Command prompt window randomly pops up and turns off

hey guys.
Need a bit of help with this.

So, I have a Command Prompt window popping up every time I start up the computer... but it shuts down almost immediately.

Similarly, throughout my working session, the command prompt window pops up and disappears instantly at random intervals and reads as following:

C:\Users\Deks Roning\AppData\Roaming\ihruawe

I don't use Microsoft office.
I scanned the system using Windows Defended, Avira (just to be sure) and Malwarebytes.

All came up clean.
I also ran sfc/scannow and everything is fine (there are no file integrity problems).

The command prompt window stays open the longest (a couple of seconds) at first reboot after I go to mscconfig>services, press 'Hide all Microsoft services', then 'disable all' and restart the system - without doing so, it opens and closes instantly after a reboot.

Most often, the command prompt window seems to open and instantly closes when I'm watching videos using say Amazon Prime Video or Pot player (I have the latest drivers - those aren't the problem as the issue didn't exist on my previous Windows install with same drivers) - but it also appears during browsing, etc.

I could really use some help in identifying why this is happening and how to stop it because this never happened before.

I did a fresh Windows 10 Home x64 install a couple of days ago seeing as I bought a new 2TB nVme SSD (which is working fine) and have all the updates for it.

I also uploaded the screenshot of the window in question.

I tried looking up solutions online, but nothing of relevance showed up.

EDIT: Tried going into the directory itself and there's nothing named ihruawe related there.

 

Key word roaming.
That usually means something is hitting the internet....and it sounds like w/o your permission.
the word ihruawe returns nothing nor does translate bite on it.
although there is a down the line link to some online casino....hmm.
Use file explorer and get to that file, scan that file with defender or whatever you have.
I B thinkin U B haxored.

 

I would probably boot into safe mode and then delete that folder. If it comes back then dig deeper into what it's running.

These sorts of things indicate some sort of spyware being launched periodically. Somewhere you went or something you opened is most likely the source of this.

While in safe mode you should run another scan to see if you can pick up anything else that's hiding. There are other online scanner apps you can use as well to detect issues.

https://www.trendmicro.com/en_us/forHome/products/housecall.html
https://www.eset.com/us/home/online-scanner/

I don't trust MSFT scanners to pick things up as they false positive on things I don't want them to delete MW bytes isn't too bad but, sometimes does the same thing. Never used avira though.

I disable all of that stuff anyway and only scan when I see an impact such as bank alerts or increased spam showing up.

 

open this app-folder
any **** ,..,malware ? .,.,,. verify folder "next files" or remove this directory !

folder is hidden "copy this on explorer" appdata - setting for apps
C:\Users\ youraccountname\AppData\Roaming

//edit
or open this .BAT or next files in folder "for determine app usage"

 

https://www.microsoft.com/en-us/download/details.aspx?id=9905
portable virus clean-tool

 

I actually decided to reset windows by removing all software and data... seems to work fine now (no random command prompt popup).

 

Here's the problem too many A/V prevent proper protection. Get rid of Avira and use Defender that is more then sufficient to scan. Also as other mentioned Boot in Safe Mode to find out what should be running and what not. And if you go to remove program and see C:\Users\Deks Roning\AppData\Roaming\ihruawe isn't part of the O/S running then be suspect of it. I seen the CMD popup but that it's loading it's own software as part of the O/S itself.

 

I did a Windows reset while also removing all files from the OS. That got the OS to baseline level (same as when it was clean installed), and now its running fine.