Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A flashing cmd.exe window followed by an unwanted Chrome advertising page is suspicious, but it does not prove a browser hijacker or WMI-based malware. The same symptom can come from a scheduled task, startup entry, browser extension, policy, shortcut, service, notification permission, DNS or proxy setting, a legitimate updater, or a leftover persistence mechanism.
The safest approach is to preserve evidence, identify what launches Chrome, then remove only the confirmed cause. In the original BleepingComputer case behind this topic, the root cause was never conclusively established: the thread was closed on February 17, 2025 after the user stopped responding.
What the symptom can—and cannot—tell you
A command prompt that appears briefly after login or during the first Chrome launch may be running a batch file, PowerShell command, script, updater, or executable. If Chrome then opens an advertising destination, the launcher may be passing Chrome a URL. But timing alone cannot identify the mechanism.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Possible causes include:
- A scheduled task launching a script or browser command.
- A per-user or system startup item,
Run/RunOnceregistry value, or service. - An unwanted extension, browser policy, modified shortcut, corrupted profile, or notification permission.
- PowerShell, VBScript, batch, JavaScript, or executable-based persistence.
- A permanent WMI event subscription triggered by logon, process creation, or a timer.
- DNS, proxy, router, or hosts-file manipulation.
- Legitimate software that launches a console process or opens a web page.
- A removed payload whose startup or persistence entry remains.
Do not equate a flashing command window with malware. The useful evidence is the process command line, parent process, destination URL, file path, signature, timing, and persistence location.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Browser hijacker versus WMI persistence
What is a browser hijacker?
A browser hijacker is unwanted software or configuration that changes browser behavior. Typical signs include an unauthorized homepage or search engine, repeated redirects, unknown extensions, persistent pop-ups, unwanted push notifications, manipulated search results, modified browser policies, or a shortcut containing an extra URL or command-line switch.
Adware, potentially unwanted programs, malicious extensions, and ordinary website notification abuse can look similar. A single blocked advertising redirect is evidence worth investigating, not proof of a full browser hijack.
What is WMI-based persistence?
Windows Management Instrumentation (WMI) can be abused through permanent event subscriptions. A malicious event filter, consumer, and binding can run a script or executable when a condition occurs—for example, at logon, after process creation, or on a timer.
WMI persistence is a technical hypothesis, not a diagnosis. Failing to find a scheduled task does not imply that WMI is responsible, and many WMI objects belong to legitimate management, security, or enterprise software. Do not delete WMI objects with random commands.
What happened in the original support case?
The BleepingComputer support thread was opened on February 11, 2025. The user reported a brief command-prompt process after boot and during the first Chrome launch, followed by an advertising page identified in the thread as ooftauchaud. uBlock Origin blocked the page.
Rank #2
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
- 4GB DDR4 System Memory; 128GB Solid State Drive
- 11.6" HD (1366 x 768) Multi-Touch Display
- Combo headphone/microphone jack - Noble Wedge Lock slot - HDMI; 2 USB 3.1 Gen 1
- Windows 11 Pro
The reported scans did not identify a clear cause:
- Malwarebytes was run with rootkit detection enabled.
- AdwCleaner was run with fixes applied.
- HitmanPro reportedly found tracking cookies.
The user had also checked Chrome settings, startup programs, scheduled tasks, services, the registry, Autoruns, and Process Monitor. The listed FRST report identified Windows 10 Pro 22H2, build 19045.5371, and included several Google, Edge, and Defender policy restrictions. A restriction or “Attention” entry alone is not proof of maliciousness; it may come from enterprise administration, hardening software, privacy tools, previous configuration, unwanted software, or malware.
The visible “Shortcuts & WMI” material did not demonstrate a WMI infection. A responder supplied a case-specific FRST fix and raised indications of possibly pirated Adobe software as a risk factor. The user did not provide the requested follow-up, so neither the fix nor the suspected software was proven to be the cause.
Recommended Free Tools
Do this before removing anything
- Record the trigger. Note whether it happens immediately after login, only on the first Chrome launch, on every launch, or only on a particular network.
