About a minute after Windows starts, a Command Prompt window flashes for less than a second, and then the display goes black. The process does not appear in the normal Startup Apps list. I suspect malware, but a regular Windows Defender quick scan is taking too long. What is the safest way to diagnose and remove it?
3 Answers
If scans cannot remove the problem, back up only personal documents and pictures after checking them, then reinstall Windows from official installation media or use a clean reset. A USB-based reinstall is usually more reliable than trying to clean a severe infection from within the running system.
Check Task Scheduler, not just Startup Apps. Look through tasks that run at login or system startup, especially ones launching cmd.exe, powershell.exe, scripts, or files from unusual folders. Disable suspicious tasks only after checking their file paths, and scan the referenced files before deleting anything.
Start Windows in Safe Mode, then run a full scan with Windows Security. If the infection interferes with normal scanning, use Microsoft Defender Offline or another trusted bootable rescue scanner. Avoid opening unknown files or entering passwords until the system has been checked.
Once I get into Safe Mode, should I run a full scan there or use an offline scanner?
If Safe Mode does not fix it, I will use a clean Windows USB installer rather than keeping the infected installation.