the scan happens before normal Windows processes start. Disconnect from the internet first if you’re worried about the infection communicating or downloading anything.
Check Task Scheduler as well as Startup Apps. Search for Task Scheduler, review tasks that run at logon or system startup, and look for entries launching cmd.exe, PowerShell, scripts, or files from suspicious folders such as temporary user directories. Don’t delete system tasks blindly—check the action, file path, publisher, and creation date first.
Once I’m in Safe Mode, should I check Task Scheduler before running the scan, or just scan first?
If you use a USB installer, make sure it was created on a clean computer and double-check that you’re selecting the correct drive before deleting partitions.