Finding a Disappearing Application in Windows?

siuengr asks: "I have a computer that has a window that pops up every few minutes, but disappears before I can figure out what it is. I have run every virus program and spybot cleaner I have, but they do not find any problems. How can I figure what is causing this window to pop-up all the time, when it doesn't stick around long enough to see anything about it? Is there any software that tracks what applications have ran over a period of time, even if they are not currently running?"

Comments

Task Manager

[Lazbien]

Open up the Task Manager and be patient. Watch the processes.

Re:Task Manager

[ForumTroll]

It's trivial to replace the task manager with one that only shows certain processes, and this technique is used regularly by malware. If the security of your system has been breached the task manager isn't a reliable source of information.

Re:Task Manager

[Anonymous Coward]

Curious, mods, why is this modded as offtopic? I mean, seriously, can someone give me a decent answer? It seems that lately the mods have been worse and worse at moderating.

This comment is hardly offtopic.

Re:Task Manager

[Centurix]

Very true indeed, especially when I've heard that the w2k task manager code was included in the source leak a few years ago.

Not that I know anything about the source leak or any of its contents...

Re:Task Manager

[OmnipotentEntity]

It could be that the process isn't actually a process, but a dll loaded into a process.

You'll need to get Process Explorer as explained in the above posts. Then when you find the nasty, you'll want to kill the process housing it, and then type regsvr32 /u thenameofthe.dll into a cmd window. Then you'll want to move or remove the file.

Re:Task Manager

[Anonymous Coward]

I agree completely - This is why I dont read or post at /. that much any more

Re:Task Manager

[MLease]

Good point. Maybe download Process Explorer instead.

-Mike

Re:Task Manager

[fbjon]

I agree completely - This is why I dont read or post at /. that much any more

Except for, you know, right now... but it's only a coincidence, honest!

Face the music, ladies: you're addicted.

Re:Task Manager

[Anonymous Coward]

My Nvidia control panel had a setting to force all dialog boxes to be drawn on-screen. After that, everytime one of my apps loads, I see a dialog box labeled "This should not be seen" on my screen for a sec, then it goes away once the app is fully loaded. Sometimes programmers take shortcuts to make their stuff work. This could be an example of that.

Sys internals used to have a few good tools for tracking which dialog is related to which process. I'm not sure if they are still available since Microsoft bought them out.

Re:Task Manager

[drachenstern]

Or they used something like VB without understanding the languages abilities.

(not intending to start a flamewar here people)

Same here.

[Cybert4]

Same thing! Be interesting to see if anyone tracks this down. My solution was to buy a new computer (old one severely needed an upgrade anyway). I looked through my processes and didn't see anything. Tried windows live antivirus too. Happens every few minutes here. Try killing your processes or using msconfig to kill startup stuff. There's several sites that list known windows processes.

Nuking windows and/or wiping drives or partitions will of course work as well.

Re:Same here.

[Simon80]

buy a new computer? It really irks me when people cite this as a solution. You most definitely did NOT fix the problem, you are just avoiding it. At the very least, you can install another OS. This isn't a hard process, you just have to download an image, burn it to a CD, boot off the CD, and follow simple instructions.

Re:Same here.

[Anonymous Coward]

Wow..the solution offered to a misbehaving computer is to buy a new computer. You know, Slashdot was once a tech site. It appears that is no longer the case.

Re:Same here.

[Anonymous Coward]

You know, Slashdot was once a tech site. It appears that is no longer the case.

With a UID of 990K+ not being a geek is to be expected.

Re:Same here.

[dshaw858]

Now now, dearie... I'm sure there are plenty of new geeks joining the site every day that can help our discussions.

Re:Same here.

[joto]

buy a new computer? It really irks me when people cite this as a solution.

It is a solution!

Just because it's not the techiest, or generally lowest-cost, or whatever, doesn't disqualify it from being a solution. It solved his problem. Therefore, by definition it is a solution.

Re:Same here.

[grub]

Just because it's not the techiest, or generally lowest-cost, or whatever, doesn't disqualify it from being a solution. It solved his problem. Therefore, by definition it is a solution.

It's not a solution, the problem still exists on the computer. It's a pretty dumb way of dealing with a problem. What's he going to do if his car starts to stall once in a while, buy a new car?

Re:Same here.

[JorDan Clock]

When the cost of repairs excede the value of the car, sure. The poster pointed out the computer was in need of upgrades, so this is indeed a very good solution. He no longer has that specific problem and has a speedier computer. Let's just hope he takes better precautions with the new one and that extra speed doesn't just run the same malware faster.

While this kind of solution isn't very good if you repeatedly run into the same problem, it's perfectly reasonable in the context. Why bother fixing it when you don't even want to use it?

Re:Same here.

[iamhassi]

"It is a solution!"

not really, it's just avoiding the problem, the problem really hasn't been solved so it's not really a solution, it's more a work-around to achieve a end result. The problem still exists, just not on the computer he's using.

It's like "hey, my brakes squeal, how do I solve this?" And instead of really solving the squealing brakes by replacing them you just buy a new car. Do the brakes still squeal? Yes, but since you're not driving it anymore you no longer care.

Re:Same here.

[Lobster Quadrille]

I guess that depends what you decide the problem is. Is the problem that there's a window that pops up, or is it that said window irritates the user. Buying a new computer will fix the latter, as it relieves the irritation.

Re:Same here.

[joto]

It's like "hey, my brakes squeal, how do I solve this?" And instead of really solving the squealing brakes by replacing them you just buy a new car. Do the brakes still squeal? Yes, but since you're not driving it anymore you no longer care.

Yes. It is like that. But it is still a solution !

Just because you find it a bit silly to replace a whole computer because of spyware, or replace a whole car because of squeaky brakes, doesn't disqualify it as a solution. No matter how silly you find it, it's still a solution to the problem of the user experiencing spyware on his computer, or squeaky brakes on his car.

In the case of the computer, as a techie, I would actually recommend this to non-techies. A new dell costs about the same as you could expect to pay if you would pay someone to fix the problem. In addition you get a new and better computer. If you were to pay someone to fix it, you would still solve the problem, and still part with your money, but you would not have a new and spiffy computer. If you invested the time into learning enough about computers to fix it yourself, by the time you were finished fixing the probem, if you'd been working overtime instead, you could have bought at least 50 dells.

As for the car, the same logic applies. If it's an old car, which you know sooner or later will need a major (costly) overhaul, you can just as well ditch it when a problem shows up, such as squeaky brakes. You don't need to fix it yourself, or pay someone to do it, when you are going to need a new car soon enough anyway.

Re:Same here.

[Anonymous Coward]

Finally someone who sees my side of things! My wife wants me to buy a new car because the head gasket is blown! but I say look at the rest of the car, sure it's got a little rust and is a 1985 Ford Escort with 250k miles on it, but if I just spend the money I'll have a solution!

Re:Same here.

[Anonymous Coward]

Well it is clear that Cybert4 is not one of those geeks. I mean, shit...buy a new computer? You have got to be kidding me with this garbage.

Re:Same here.

[tambo]

It is a solution!

It is a solution that involves no learning on the part of the computer owner. This practically guarantees that the same problem will arise again on the new system. End result: ignorance-driven obsolescence.

Computers are complex - and are only becoming more so. Burnable optical discs and flash drives are better than floppy disks for many reasons, but they're also harder to use than stupidly simple 5.25"ers. Wireless networking is preferable to wired networking, but configuration can be much more painful. Etc.

If you're going to use modern technology, you have to keep up with the learning curve. Sad but true.

- David Stein

Re:Same here.

[The PS3 Will Fail]

"Why bother fixing it when you don't even want to use it?"

It is not as important to fix it as to understand what "it" is so that he/she doesn't run into the same problem again. It is quite likely that whatever he/she did to cause this problem, he/she will continue the behavior and merely create the problem on the next machine. Therefore, it is not perfectly reasonable. How can it be perfectly reasonable when it is just going to occur on the next machine?

Re:Same here.

[Schraegstrichpunkt]

It depends on how you define the problem. If the problem is "this computer has malware", then buying a new computer is not a solution. If the problem is "the computer I use most of the time has malware", then it is.

Re:Same here.

[kabz]

Lots of people actually do buy a new computer. My inlaws have a stack of perfectly decent but probably jacked-up software-wise PCs, including quite a cool looking Sony Vaio 'Monolith' tower.

To "people like us" (tm) the software is fixable, and hardware may be fixable.

To regular Joe User it is just a failing computer, and they have not much more chance of fixing whatever it is, than performing open heart surgery on the Pentium III or whatever powers their piece of junk.

Re:Same here.

[JonathanR]

When the cost of repairs excede the value of the car, sure.

This is false economy. You shouldn't compare the repair costs with the value of the car you have. Rather, compare the repair costs (and expected life of the repair) with the expected depreciation and running costs of the new car you propose to purchase.

Always factor in the expected depreciation of the newer vehicle. The depreciation amount on a new replacement can pay for a lot of repairs to the present vehicle.

Re:Same here.

[TubeSteak]

Just because you find it a bit silly to replace a whole computer because of spyware, or replace a whole car because of squeaky brakes, doesn't disqualify it as a solution.

The more layers of bureacracy you have to deal with, the more valid that solution becomes.

Anyone who's dealt with military efficiency (or even standard Gov't bureaucracy) could tell you that throwing away a $2,000 item is cheaper than trying to get it fixed.

Buying a new computer may not be a valid solution for this particular /. Submitter, but it makes sense for lots of organizations.

Re:Same here.

[1u3hr]

It depends on how you define the problem. If the problem is "this computer has malware", then buying a new computer is not a solution. If the problem is "the computer I use most of the time has malware", then it is.

It's nether of those; if you look at the top of the page, the problem is:

How can I figure what is causing this window to pop-up all the time?

And the reason we're discussing it at all is the idea that something interesting or sneaky is going on, and can the Great Minds of Slashdot find out what.

Re:Same here.

[xtracto]

Just as a comment, I once stupidly made my machine hijacked my crapware (can you believe I actually ran the "crack.exe" file that comes with the astalavista cracks =oS) and had to spend almost 4 hours cleaning my computer.

I used lots of anti cracpware programs that certainly cleaned a lot of things but my machine kept getting infected.

After some time I dont know why I searched in the "Screen properties" (dont remember the exact name as I am in Linux now), where you right click the desktop and then properties.

That will show you a window with desktop and screen properties but there is also a tab that lets you configure the "Active Desktop" thing in which you can make a web page you desktop page. Well, the problem was that the trojan installed a web page as active desktop (with my same background so I could not notice), but this page had some javascript code that kept infecting the computer.

I thing it was quite clever and since none of the anti spamware (ad aware, hijack this, MS-shitdefender, Freeav, avg, clamwin, etc) recognized it, I believe my comment might help someone avoid some headache.

Re:Same here.

[WebfishUK]

If the customer is happy, it's a solution.

Re:Same here.

[LordKronos]

The poster pointed out the computer was in need of upgrades, so this is indeed a very good solution. He no longer has that specific problem and has a speedier computer.

But was the speed of the COMPUTER really a problem before? I've seeb enough reports on how user's computers get so full of spyware that it slows the machine down over time. Then they feel their computer is too slow so they buy a new one, even though the old hardware was plenty fast enough.

Re:Same here.

[Squozen]

It's reasonable if the next computer runs Linux or OS X, I guess.

Re:Same here.

[Don Giovanni]

Wouldn't backing up and reinstalling work just a good?

Re:Same here.

[jizziknight]

You, sir, are a smart man. Everyone laughs because I refuse to buy a new car to replace my '92 Saturn SL2, but the fact is, it's just cheaper to fix the things that go wrong every now and then than to buy something new. Sure, it's not the greatest car, but it get's me where I need to go (even if it's across the country) and gets around 30 mpg. Unless the car is totaled, it's almost always cheaper to fix it than to buy something new. However, this doesn't really apply to computers. Finding upgrade parts or replacement parts can be expensive when compared to buying a whole new system.

Re:Same here.

[itwerx]

I guess that depends what you decide the problem is. Is the problem that there's a window that pops up, or is it that said window irritates the user. Buying a new computer will fix the latter, as it relieves the irritation.

Whether you label it as the problem or not, the irritation is still just a symptom.

Re:Same here.

[linear a]

Not unreasonable to buy a new computer if the old one is on it's way out. My current box is 4-5 years old and I've already decided to buy next time I would end up rebuilding the OS for whatever reason. Really bad infection would cause that if I couldn't trust that I was able to clean it up completely.

Re:Same here.

[rivendahl]

It's the hang up everyone has with interpretting language. You know what you wanted to say, and meant to say, and the words you selected to say it seemed logical at the time however, people (persons), as you can well see, demand that you qualify what you said to more accurately complete your thought. For example:

Yes, buying a new computer is in fact a solution . And more to the point, may not be a good solution. However, when put into context of the original question regarding fixing the current issue, perhaps buying a computer isn't a solution in that scenario .

But honestly (aside from me being hypocritical about it) who really cares, and does it really matter? No. I don't give a rat's ass whether it's a case of non-sequitor. It goes back to the idea of "how the hell can one get a failing grade on an opinion". Two ways actually; either it isn't what the professor wanted, or it was non-sequitor.

So what? I'm just rambling anyway. Mod this down please, I suck and deserve bad karma...

Riv

Re:Same here.

[lostboy2]

Not that it matters, but I think you're both right, only you're more right. Whether or not buying a new computer is "a solution" depends on how you define the problem.

If the problem is stated as "fix this computer", then buying a new one is not a solution. If the problem is "eliminate the offending application", then buying a new computer is a solution, although possibly just a temporary one. Since the parent post mentioned the need/desire to upgrade anyway, I'm inclined to go with the latter definition.

Re:Same here.

[Anonymous Coward]

Note that the commenter who offered the "solution" was saying it was for their problem, and that he also noted that nuking windows/installing another OS would be another way to keep it from poping up. I doubt the poster was suggesting that it is a good solution for all cases, simply that they didn't want to mess with fixing it on a computer they felt needed to be replaced anyway.

Re:Same here.

[gurps_npc]

Joto, you are making assumptions about what the word Solution, and what the real PROBLEM is.

Specifically, you are thinking the problem is "the owner is annoyed". If that is the real problem, then putting a bullet in their brain will also solve it. Your answer demonstrates practicality, not intelligence.

Stop thinking about it as a real life thing annoying you and pretend this is a question on a test given to you by your teacher at a car mechanic school/computer mechanic school.

We both know you would FAIL if you wrote down "buy a new one" as the 'solution'.

Why? Because you are solving the social problem, not the technical problem you were asked about.

Your answer is moronic to people that care about the technical issue, which you don't care about. Accept the fact that some people care about the technological issue, not just "how does this annoy me?" and suddenly you will understand why some people do not respect what you wrote.

Re:Same here.

[Anonymous Coward]

It is a solution!
 
It's as much a solution as is commiting suicide over a hang nail.

Re:Same here.

[dargaud]

It is a solution!

Well... not necessarily... Get a new computer and start reinstalling all the stuff you were using on the old one... until the prog you got on IRC to do whatever reinstalls the same spyware and you are screwed back to square one.

Re:Same here.

[mustafap]

This is just fucking stupid.

We are all moving into a throw-away society. Attitudes like that are the reason for so much crap being dumped into the oceans.

Christ, will people wake up.

Re:Same here.

[drachenstern]

indeed, my homebrew AMD-K6II with 182 MB RAM runs XP with either photoshop or AutoCAD and WMP/WinAMP just fine. The fact that the internet connection is only when I want to be online on that box (ie, cable remains unplugged normally so it doesn't get infected) doesnt hurt the situation either.

But this is just for those who don't realize that the minimum requirements really are okay, if you'll just go up a coupla steps. anything else is overkill.

My OTHER five computers are two HP AMD Sempron laptops, a Gateway P4 3.0+ laptop and a Dell 3.0+ intel desktop. So no, I don't rely on old hardware, but the point was ...

On top of that, how do I know if I am approaching MTBF on my hard drive when I don't know how many hours I've been running it over the past 6 years? Assume moderate /.er usage until 1 year ago.

Re:Same here.

[Simon80]

Thing is, the old compy can still be put to use as some kind of server box, or something. Of course, Windows will NEVER try to remove the stigma that Joe user associates with this, they are in the business of selling crippleware, so that they can charge businesses a few hundred bucks more for an "enterprise-grade" server OS. I guess they have a simple interface for file and print sharing, but for any other features, they want to charge you more.

Re:Same here.

[Anonymous Coward]

one could say it is not a solution if it leaves the old computer still borked.

Re:Same here.

[ErikZ]

"On top of that, how do I know if I am approaching MTBF on my hard drive when I don't know how many hours I've been running it over the past 6 years? "

You don't. It's a complete crapshoot, at best you'll get some warning that the hard drive is failing.

Re:Same here.

[drachenstern]

exactly my point, but thanks for taking the time to respond

Re:Same here.

[ElleyKitten]

buy a new computer? It really irks me when people cite this as a solution.

I like that solution. It gets me free computers. :-)

Re:Same here.

[EvilJoker]

To see how long you've been running? If your drive supports SMART, you may be able to find out (google for smartmontools).
As a bonus, it can also help predict failures. 6 years is a long time, I hope you do backups.

However, the MTBF does NOT measure longevity- it measures premature failure rate. E.G. if I have a farm running 1,000 drives w/ a MTBF of 100,000 hours, there should be 1 failure every 100 hours.

Let us not get ahead of ourselves.

[sporkme]

Use CamStudio (GPL), or some other desktop video recorder. Record your desktop until the event has occurred a few times, then advance to a frame in the video file that contains the dialogue box/application window. Leave the task manager (ctrl-alt-delete) running off to the side. Let the event occur once with the applications tab displayed and once with the processes tab. Make sure you can see the whole process list.

Check the event viewer (control panel->administration) for erratic messages. Try disabling processes one by one to see if one of them is the cause. What Anti-stuff are you running? Anti-stuff is only as good as the definition database. Furthermore, many malicious processes can hide their existence from the OS, and an application tracking software is almost certainly going to get this info from the OS. Make sure your video drivers are up-to-date. If you suspect that the app communicates over the netowrk, install a software firewall and set it to anal mode.

Run a benchmarking utility or simultaneously run several resource hungry applications to slow the machine down, and maybe the window will hang around for a while.

If you cant catch it there, just format and reinstall Windows--the standard fix for anything Microsoft. Cue the mac/linux comments!

Re:Let us not get ahead of ourselves.

[Marxist Hacker 42]

I agree- but easier than trying to find the screen real-estate to see the entire task list, click on the "CPU" column until "Sytstem Idle Process" is at the top- this will essentially sort the list by the most active programs of the second, and then the screen recording software will capture all the currently running processes.

Re:Let us not get ahead of ourselves.

[Lisandro]

If you cant catch it there, just format and reinstall Windows--the standard fix for anything Microsoft. Cue the mac/linux comments!

    You're being funny, but i had to fix a Windows system at work after years of both working with and using at home Linux desktops, and the experience was horrid. Horrid. I had to use three different spyware programs + Avast antivirus, spent a few hours, and i'm pretty positive they left crud behind.

    I have a Windows partition i use when i'm really forced to, but i never managed to screw it that bad.... the fact that people are suggesting to record their monitors, format the harddisk or buy a new computer altogheter so they can use their systems comfortably just blows my mind.

Re:Let us not get ahead of ourselves.

[berzerke]

Unless there is a rootkit, in which case, it will never show anything. I've encountered rootkits on Windows recently, 2 in August alone. I suspect we will be seeing more and more of them.

Re:Let us not get ahead of ourselves.

[dohzer]

A camera is actually what I used to catch my Bios screen the other day when it was flashing up too quick to read, and then reseting. Because the problem was occuring before the OS could load there was no way I could actually use a program to check it.

Re:Let us not get ahead of ourselves.

[Anonymous Coward]

Use CamStudio (GPL), or some other desktop video recorder

One time I had this happen, one of my coworkers happend to have his DV camcorder in at work for something. We videotaped it and then stepped through the video till we saw it.

Other times, I've also used the video-capture mode on a digital camera.

Sometimes, the low tech solution is the best.

Re:Let us not get ahead of ourselves.

[Anonymous Coward]

Leave the task manager (ctrl-alt-delete) running

The task manager shortcut is ctrl-shift-esc. This works in all configurations of 2000 and XP, not just the fast-user-switching mode in XP.

I know there is a button for task manager on the SAS screen, but this shortcut is quicker and more reliable, for example when users have a replacement GINA.

Re:Let us not get ahead of ourselves.

[sporkme]

I cannot and AFAIK never have produced anything but task manager DIRECTLY via ctrl-alt-del. I cannot produce a different result with ctrl-shift-esc. In what scenarios would the ctrl-shift-esc shortcut make a difference? I have never had to use ctrl-shift-esc but I knew it had the same result. Windows 98? couldn't tell ya this late in the game.

Re:Let us not get ahead of ourselves.

[Anonymous Coward]

In Windows NT and 2000, Ctrl-alt-del brings up the SAS screen, which has six buttons, one of them to start the task manager. XP is the same when configured for domain membership. Ctrl-shift-esc starts the task manager directly in all situations (though I am not sure about NT4).

Windows 98 and related systems don't have a task manager, they have the bastard son that shows "some processes".

Some Anti-virus Progs

[Zardus]

A friend of mine had issues with Kapersky anti-virus doing this every few minutes. Do you have that installed?

Tiny Firewall

[Microlith]

Tiny Firewall provides a security module that requires the user authorize every unknown application be manually allowed to run.

While I have yet to see any unknown process start on my machine, none (not even ones started by trusted processes) are allowed to proceed without first being given the OK by me. I'd give it a shot and see if TF 2006 can catch it for you.

Re:Tiny Firewall

[joto]

Somebody actually use tiny firewall? Wow, I tried it once, and after having clicked yes about 2579 times the last 5 minutes... it didn't get used any more!

Re:Tiny Firewall

[Anonymous Coward]

I believe that the Tiny firewall became the Kerio Firewall. It seems to have gone through a few name changes, but it is one that I use as well. With Tiny a lot of clicks were sometimes necessary, but normally you could make it "learn" which applications and ports were allowed and which ones weren't. Once it was trained, being bothered was much rarer. In such cases, I'd rather know that something unusual is happening and make my own choice, rather than just have it happen it the background. In addition, its quite educational about what goes on behind the scenes...

Re:Tiny Firewall

[netsharc]

I second this idea. Although I know it as Kerio Firewall (and it's nowhere to be found at kerio.kom, only at Sunbelt Software, what gives?), here's the download page.

I once helped a girl who suffered the same problem. A pop-up comes up every so often. I didn't see anything wrong at first, but then I noticed wscript.exe was running. It was running a VBS-script in a loop, and every few random minutes it would launch an Internet Explorer window with an ad, which would just as quickly disappear. I search the disks for all VBS files, found the suspect file, and searched the registry for any mention of that filename.

Another way malware might hide is when they install themselves as a service.

Re:Tiny Firewall

[Sycraft-fu]

What gives is Kerio sold it's firewall to Sunbelt Software (Counterspy is what they are best known for). Reasons were not disclosed. If I was to guess I'd say they weren't making enough money on it and were worried the improved Vista firewall would cut that back further.

Re:Tiny Firewall

[Anonymous Coward]

Kerio traded it for some e-meters from Sunbelt.

Re:Tiny Firewall

[Sparr0]

Why are you running 2579 different applications? Sounds like poor design on some OTHER developers' parts.

Re:Tiny Firewall

[Guru2Newbie]

I've used the freeware version 2.0 of Tiny Firewall under Win98 and Win2K since 2001; Tiny version 5.5 crashed frequently or simply failed to run under Win2K and WinXP.

Tiny 2.x is fast, free, and it did the job. It's not as user-friendly as ZoneAlarm, so you have to kinda know what you're doing.

Oh, did I mention it was free?

