It happened pretty quickly and I didn't notice exactly what happened in that command window (MS-DOS style). I ran Norton Power Eraser, Malwarebytes and have Norton Anti-Virus on all the time. When it happened, I was on some unfamiliar but not-dangerous web-site (uBlock on).

How can I figure out what happened?

  • 1
    Install the WPT (part of the Win10 SDK: dev.windows.com/en-us/downloads/windows-10-sdk), run WPRUI.exe, select First Level, CPU usage, DiskIO, FileIO and click to start. Now capture 1 minute of the DiskIO after opening cmd.exe. After 1 minute click on Save inside WPRUI. Zip the large ETL file into zip/RAR file, upload the zip (OneDrive, dropbox, google drive) and post the share link here. Mar 19, 2016 at 16:52
  • @magic The activity disk subsided to normal (zero without load) after a while, but I am still (slightly) worried about what actually happened with that command window popping up out of the blue and clearly running some commands/closing done on its own. Recording the current vitals won't help, I assume (as of now CPU hovers between 5 and 10 without any load which might be unusual).
    – A.S.
    Mar 19, 2016 at 17:27
  • WPRUI records in a loop and internally deletes the old data. So run it for a while until you see the issue again. Now go to WPRUI and save the trace Mar 20, 2016 at 8:17
  • @magic The only observable "issue" at the moment is 3-8% idle CPU (i5-4570T) usage. Is that at all a matter of concern? Any guesses as to what could have caused that command window pop-up without looking at current trace data?
    – A.S.
    Mar 20, 2016 at 15:50
  • no, without looking at the trace I can't see anything. In the trace I see all running processes and here I could see a cmd/conhost.exe processes. Mar 21, 2016 at 5:26


You must log in to answer this question.

Browse other questions tagged .