- Capture the destination. Photograph or copy the complete URL. Do not revisit it unnecessarily.
- Record timing. Write down the date and time of each occurrence.
- Preserve suspicious files. Before deleting anything, record the full path, hash, digital signature, publisher, parent process, and command line.
- Back up important personal files. Do not include cracks, unknown scripts, executables, or suspicious browser-profile data in a clean backup.
Avoid stacking cleanup tools or deleting entries while a specialist is reviewing logs. Premature cleanup can destroy the evidence needed to identify the launcher.
Check Chrome without destroying evidence
- Open
chrome://extensions. Remove extensions that are unknown, recently installed, installed outside the Chrome Web Store, or unnecessary. Record their names and IDs first. - Open
chrome://settings/resetand select Restore settings to their original defaults if the behavior appears browser-specific. Make sure you know your website passwords first; resetting can remove cookies and session data. - Review Chrome’s startup pages, search engine, homepage, and notification permissions. Remove unknown notification sites.
- Open
chrome://policy. On a personal computer, investigate policies that force an extension, homepage, search provider, proxy, or other setting. On a managed computer, policies may be legitimate. - Inspect every Chrome shortcut. Right-click it, choose Properties, and confirm that Target ends at the legitimate
chrome.exepath. An appended URL or unfamiliar command is suspicious.
A Chrome reset or reinstall may not remove a scheduled task, service, registry startup item, WMI subscription, modified network setting, or synchronized profile that restores an unwanted extension.
Find what launches Chrome
Download diagnostic tools from Microsoft’s official Sysinternals page, not an unofficial mirror.
Rank #3
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Autoruns
In Autoruns, review the Logon, Scheduled Tasks, Services, WMI, Explorer, and browser-related sections. For each unfamiliar entry, check its file path, signer, publisher, parent process, and purpose. Do not disable or delete an entry solely because its name is unfamiliar.
Free tools Windows power users keep installed
One-click scans. No signup required.
Process Monitor
- Start Process Monitor immediately before reproducing the issue.
- Filter for
chrome.exe,cmd.exe,powershell.exe,wscript.exe, andcscript.exe. - Look for Process Create events, command-line arguments, Run-key reads, browser-policy reads, and access to
.bat,.cmd,.ps1,.vbs,.js, or unfamiliar executable files. - Stop capture immediately after the redirect and save the
.PMLfile.
Process Explorer
Use Process Explorer to inspect the parent process, command line, image path, signature, and process tree for Chrome or the transient console process. The parent process often provides more useful evidence than the visible command window.
Inspect common Windows persistence locations
Startup folders
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup
%ProgramData%MicrosoftWindowsStart MenuProgramsStartUpRegistry startup keys
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnceInspect the referenced file and its signer before changing a value. Export the key or document it first.
Scheduled Tasks
List tasks with PowerShell:
Get-ScheduledTask |
Select-Object TaskName,TaskPath,StateInspect a task’s actions before removing it:
Get-ScheduledTask -TaskName "TaskName" -TaskPath "Path" |
Select-Object -ExpandProperty ActionsPay particular attention to tasks that launch cmd.exe, powershell.exe, wscript.exe, mshta.exe, rundll32.exe, files from %AppData%, %Temp%, or %ProgramData%, or Chrome with an external URL. These are investigation clues, not automatic proof of malware.
Services and browser policies
Check recently created or unsigned services and verify their executable paths. Do not disable Microsoft, hardware, security, or vendor services without confirming their purpose.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Review Chrome policy locations:
HKLMSoftwarePoliciesGoogleChrome
HKCUSoftwarePoliciesGoogleChromeCheck the policy value, its origin, and the setting it enforces. An unexpected extension-installation, homepage, search, or proxy policy on a personal computer deserves investigation; a workplace-managed device may legitimately have all of these.
Check WMI only when the evidence points there
A trained analyst can enumerate WMI filters, consumers, and bindings with Autoruns or carefully constructed PowerShell queries. The goal is to document the complete chain:
- Namespace.
- Event filter and trigger.
- Consumer type and command.