Process Explorer

[greerga]

Prcess Explorer Options..Different Highlight Duration

Re:Process Explorer

[RobertKozak]

Process Explorer

Re:Process Explorer

[Jett]

I ran into this exact problem once and used proc explorer to figure out wtf was going on. It does the job. In that case it was some new spyware, I updated spybot to the beta definitions and that took care of it without a problem.

Re:Process Explorer

[Chelloveck]

Yup. Process Explorer, Filemon, and Regmon should be in everyone's toolboxes. And it might not be a bad idea to download everything from SysInternals as it was recently acquired by Microsoft and may not exist much longer. From the announcement on their blog:

As for Sysinternals, the site will remain for the time being while Microsoft determines the best way to integrate it into its own community efforts, and the tools will continue to be free to download.

Disapearing Windows

[Anonymous Coward]

It might be a better solution

Re:Disapearing Windows

[ruckc]

Where are my mod points when I need em....

Process Explorer

[x2A]

Google for it. It shows recently terminated processes in red (or whatever) for a few seconds after it's terminated (all configurable)

Approach the problem logically...

[baadger]

Assumptions:
1. For a dialog to be coming up it has to be iniatated by a process.
2. Mystery process most likely isn't part of Windows

Action:
1. Disable all startup programs with msconfig
2. Reboot
3. If problem is gone re-enable startup processes one at a time.
      If the problem is back/still there go to step 5
4. Goto step 2
5. Visit Slashdot. Scroll past this comment and proceed to next proposed solution, one which, hopefully, won't waste your time like this one just did.

Re:Approach the problem logically...

[x2A]

You lie! If this was really slashdot, 6. would be "profit!!!"

Re:Approach the problem logically...

[dasunt]

A binary search would be better. Split the search space (the set of startup programs) in half. Enable or disable one half. If the problem appears, adjust your search space to that half. If the problem does not appear, adjust your search space to the other half. Repeat.

Maybe the app isn't actually closing

[PygmySurfer]

Maybe the process continues to run, it's merely popping up some kind of window from time-to-time. I'd look through task manager for any processes that don't seem right. Google for the process names if you find anything suspicious.

Or maybe it's just Messenger showing you when someone's logged on :P

Hate to do this in a first post but...

[terrahertz]

...this is truly a crappy Ask Slashdot.

The submitter didn't provide ANY details about his environment other than "Windows" nor did he provide ANY description of what the "disappearing application" does.

The devil is in the details, and so is your answer. Provide more info or, as a man more eloquent than I once said, "BRACE YOSELF."

Re:Hate to do this in a first post but...

[Anonymous Coward]

Amen.

Dear submitter: Please place your computer in a box with $99 and a return shipping label. Send it to me. Your computer will be back in 5-7 business days.

Re:Hate to do this in a first post but...

[Anonymous Coward]

Wow! That's some inscrutable logic you have there!

If he KNEW what the application was or what it did, he wouldn't need to ask the question. All he knows is that it pops up a window.

Re:Hate to do this in a first post but...

[terrahertz]

Urm, I'm not sure what you're replying to there, AC ole chum.

Even the most technophobic computer illiterate can do things like QUOTE SOME TEXT or DESCRIBE SOME COLORS OR SHAPES within what's popping up.

If that wasn't readily apparent within my original post...when I used the words "ANY DETAILS" and "ANY DESCRIPTION" ...um...yeah.

The other possibility is that the submission is a put-on by someone with the motivation to see the /. answer to the question, and there really isn't any "disappearing window." Draw your own conclusions from there -- I think it's crap either way.

Obligatory:

[Anonymous Coward]

Switch to Linux!

OK, a touch more seriously, you've killed off everything non-essential to a working computer and had it still come up? If not, check that first@

Re:Obligatory:

[Karma Farmer]

BSD

Bad OS, Change OS

[Anonymous Coward]

'nuff said.

Check Scheduled Tasks

[justanyone]

If nothing obvious is running as a process, this might be popping up from a scheduled task.

Occassionally we ran these at my old job and it would pop up a window in front of whatever you were doing, very briefly. The task was a batch file that kicked off something else.

HP?

[Anonymous Coward]

If you have an HP printer/scanner it might be their updater program.

Sysinternals.com

[szyzyg]

Look on sysinternals.com - the best bet would be Filemon - then you can track which files are being opened.

Re:Sysinternals.com

[AndroidCat]

Mark Russinovich (sysinternals.com) has a whole bunch of darned useful tools for watching access to TCP/IP, the registry, filesystem, processes etc. I mainly use TCP/IP View, but the others have come in handy. Highly recommended!

Process Explorer

[rizzle]

Download Process Explorer. It's like task manager on steroids. One of the things you can do is put "delays" on the list of running processes when the list changes, like with the addition/removal of a process/window.

Go to Options > Difference Highlight Duration, and set it like 15 seconds or whatever. New processes will show up in bright green for 15 secs, and killed processes will show up as red for 15 secs.

Good one

[Cybert4]

Yep, I have the problem too and have an HP deskjet (probably with the huge stinking driver instead of the cut-down one).

Re:Good one

[Anonymous Coward]

Yes the HP software was doing it to me too, I would be playing a game and it would actually drop me to the desktop. At first I thought the game had crashed but I was able to alt-tab back to it. I ended up uninstalling all the HP software that came with that printer.

Re:Good one

[CeruleanDragon]

Ditto here, I've been trying to figure it out, but I highly suspected it was the new HP drivers I just installed (which included the Imaging stuff, as I have an All-in-one). This just absolutely confirms it. (Thanks to all)

It's probably your addblocker

[lobsterGun]

your adblocker (or something like it) is proabaly closing a popup window as soon as it appears.

Do you use TweakUI?

[WalterGR]

Your exact scenario happened to me a few weeks ago.

Do you use the TweakUI program that comes with Powertoys for Windows XP? If so, do you have X-Mouse turned on? Check Mouse -> X-Mouse and see if "Activation follows mouse (X-Mouse)" is turned on.

Some poorly written Windows apps will pop up dialogs that then disappear if they lose mouse focus. If you have X-Mouse turned on, they will pop up a dialog - and if your mouse is anywhere else on the screen, they'll think they've lost focus and close the dialog.

All I had to do was disable X-Mouse until the app popped the dialog again, then I could deal with it. Unfortunately I don't remember what the poorly written program happened to be...

HP Software?

[Clazzy]

We have an HP PSC 2355 printer and we installed the software that came with it. Anyhow, every half an hour or so, a program would randomly appear in the taskbar and disappear very quickly afterwards, usually minimising any full-screen applications. In the end, we had to disable it in msconfig. I honestly can't remember what the entry was in msconfig, but I could find it somewhere if it's actually the problem. Of course, it probably begins with "hp" anyway.

Re:HP Software?

[Karma Farmer]

The most interesting thing in this thread is that more than 10% of the posts are about badly written HP printer software.

That is one seriously messed up company.

Re:HP Software?

[Clazzy]

They worked just fine without the program running in msconfig, so I don't know what possible purpose it had other than annoying the end-user.

Re:HP Software?

[Anonymous Coward]

Amen. HP printer drivers are an embarrasment to humanity.

Re:HP Software?

[biglig2]

Tell me about it, I installed a new HP multi-fuction printer/scanner/fax on Tuesday. As soon as I connected it to the phone line, it called up the phone company, pretended to be me, got my phone records, and faxed them to HP corporate headquarters.

Re:HP Software?

[lukas84]

Never, ever buy consumer printers / scanners / etc. They're all complete and utter crap.

I had to configure one of these for my mother, and they're unusuable.

The semiprofessional equipment they offer is, however, rather good.

We've got a new HP LaserJet color 4700 DTN, just a few weeks ago. Thats a semiprofessional 30 ppm color laser printers with 3 500 Sheet feeders.

Works like a charm. The printer driver is a normal windows driver, no software, no nothing. Just install the 2 mbyte printer driver, and everything will work fine. It even has a nice thing about defining "printer profiles" on the server which is also usuable on the client.

We also got a 7xxx Network scanner (just a scanner, not a multifunction device). Works like a charm. Lightweight client software.

Re:HP Software?

[Clazzy]

The printer itself is fine (works flawlessly in Linux, too), it's just the damn software. Maybe I was just luckier than you.

Spy++

[storem]

Spy++ (comes with Visual Studio and probably other packages) should be able to list the window, even after it disappears and trace it to the owning process. Used it many times to find information about "rogue" dialogs.

Re:Spy++

[enharmonix]

Somebody please mod parent up! It needs to be +5 Informative.

First thing I thought of was the Borland version (Winsight), and this is exactly how you figure this kind of nonsense out. These apps actually enumerate all current window handles and will give you owning pids, parent/child windows, message queues, etc. If you don't already have a Borland IDE license, Borland now offers free (beer) and trial versions of their products, just dl a windows version and it ought to come with this tool.

If not, I also found another similar standalone app called Winspector (not to be confused w/ Borland's Winspector, which does something different) at http://www.windows-spy.com/, but I have not used it and can't vouch for it.

HP processes perhaps?

[no_pets]

Sounds exactly like one of the HP processes that used to run on my machine. I installed an HP printer program that I needed along with the drivers and then I noticed a taskbar process that would run about every 15 minutes or so. It really bugged me until I got rid of it.

Do you have an HP printer perhaps?

Re:HP processes perhaps?

[Scoldog]

I agree. The HP Update Software drove me up the wall when it flashed up for a second. Reason being, I'd be playing a video game and be in the middle of a cutscene or something when the damn HP update window would pop up. The computer would treat this the same as a mouse click and stop whatever was happening on screen.

Installing the base HP drivers rather than the full software package has sorted the problem out. I would recommend that instead.

What....

[Yusaku Godai]

Since when did Slashdot become Experts Exchange?

Re:What....

[east coast]

Since when did Slashdot become Experts Exchange?

At least we don't need to login to see the solution. That site is annoying.

Re:What....

[Yusaku Godai]

Yeah, I started thinking that right after I posted.
That is a good thing.

Re:What....

[hunterkll]

You don't have to log in to see it. ... you just have to do some mad scrolling down......

Re:What....

[StikyPad]

Yeah, parent is probably Old School like the Old School. They don't require people to login anymore, but they used to a few years ago. I'm not sure when they changed it.

Re:What....

[Anonymous Coward]

Is there actually any content at Expert Exchange? All I've seen there are annoying ads and that proprietary Flash garbage. Is there actually any information? It looks like it only exists to trap naive users using search engines into click on links to their pages that have zero information. Google really should block that site from their results.

Re:What....

[SurturZ]

Accepted Answer!

Re:What....

[matt328]

Just don't ever accept cookies from them. It seems now they give you one freebie solution and they use a cookie to track whether or not you've already viewed a solution this century.

Please award points now.

Process Lasso

[nomax]

Try Process Lasso, it has a process log feature. Very handy.

http://www.bitsum.com/

--nomax

Re:Process Lasso

[grcumb]

Try Process Lasso

I have to get out of here. I just read 'Try Princess Lasso', and I started thinking, 'What, like Wonder Woman? Hey, now there's my kind of diagnostic!'

Not enough details

[jafiwam]

But...

Get "HighjackThis" which will give you a list of all the stuff starting in a log file.

From there, you can start to figure out what each one is. It takes HOURS, but you'll know a lot when you are done.

Also, get "Tlist.exe" and "kill.exe" from the Windows SDK or PowerTools.

Then compose a batch file to use the command line switches in TList to fire periodically. Eventually the two apps will be running the at the same time. (Pipe all the results to a text file you can look at.)

Or, call a pro who can dig it out by sitting down in front. Submitter doesn't have enough background to provide full detail probably shouldn't be dicking with his/her registry either.

Re:Not enough details

[jafiwam]

(Ok, bad form to reply to myself.)

Also, learn to use "netstat" as well. Pop up windows with ads might reveal themselves by the TCP/IP connections they make.

You might be looking at it...

[HiredMan]

You might be looking at it and not see it.

When to a security demo and watched the security guys run a Metasploit process that actually injected the remote .dll into a currently running .dll on the target machine while showing process viewer.
So while sys_msg.exe or whatever minimal process changed in the process viewer slightly the name remained the same and there was no way to tell that the process was suddenly pwned from a remote host and was (presumably) doing horrible and unwanted things to your computer. All from a dropdown menu, point and click interface too.

I went back to my office and hugged my Mac, tell you what.

=tkk

The next step...

[hackwrench]

After doing that and then downloading Process explorer to make sure it isn't replaced is to look in your startup with either MSconfig or startup control panel.
http://www.sysinternals.com/Utilities/ProcessExplo rer.html
http://www.mlin.net/StartupCPL.shtml

Event Viewer

[Gates82]

I can't believe this hasn't been posted yet, atleast start by looking at the software log in the event viewer.

You know for just $50 an hour plus travel, I can take care of that issue for you.

--
So who is hotter? Ali or Ali's sister

networked?

[themushroom]

You didn't mention whether the computer was on a network. I see CMD windows pop up for a second to run things once in awhile on work machines, so there could be any number of applications which aren't in the msconfig list being invoked upon you.

If you're not on a network, as some others said earlier have a look at msconfig... that'd spook me.

HP Software

[trevick]

I had this same problem; a no-name window would appear in my task bar every few minutes and then disappear immediately. I used a tool by Stardock called SecureProcess (a part of their ThinkDesk suite) to find out what it was. The tool can be used to stop processes from starting until you give them permission.

In my case, it turns out the mystery window was software that came with my HP printer. I might be wrong, but I think it was HPCMPMGR.EXE (this was several months ago, however, so my recollection might be off.)

Re:HP Software

[Kaenneth]

I was stunned when I helped someone install an HP printer recently; the disk that came with it wanted to install over 800 megabytes of stuff.

bazooka

[Anonymous Coward]

go to cnet.com and download bazooka -- it will tell you if you have any malware and how to remove it

Sysinternals is a windows admins best friend

[Anonymous Coward]

For any windows problem to which you do not know the answer immediately or through a quick google search.

Visit http://www.sysinternals.com/

Look through all the categories and short descriptions until you find a tool that could provide a diagnostic clue.

In your case Process Explorer will do the trick, just turn the highlight time up and you should see process creation (provided it is caused by a process).

If no new process is spawning, an existing one is launching the window, so compare the process listing against a similarly configured pc without the problem or a clean one and slowly remove processes until the one causing the problem is destroyed.

If all the processes listed are valid, then you may have a compromised exe or dll, so use the dependency walker to find all the files used, then use md5sum or similar to hash them and compare the hashes against a clean machine.

If you think the problem may be using a network connection you get additional options; you can use tcpview & process explorer to find the process in question and then kill it. You can also use wireshark (formerly ethereal) from http://www.wireshark.org/ either on the machine itself or another machine to monitor the network traffic.

If all these steps are ineffectual, you may have a rootkit, so run rootkit revealer also from sysinternals.

If you suspect a virus/spyware then it can be difficult to use the machine itself to diagnose; instead grab a copy of Barts PE with Mcaffee/Sophos & lavasoft adaware and the registry redirector to scan the local machine. This usually will allow you to get the machine to a state where other tools can be effective.

Check out the Windows Resource Kits from Microsoft; they have a wealth of tools that may not be immediately useful, but can prove invaluable.

On domain machines, the first step is always to check any logon scripts/group policy.

May be normal?

[jafac]

I've noticed that some web sites will pop-up a browser window and hide it. For what reason, I have no idea. Poor coding practice?

On the Mac side, you can make it appear by using Expose. It's just a tiny, blank browser window with no control bar or buttons or anything, shuffled conveniently off the screen. Until Expose makes it my bitch.

On the Windows side, I'm sure there's got to be ways of popping IE windows, and making them not appear in the task bar. I just haven't seen it on the Windows side, because I browse a much narrower range of sites on Windows.

Re:May be normal?

[Anonymous Coward]

It would be nice to have some sort of information...no offense, but for all we know, this could be intellitext boxes and "immediately disappearing" might just mean it happens before a 105-year-old man can adjust the angle of his trifocles and figure out what's going on.

What OS?

[teridon]

You fail to state what OS you are running.

If you are running Windows XP Professional (I think Windows 2000 Pro also has it), you can simply turn on process tracking in Group Policy. Every process that starts will now be logged in the security log. View it with the Event Viewer (Start.. Run.. type "eventvwr.msc")

Instructions for how to enable process tracking (for exactly the same problem!)

I don't think the same can be done for Windows XP Home... but I've been wrong before ;-)

Hp Printer

[Anonymous Coward]

I am betting that you have an HP printer. I almost destroyed the printer itself when I found out what the window that was nagging me was. I stopped using their software. Google for it, I have since lost the link. I believe it may have been calling home to update it's software and perhaps I had blocked it's traffic and it just kept trying. It was very annoying because it would drop my full screen games to desktop. Whatever it was doing, I got it stopped for awhile thanks to google but when we updated the software it started doing it again. So we stopped using it altogether.

Very Simple

[MerlynEmrys67]

If it is a window - use APISpy to track windows API calls - look for a call to CreateWindow() and track where it is coming from.

iTunes and Shared Music?

[herrlich_98]

I hate to just chime with my own two cents and wild guess but I've had the same experience and tracked it down to iTunes opening a song from Shared Music. It a small wide rectangular window saying "Opening URL..." or something. I have seen it up for longer when there are network problems. You can reproduce it by clicking on Next Song several times quickly just as quickly as it can load songs.

Slo-Mo

[Mignon]

Press the "turbo" switch and run your PC at 8mhz instead of 12. The window will stay on screen longer, giving you enough time to see what it says.

Re:Slo-Mo

[dave562]

Also useful for quickly passing those pesky "auto-pilot" animation sequences in Wing Commander. Just make sure to take turbo off before you have to fight those pesky Ferrangi.

Another Sony Rootkit?

[mombodog]

Better get GMER http://www.gmer.net/

wintasks

[ehuss]

As several people have mentioned, some of the tools at sysinternals.com are perfect for this, and I highly recommend them.

Also, WinTasks (a task manager replacement) has a process logging feature. (www.liutilities.com)

harddrive

[kisrael]

what about figuring what's causing my laptop hard drive to go constantly? the memory settings look ok...

