3

I have a problem with my Win10 PC where I'm getting regular command prompt windows launching every 15 mins or so, trying to run an app or batch file then disappearing so fast I can't see what was run.

Only started recently and I have not installed any new software, and my Windows defender is up to date so hopefully not a virus.

Also checked the various registry settings for startup apps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run and Windows startup folder / Task Manager startup, nothing suspicious added.

I get these regular invocations even if there is no application running so its likely something in the background.

Any tips about how to locate what is being launched and by what app/background process?

deandob
  • 135
  • 3
  • I have a fast PC so the command window just flashes in a split second, too fast to even read what is being executed. Good idea about the event viewer but nothing. – deandob Jun 10 '17 at 02:55

1 Answers1

3

try a screen recorder and find out what is that first.

http://www.hongkiat.com/blog/win-screen-recording-softwares/

sometime, you can't only rely on windows defender

try to run free software like Malwarebytes Anti-malware. sometime it sees what the best anti-virus software can't see.

you can also try this small software last activity view, which will show you the details of your computer's activity.

http://www.nirsoft.net/utils/lastactivityview.zip

Ed Ny
  • 76
  • 4
  • Good idea, I'll run the recorder so that I can replay the split second the command window comes up then disappears. – deandob Jun 10 '17 at 02:55
  • Found it, thanks to the tip to run a screen recorder. Officebackgroundtaskscheduler.exe which is a Microsoft office bug apparently, fixed in the next office build. See here for details if anyone else is looking on superuser for a fix: https://answers.microsoft.com/en-us/msoffice/forum/msoffice_officeinsider-mso_win10/officebackgroundtaskhandlerregistration-flashes-a/2600497e-78e4-41a1-9040-461cd2c3ea13 – deandob Jun 10 '17 at 03:17