Unknown event occurs at exactly 10 minute intervals


kiwiaz

Member
Local time
1:10 PM
Posts
66
OS
Win11
An unknown event occurs at exactly the 10 minute interval (i.e 7:00, 7:10, 7:20 etc). It is expressed as a black pop-up in the left corner of my primary screen - about the size of a CMD window. It occurs for only a brief portion of a second, way too quick to even tell if there is anything in the box. It is however, long enough to prevent the computer from going to sleep normally. It's been going on for a few weeks, but I can't correlate it to any particular change in my system which has only been running 11 for a couple of months. ("Upgraded" from 7.)

Application Event viewer says the Restart Manager (Event ID 10001 and 10000) starts and ends a session at these intervals.

Malwarebytes says I have no malware. CHKDSK says all files are normal.
 
Windows Build/Version
22H2 22621.2715

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
Welcome to the forum. The restart manager is used by windows update and application updates, Explained here. About Restart Manager - Win32 apps


I suggest you start by performing a clean boot to eliminate software conflict causing the issue. If it doesn't happen in a clean boot, you have some software conflicting with Windows or even a software that is corrupted.. You have to narrow it down using the process of elimination. Brink's procedure will help you weed out which one. Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts Tutorial
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 22631.3447
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1tb Solidigm m.2 +256gb ssd+512 gb usb m.2 sata
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 22H2 19045.3930
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
You might want to get a Process Monitor trace too and check which processes it is terminating in order to release the files being held by them.
 

My Computer

System One

  • OS
    Windows 11, Windows 10, Linux Fedora Cinnamon
You might want to get a Process Monitor trace too and check which processes it is terminating in order to release the files being held by them.
So, getting back to this. The event is still occurring at 10 min intervals and is indeed a terminal window that flashes open and closed.
SFC says no integrity violations. Malware scanners don't detect any threats.
Process Monitor provides waaaay too much information but I have driven my eyes red trying to identify meaningful data. I'm wondering if it isn't related to NVidia...Clipboard03.jpg
A bunch of terminal operations occur soon after which seem to refer to every language extension;Clipboard04.jpg
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
You need to filter the log down to process termination, check which processes are being terminated or at least look at which files are being closed.
 

My Computer

System One

  • OS
    Windows 11, Windows 10, Linux Fedora Cinnamon
ProcMon is not exactly intuitive and the GitHub just says learn by doing ...
What terms would I use to filter?
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
I've attached a zip file for a ProcMon filter. Download the attached zip and extract it. In Process Monitor, go to the Filter menu, then Organize Filters. Click the Import button and import the attached file. Click OK to save this filter. On the Filter menu again, choose Load Filter, and then the Process Start and Stop filter.

Clear the ProcMon log and start capturing again.
 

Attachments

  • Process Start and Stop.zip
    542 bytes · Views: 4

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
I've attached a zip file for a ProcMon filter. Download the attached zip and extract it. In Process Monitor, go to the Filter menu, then Organize Filters. Click the Import button and import the attached file. Click OK to save this filter. On the Filter menu again, choose Load Filter, and then the Process Start and Stop filter.

Clear the ProcMon log and start capturing again.
How cool is that - certainly cut down the clutter!
Clipboard05.jpg

If it is relevant, I don't use Teams.
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
1704052343803.png

I'm wondering what the process " sjctbcs " is?
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
Double click that entry, and take screenshots of the three tabs, so we can see what's up.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
On the premise that it is easier to take out the archers than intercept the arrows, maybe I could just delete the roaming profile?
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
No, don't delete the Roaming folder. Not sure Windows will even let you do that, but it's a necessary folder anyway.

This is some randomly-named .NET application in your user folder, which raises my suspicion. Have you submitted it to VirusTotal to see what it says?

Edit: I say it's suspicious because I'm a .NET developer myself. That program says it's the .NET Assembly Registration Utility. That actual utility is named RegAsm.exe, not some crazy random string.

Also, not sure what the comment about OneDrive was about.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
Additionally, you can grab a copy of AutoRuns, and search for that "sjctbcs" thing. There's a filter box at the top of AutoRuns. I'd be willing to bet you have a scheduled task or something running this thing periodically.

Autoruns for Windows - Sysinternals
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
No, don't delete the Roaming folder. Not sure Windows will even let you do that, but it's a necessary folder anyway.

This is some randomly-named .NET application in your user folder, which raises my suspicion. Have you submitted it to VirusTotal to see what it says?

Edit: I say it's suspicious because I'm a .NET developer myself. That program says it's the .NET Assembly Registration Utility. That actual utility is named RegAsm.exe, not some crazy random string.

Also, not sure what the comment about OneDrive was about.
What file would I submit to VirusTotal? I don't see any of those names in the Roaming folder.
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
I searched for "sjctbcs" with AutoRun. It only flagged (Roaming ...\Startup) DDM2.0.lnk which applies to Dell Display Manager Autolaunch but gives a 'file not found' error.

CCleaner found nothing.
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
Just wondering. Did you even try a clean boot?
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 22631.3447
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1tb Solidigm m.2 +256gb ssd+512 gb usb m.2 sata
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 22H2 19045.3930
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
Just wondering. Did you even try a clean boot?
Yes. I performed a clean boot and then, without opening any programs, just waited for the ten minute interval. The terminal window popped up just the same.
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    Ryzen 7 7700X
    Motherboard
    Gigabyte B-650 Aorus Elite AX
    Memory
    32GB DDR5 G.Skill
    Graphics Card(s)
    RTX 4060
    Sound Card
    On-board
    Monitor(s) Displays
    Dell U2518 Dell U3223
    Screen Resolution
    3840x2160
    Hard Drives
    1TB M.2 AData, Samsung 860 EVO, WD 5000AADS, WD10EZEX
    PSU
    EVGA 850
    Cooling
    AK400
    Keyboard
    Logi MXKeys
    Mouse
    Logi MX Master 3
    Internet Speed
    Sad. Just sad.
    Browser
    Firefox, Vivaldi, Brave
Back
Top Bottom