24

I saw in the morning a command prompt window for just one second. After the command finished the window was closed.

I would like to see, what command was run before it closed. Is it possible?

I know, I can see prompt history, if I press F7, but this only works until the command prompt window is closed.

I ran my virus killer applications (Malwarebytes and Windows Defender), but I did not get any result.

I think that was a virus or an undetected malware, that's why so important to me what's going on in the background. More so I am afraid because I downloaded an application from a untrusted source. But I don't want to remove this application, I would like to explore what it does to my system.

Improve this question
6
  • you might try looking into startup applications such as anything in "shell:startup" if this happened after booting the computer
    – Blaine
    Mar 12, 2016 at 12:55
  • 9
    Short answer: no, the command history is not stored anywhere.
    – DavidPostill ♦
    Mar 12, 2016 at 13:05
  • But it has to be a system log where this commands can be found right?
    – user3545446
    Mar 12, 2016 at 15:21
  • @user3545446 There is, to an extent. Open Start and then search "event viewer". Check for any suspicious events and see what they're doing.
    – Dog Lover
    Mar 20, 2016 at 6:04
  • 1
    Just note that it not necessarily might be a virus. Some less elegantly written programs do that sort of thing to check something (like updates, etc) on startup, or do that to start a launcher for startup. You might be able to find what launched it by looking in: 1. msconfig 2. scheduled tasks 3. "Startup" folder on your start menu. But don't panic just yet. If you're worried, do a backup of your most important data first.
    – Wizongod
    Apr 13, 2016 at 13:30

4 Answers 4

Reset to default
11

Install ConEmu and do the following:

  1. Press Win + Alt + P
  2. Go to "Features"
  3. Enable "Log console output (*)"
  4. Clear the line below "Log console output (*)" and change it to "%userprofile%\ConEmuLogs"
  5. Press the button which is at the top right. It should close or ConEmu might give you an error (ignore it unless it is about the log file)
  6. Close the tab you opened in ConEmu if it didn't close automatically.
  7. Press Win + R and enter "%userprofile%\ConEmuLogs"
  8. Press ENTER
  9. Find a file with the following format "ConEmu-YYYY-MM-DD-pNNNN.log"
  10. Open it w/ a text editor, like Notepad.
  11. This log file will contain all the commands run and their output.
  12. Please reply back to tell me if this worked for you and/or I misunderstood you. Have a nice day!
Improve this answer
2
  • 1
    Thx I will try out tomorrow!
    – user3545446
    Jul 15, 2016 at 14:09
  • Thank you for this great illustration of ConEmu. I love ConEmu because it brings poweruser functionality to the oldest DOS console through a nice Windows interface !!
    – Rich Lysakowski PhD
    Oct 6, 2020 at 16:35
0

Running win 10 17763.1, this is the 2018 October per-release of redstone 5. Win-alt-P didn't work, so I ran the desktop shortcut as admin, then went to + in console and then went to (setup tasks) Now I highlighted features and checked log console output. I have left the default location. %UserProfile%\Desktop\ConEmuLogs....

I have run commands in CMD and Powershell as admin, then went to search and pasted in the default location and have two logs. Nether log showed the commands I have run. Appears this will not help with background commands run. Wanted to add for anyone looking at this, Malwarebytes will help with Internet browser problems such as hijackers/scripts but it is worthless for a true Virus/Trojan/worm, same as windows defender. Microsoft purchased defender from Giant, after they injected it into windows it has become very poor. Basically it will catch people who try and use programs that activate windows, it's junk. Install or run a internet software virus check using a real tool such as Avira, Bitdefender, Kaspersky, Norton. If you don't download anything or open any attachments you probably won't get a true virus, just browser problems such as a hijacker. Odiebugs.

Improve this answer
0

Now in 2021, PowerShell has persistent command history.

Improve this answer
0

Clink provides persistent history between windows command prompt sessions. Find visual demo

Clink combines the native Windows shell cmd.exe with the powerful command line editing features of the GNU Readline library, which provides rich completion, history, and line-editing capabilities. Readline is best known for its use in the Unix shell Bash, the standard shell for Mac OS X and many Linux distributions.

Here are some highlights of what Clink provides:

The same line editing as Bash (from the GNU Readline library version 8.1). History persistence between sessions. Context sensitive completion; Executables (and aliases). Directory commands. Environment variables. Context sensitive colored input text. Automatic suggestions from history and completions... and more

For details, refer to the Clink documentation.

Improve this answer
1
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – DarkDiamond
    Apr 9, 2022 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .