command prompt window after clean scan and restart

[mattsbytes]

I ran a scan on an up-to-date XP install. It did not find any malware. When I restarted the computer the next day, a command prompt window opened before the desktop loaded. It was open for a few seconds, then closed. In the Event Viewer, I had this item: mbamchameleon service was successfully sent a start control

 

Was this a cleanup of something that was left from the scan? Just wondering if the brief command window was from the anti-rootkit tool and if it's normal behavior. 

 

Thanks

 

[AdvancedSetup]

Please run the following scanner and send back the logs and we'll see what's going on.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt

• Save both reports to your desktop
• Please include the following logs in your next reply as an attachment: DDS.txt and Attach.txt
• You can ignore the note about zipping the Attach.txt file and just post it or attach it.

[mattsbytes]

It was a single event. Subsequent restarts have been normal, so I'm not sure it's worth chasing that hard. During shutdown of MBAR, I got a ZoneAlarm message about MBAR wanting to run at startup. It's listed as a registry entry for a RunOnce item in the logs (which are terrible on the newer versions of Zone, so I can't get to much info on it now). That's why I was assuming it was a cleanup pass that was deleting something. It just seemed a little strange since the scan was clean, but maybe it's not since the program doesn't do a normal Windows install. If it had happened during an MBAR prompted restart, it wouldn't have made me curious. 

 

Thanks anyway.