How To Identify What's Opening a Command Window?

steamship · Feb 22, 2024

I'm currently only using the laptop for a couple of hours in the morning, and sometimes a hour in the evening, but occasionally a windows command window (blue background) pops up and disappears again. It's on the screen for a fraction of a second, and I've never managed to spot any text in the window or the window title.

Is there any way to figure out what is causing this? I've had a look in the Event Viewer, but just glancing through various things, there's a ton of information showing for events in the last minute.

CSharpDev · Feb 22, 2024

A powershell window? Strange. What antivirus do you use? Run a scan to be safe.

CSharpDev · Feb 22, 2024

Also to be on the safe side, run this shell command in Powershell as admin: Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

FreeBooter · Feb 22, 2024

In this video, i will show you how to use a powerful application like Autoruns to manage your Windows start up programs, processes and other entries.

steamship · Feb 22, 2024

CSharpDev said:
A powershell window? Strange. What antivirus do you use? Run a scan to be safe.

Standard Windows 11 anti-virus. The normal quick scans that it runs shows nothing, but I'll plug the laptop in and run a full scan.

CSharpDev said:
Also to be on the safe side, run this shell command in Powershell as admin: Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

What exactly will this achieve? I've Googled the command, but what is the desired result? Do you think something remote is running, and by changing it to LocalMachine will stop it? If so, how do I still identify 'what' that process is?

BTW I went into a PowerShell window, and mine has a black background, the same as a Command Prompt window.

FreeBooter said:
In this video, i will show you how to use a powerful application like Autoruns to manage your Windows start up programs, processes and other entries.

Thanks. I've just run it, and looked through the various tabs. The various drivers and processes all have names associated with the hardware and software I have e.g. HP, Mediatek, Nvidia, Adobe, Macrium, Google, Microsoft, etc.

I also looked in the Task Scheduler, and there are a few items there, but all familiar names: MSEdge update, GoogleUpdate, NvidiaCrashReport: and a couple of Omen custom events for Event IDs 9995 & 9997.

I'll also use the Snip tool to record the screen whilst it's running a full virus scan, in the hope that it might pop up.

CSharpDev · Feb 22, 2024

steamship said:
Standard Windows 11 anti-virus. The normal quick scans that it runs shows nothing, but I'll plug the laptop in and run a full scan.

What exactly will this achieve? I've Googled the command, but what is the desired result? Do you think something remote is running, and by changing it to LocalMachine will stop it? If so, how do I still identify 'what' that process is?

BTW I went into a PowerShell window, and mine has a black background, the same as a Command Prompt window.

Thanks. I've just run it, and looked through the various tabs. The various drivers and processes all have names associated with the hardware and software I have e.g. HP, Mediatek, Nvidia, Adobe, Macrium, Google, Microsoft, etc.

I also looked in the Task Scheduler, and there are a few items there, but all familiar names: MSEdge update, GoogleUpdate, NvidiaCrashReport: and a couple of Omen custom events for Event IDs 9995 & 9997.

I'll also use the Snip tool to record the screen whilst it's running a full virus scan, in the hope that it might pop up.

My command just sets up the ExecutionPolicy of powershell scripts. You will be able to run scripts you write locally, and scripts that you didn't write yourself but only if they are signed by a trusted publisher. So random scripts can't just run on your systems.

steamship · Feb 22, 2024

With the Snip tool running, I ran a full scan whilst plugged into the mains, and left the laptop for 30 minutes. In typical fashion, the issue didn't surface. If I remember, I'll start the Snip tool first thing tomorrow and use the laptop as normal, and hope it appears.

DBird29 · Feb 22, 2024

I have seen that on my Win11 HP laptop too. Looking forward to an answer

kiwiaz · Feb 22, 2024

I went through a similar trial - the pop-up was occurring on 10 minute intervals - and there is quite a long thread here on that instance, in which several members contributed their diligence. Sort version; after a lot of effort there was no clear resolution. I subsequently removed and reinstalled my screen saver and the issue mostly disappeared. Every now and again it still happens though, apparently at random, sometimes many days apart.

Steve C · Feb 23, 2024

OneDrive does this when it updates

steamship · Feb 23, 2024

kiwiaz said:
I went through a similar trial - the pop-up was occurring on 10 minute intervals - and there is quite a long thread here on that instance, in which several members contributed their diligence. Sort version; after a lot of effort there was no clear resolution. I subsequently removed and reinstalled my screen saver and the issue mostly disappeared. Every now and again it still happens though, apparently at random, sometimes many days apart.

I tried searching for similar instances before posting, but couldn't find anything. Would you have a link to that particular thread?

I don't have any screensaver set, so I can eliminate that.

Steve C said:
OneDrive does this when it updates

I did see a couple of entries in the Task Scheduler for OneDrive, and since I don't use it, I might try disabling them.

In true fashion, I forgot to start the Snip tool to record the screen, so will have to try again.

kiwiaz · Feb 23, 2024

steamship said:
I tried searching for similar instances before posting, but couldn't find anything. Would you have a link to that particular thread?

Unknown event occurs at exactly 10 minute intervals

An unknown event occurs at exactly the 10 minute interval (i.e 7:00, 7:10, 7:20 etc). It is expressed as a black pop-up in the left corner of my primary screen - about the size of a CMD window. It occurs for only a brief portion of a second, way too quick to even tell if there is anything in the...

www.elevenforum.com

Berton · Feb 23, 2024

I see it happen at times, usually 3 flashes, but have never seen it as blue, always black which is how, by default, Command Prompt and PowerShell/Terminal open unless custom settings have been applied.

Quandary · Feb 23, 2024

steamship said:
I'm currently only using the laptop for a couple of hours in the morning, and sometimes a hour in the evening, but occasionally a windows command window (blue background) pops up and disappears again. It's on the screen for a fraction of a second, and I've never managed to spot any text in the window or the window title.

DBird29 said:
I have seen that on my Win11 HP laptop too. Looking forward to an answer

My HP Laptop is powered on 24 hours a day and is opened early in the morning. Almost every day at 8:00 am a command window flashes for a second. There have been some occasions when the PC was turned off that the command window appears some time after it was booted.

I originally thought that it may be iTunes but suspect that it is OneDrive which I use. There is not scheduled task for any such event. As this has been happening for over a year with no apparent consequence I just ignore it, but would like to know/stop it.

steamship · Feb 24, 2024

Quandary said:
My HP Laptop is powered on 24 hours a day and is opened early in the morning. Almost every day at 8:00 am a command window flashes for a second. There have been some occasions when the PC was turned off that the command window appears some time after it was booted.

I originally thought that it may be iTunes but suspect that it is OneDrive which I use. There is not scheduled task for any such event. As this has been happening for over a year with no apparent consequence I just ignore it, but would like to know/stop it.

As you say 'no apparent consequence', but it would be nice to know what is causing it, just in case.

I used the laptop for nearly three hours straight yesterday, with the Snip tool recording everything. Never noticed a pop-up whilst working, and nothing appeared in the recorded clips. Will try again.