- Binding between filter and consumer.
- Executable or script path.
- Publisher, signature, and expected owner.
Export or document the object before any removal. Remove only a subscription confirmed to be malicious. If you cannot interpret WMI objects confidently, use a reputable malware-removal forum or professional incident-response service rather than experimenting with deletion commands.
Run reputable scans
- Update Microsoft Defender and run a Full scan.
- If suspicion remains, run Microsoft Defender Offline, which reboots the computer and scans outside the normal Windows session.
- Run Malwarebytes or AdwCleaner from the official site.
- Avoid running multiple real-time antivirus products simultaneously.
- Do not install a collection of registry cleaners or “PC optimizers.”
See Microsoft’s Defender documentation for current scan options. Clean scans are useful, but they may not explain a browser policy, altered shortcut, legitimate-but-unwanted program, or persistence artifact without a detectable payload.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use FRST with expert guidance
Farbar Recovery Scan Tool (FRST) can produce detailed diagnostic logs for specialist malware-removal forums. Download the correct 32-bit or 64-bit build, run the scan, and provide FRST.txt and Addition.txt to a trusted analyst.
Best Value
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
Do not apply a fix list copied from another computer or forum case. FRST fixes are machine-specific and can remove browser data, alter settings, delete files, or require a reboot. In the original case, the responder instructed the user to place FRST64.exe and the supplied fix list in the same folder, press Fix once, allow a possible reboot, and attach Fixlog.txt. That was a case-specific procedure—not a universal repair script.
How to judge the evidence
Evidence supporting a browser-hijacker diagnosis
- Homepage or search engine changes without permission.
- Unknown extensions return after removal.
- A shortcut contains an unexpected URL or executable.
chrome://policyshows unauthorized policies.- Redirects occur across multiple sites or browsers.
- A task or process consistently launches Chrome with a URL.
- The behavior stops in a new profile or after a browser reset.
Evidence supporting broader malware investigation
- Defender is disabled or repeatedly re-disabled.
- Unknown tasks or services execute from user-writable directories.
- Unsigned scripts or executables run at logon.
- New administrator accounts appear.
- Proxy, DNS, firewall, or hosts-file settings change unexpectedly.
- A suspicious WMI consumer points to an unknown file.
- There are signs of stolen passwords, sessions, files, or financial accounts.
Evidence suggesting a benign cause
- The process belongs to a known, signed vendor updater.
- A legitimate application opens its welcome or promotional page.
- The behavior began after a known game, driver utility, or OEM update.
- The process is signed and located in a normal installation directory.
- Disabling a known startup application stops the event.
When to reset Windows or escalate
Consider a clean Windows reinstall or reset when malware returns after specialist cleanup, security tools remain disabled, administrator-level persistence cannot be removed confidently, or there is credible evidence of credential theft or system-level compromise. Preserve documents, bookmarks, licenses, and useful evidence first, but do not blindly restore suspicious executables, cracks, scripts, or browser profiles.
If compromise is plausible, change important passwords from a clean device, revoke active sessions, enable multifactor authentication, and contact financial institutions where appropriate. Remove pirated or suspicious software. In the source case, a responder raised possible pirated Adobe software as a risk factor; the thread did not prove that it caused the redirect.
Seek professional help promptly if the computer contains business or sensitive data, an unknown administrator account appears, ransomware or credential theft is suspected, or you cannot distinguish legitimate management components from malicious persistence.
Frequently Asked Questions
Does a flashing command prompt mean malware?
No. It may be a legitimate updater or startup script, although the process, command line, parent process, and resulting URL should be investigated.
Does a clean antivirus scan rule out infection?
No. A clean scan does not necessarily explain browser policies, shortcuts, scheduled tasks, WMI subscriptions, notification abuse, or legitimate software being misused.
Are tracking cookies proof of infection?
No. Tracking cookies are privacy-related artifacts. Their presence does not prove they caused a redirect or that the computer is infected.
Should every unfamiliar scheduled task be deleted?
No. Verify its action, executable path, signer, publisher, trigger, and purpose first. Export or document it before making changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
