A few months ago, a family member visited some questionable websites while searching for Pokémon content. Afterward, typing on the laptop sometimes caused the text "LINK IN BIO" to appear instead of the intended characters. Windows Defender and the Malicious Software Removal Tool did not find anything. Later, several transparent terminal or command-prompt windows briefly appeared in random places during startup before closing. The same thing seemed to happen on another family laptop, even after resetting the computers through the cloud. Could this be malware, leftover terminal sessions, or a normal startup process? I'm worried about turning the computers on and would appreciate advice on how to check safely.
3 Answers
One possible explanation is that a terminal window is being restored after an update or reboot, briefly showing the end of an earlier shell session before closing. If it happens again, record the time and look in Event Viewer, Task Scheduler, and the startup list for a process that launches at that moment. Avoid downloading random cleanup tools or visiting more suspicious sites while investigating.
Brief command-prompt flashes during startup can come from legitimate programs, update scripts, scheduled tasks, or terminal sessions being restored. They do not automatically indicate an infection. Check Task Manager’s Startup apps and Task Scheduler for unfamiliar entries, and make sure Windows and your security software are fully updated.
If Defender and the built-in malware scanner are clean, that is reassuring, but it is not absolute proof that nothing is wrong. Run a full scan, followed by Microsoft Defender Offline if you are still concerned. Also remove suspicious browser extensions and reset browser settings rather than repeatedly resetting the entire computer.
I’m still nervous because the windows appeared on more than one computer, but I’ll try the offline scan and check the startup programs.