Unknown Cmd window pop ups every hour

For a while now I have had Cmd.exe run 2 pop ups about every hour. I do not know what the pop ups are doing and my attempts to catch them have been a bit lacking.

A screen shot I managed to grab while recording my screen: http://imgur.com/9QAXIVf
(screen recorded with Open Broadcaster)

I have attempted running spybot and malwarebytes but the problem persists.

possible other problems:

Sometimes unknown tasks with apparently no purpose will show up in my task manager, which I will promptly end. I suspect they are a product of the Cmd windows.

Any advice on how I can catch this thing and get rid of it would be awesome. Thanks!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-06-2016 01

hi,

You can run these two tools and we will go from there. Usually only on this site once or twice per day so you may not get a response back from me until the following day.

Please download adwcleaner and save to your desktop.

    http://www.bleepingcomputer.com/download/adwcleaner/

    Right click AdwCleaner.exe and select "run as admin"
    Accept the disclaimer
    Click on the Scan button.
    Once the scan is done, Click the Clean button
    Press OK when asked to close all programs and follow the onscreen prompts.
    Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically
    Copy and paste the contents of that logfile in your next reply.
    A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Please download Junkware Removal Tool to your desktop.

     http://thisisudax.org/downloads/JRT.exe

    Double click the icon or Right click for Vista/W7,8 and select Run as admin.
    The tool will open and start scanning.
    Please be patient as this can take a while to complete.
    On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    Post the contents of JRT.txt into your next message
 

Ok. So you still getting the cmd windows popups. Its hard to read the screenshot you uploaded, at least to try and read what it actually says.

We will use FRST to remove some items.

Copy whats below into notepad and save it as Fixlist.txt in the same location you have FRST. Start FRST like before except this time click on the Fix button once. Machine will reboot to finish. Upon reboot it will display a new fixlog.txt that you can copy/paste in your reply.

We will go from there.

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3325161&octid=EB_ORIGINAL_CTID&ISID=ME5EE2665-EFC6-4A7E-9734-316BE0E72D24&SearchSource=55&CUI=&UM=8&UP=SPFAFB5574-38BA-49C8-BF5F-CD34C56005C3&D=051416&SSPV=
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?s=G5Ezftpbl0cshmoBP,9d6154d6-efd3-425f-92fa-112a3319d6c9,&prd=smw&q={searchTerms}
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
S4 BitTorrent; "C:\Program Files\BitTorrent\BitTorrent.exe" /s iid=6908977 did=APSnapdoAMRev sid=3 ref=880b2631-3e04-5f95-9b4a-5487799a1728-PolicyMac id=6be1dde9652db82d208371d33627296304a1c4b313da0e73919c839d673eef0d [X]
S4 dpynloaeuodate; C:\Users\FRED2\AppData\Local\siliconin.exe eproduct dpynloaeuodate [X]
C:\Users\FRED2\AppData\Local\siliconin.exe eproduct dpynloaeuodate
2016-05-02 11:03 - 2016-05-14 16:53 - 6494208 _____ () C:\Users\FRED2\AppData\Roaming\agent.dat
2016-05-02 11:02 - 2016-05-14 16:52 - 0127488 _____ () C:\Users\FRED2\AppData\Roaming\Installer.dat
2016-05-02 11:03 - 2016-05-14 16:53 - 0018432 _____ () C:\Users\FRED2\AppData\Roaming\Main.dat
2013-09-13 00:33 - 2013-09-13 00:33 - 0000042 _____ () C:\Users\FRED2\AppData\Roaming\WB.CFG
2013-09-05 18:34 - 2016-06-20 22:53 - 0007603 _____ () C:\Users\FRED2\AppData\Local\Resmon.ResmonCfg
Empty Temp:

Ok. what about the cmd windows. Still showing up? I cant make out the screenshot you posted, to hard to read. Can you post what its says, make be helpful.

So far I haven't seen it since your last fix. 

The cmd pop up It was recorded with open broadcaster because the it would open and then close immediately. SO the only way for me to get it was to constantly record the screen for an hour. I can't read it either. 

It only shows for about a tenth of a second, longer if im straining the PC resources but not much. 

Thanks for your help. If it comes up again i'll let you know

​Ok thanks for the update. Should it appear again just post back. Otherwise if all is good on your end: Happy Safe surfing out there.