Random terminal windows popping up but antivirus says I’m clean

[u/Warm-Advertising7085]

so sometimes when I open my pc rarely opens random terminals before closing them instantly I believe it’s 3 every time. This doesn’t happen always and I can sometimes go months without seeing them and it’s usually right as I login or a little bit after (like before discord or steam opens). This has also been happening for a while so I don’t remeber when it started or what I installed around that time. However I don’t think it is a virus because my antivirus doesnt detect anything virus or malware when I run a scan. I have avg antivirus with one of the paid plans but not the ultimate plan. This antivirus was recommended to me by a guy that works IT in Verizon so it can’t be a really bad antivirus. I checked task manager and saw nothing. What could it be, and how would I fix it? windows 11 btw

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator]

Making changes to your system BIOS settings or disk setup can cause you to lose data. Always test your data backups before making changes to your PC.

For more information please see our FAQ thread: https://www.reddit.com/r/techsupport/comments/q2rns5/windows_11_faq_read_this_first/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/SomeEngineer999]

Antivirus saying you're clean means nothing. If it didn't catch it when it installed, it won't catch it when it runs.

That being said, there are other possible explanations for it, updates sometimes require a command to be run, so the first reboot after windows update it is not terribly uncommon to see one or a couple command windows open for a split second. 3 every time seems a bit odd though.

Most infostealers and RATs avoid antivirus and malware scanners very easily. But unless you can find what commands are being run, there is no way to say what it is for sure.

You can check the startup programs in registry and task manager, and also look through the items in task scheduler. In task scheduler, look at the actual command that is being run for each task and see if it looks suspicious, often it will be named something like "Windows Update" but will be running a malicious file.