Re:harddrive

[Alien54]

what about figuring what's causing my laptop hard drive to go constantly? the memory settings look ok...

In general, this is cause by too many processes running for the amount of ram you are running. Things like AOL have all kinds of secondary processes. A typical lean system will be running 25 to 35 processes. Some systems ship now running 70 plus processes out of the box. Also, some people run things like Norton Internet Security, or the McAfee Security Center all in paranoid mode. These can also slow a system way down. Especially if you have low ram (less than 512)

The other solution is to go out and install at least a gig more memory. Or else buy a computer that will accept and allow for more than a gig of memory as a maximum.

Re:harddrive

[Anonymous Coward]

Get rid of Fedora and install a real OS like FreeBSD, Slackware, QNX or Windows.

Write a monitoring script

[Money for Nothin']

Write a script (VBS, Perl, whatever) to monitor your process list. Have it poll the process list every quarter of a second or something, and keep a running list of processes that are found. On the first iteration, write the list to one file. On succeeding iterations, compare the list of the i-th iteration to the list of known processes -- if a new process appears that wasn't in a previous iteration, spit it out to another file...

Hilarious!

[HarvardAce]

Press the "turbo" switch and run your PC at 8mhz instead of 12. The window will stay on screen longer, giving you enough time to see what it says.

I vote that this should be the comment of the week.

Re:Hilarious!

[clintp]

Maybe not so far off the mark: try running a session connected to the machine via VNC or Terminal Services. Especially over dialup or otherwise constricted network. The slow redraw might give you time to figure out what it is.

Re:Hilarious!

[HarvardAce]

if it shows up at all....and talk about an indirect solution, you might as well just screencap your entire desktop then...

Re:Hilarious!

[darkonc]

you might as well just screencap your entire desktop then

Too late. Somebody already suggested that...

Re:Hilarious!

[AndroidCat]

And if you've added a V20 chip, swapping the 8088 back in helps too.

Get Spyberus

[Alien54]

Available at robotgenius.net

Spyberus is free of charge. Check out the tutorial

There is probably a dll that is tied into explorer or something to repopulate when you clean.

Also, use Spybot Search and Destroy in safe mode with all of the updates, but use all of the immunize functions first. It can spot some zombie process that "look" normal, but which sure as heck aren't. and then kill them.

Do a maximum amount of cleaning in safe mode.

Check out Spywarewarrior.com for a comperhensive list of bogus cleaners that are really infectors. For an example, see this illustration.

I make a decent living doing nothing but cleaning things like this up. I can't give you a ten page How-to, but the links will put you on the right trail.

Re:Get Spyberus

[NavyNasa]

I think some of us would like the 10 page how-to. Some of us might be willing to PAY for the how-to. Why reinvent the wheel?

Re:Get Spyberus

[Alien54]

I think some of us would like the 10 page how-to. Some of us might be willing to PAY for the how-to. Why reinvent the wheel?

It tends to get outdated quickly, plus Spywarewarrior has forums that come with extra handholding free.

Plus they have the equivalent of the 10 page How-To here:

spywarewarrior.com/sww-help.htm.

Like I said, the links I provided are enough to get you pointed in the right direction.

iexplore

[qaz20]

I fixed this on my XP home sp2 machine by
deleting iexplorer.exe and quickly
creating a folder named iexplorer.exe
in it's place so Ms can't replace it.

Worked for me, no more popups,
and if I want IE, I run it from the
backup file.

q a z

Save a little more time.

[twitter]

A binary search would be better. Split the search space (the set of startup programs) in half. Enable or disable one half. If the problem appears, adjust your search space to that half.

Start with zero, all of them turned off. If this does not work, and it won't, you better wipe and reload. Boot off a liveCD, backup data files and start the reinstall.

Windoze never gets better, so you are better off with an ,alternative that installs in 20 minutes, does everthing you want and then keeps doing it. I once swore that I'd never suffer through a windoze install again, the reboots, the driver hunt, the software hunt, the endless screens of "I agree master" and now, I'm told, multiple reboots over "security updates". I've only had to break that vow once but never for my own computers.

Macs aren't safe

[Myria]

Macs aren't safe from injecting code into an existing process. Trojans can do the exact same thing on Mac OS X as on Windows. See the vm_write() Mach API call.

Same applies to Linux's ptrace().

Melissa

Re:Macs aren't safe

[99BottlesOfBeerInMyF]

Macs aren't safe from injecting code into an existing process. Trojans can do the exact same thing on Mac OS X as on Windows. See the vm_write() Mach API call.

Yeah, but this is software availability we're talking about. Via metasploit you can do such a thing from a drop-down menu without writing a line of code. I've seen no such, easily available, malware development tools for the Mac. That isn't to say someone could not create one, just that right now that is not the situation.

Re:Macs aren't safe

[jrockway]

Metasploit has Mac exploits. And if they don't anymore, they're certainly easy to write.

This is why I hug my OpenBSD machine. It may be my family's only line of defense!

Root-Kit?

[UltimApe]

Why hasn't anyone mentioned root-kits?

My gf's computer had a root-kit on it. I go to a tech school, and nearly everyone knowledgeable here (even IT guys) went over the damn thing to see what was wrong. It kept doing pop-ups, like it had some type of ad-ware, but it didn't appear to have anything abnormal running. It didn't matter if it was IE or firefox, the ad would pop up on pretty regular intervals. Every possible thing was checked, from using standard tools like spy-bot-s&d, any number of free and bought virus scanners... Some people (including me) even poured over the registry by hand to find out if anything was running. absolutely nothing.

It turned out to be a ROOT-KIT (2 actually, they hid each other. One user-mode, and one kernel-mode). The rogue programs actually were able to make windows "not see" the file. On boot, windows would see it just enough to turn it on, but after it was running it prevented anything from actually finding it, injecting code between the hard-disk access and low-level windows stuff. not windows-explorer, not regedit, not task-manager, not even 3rd party apps like win-task, or even defraggers.

http://www.sysinternals.com/Utilities/RootkitRevea ler.html - RootkitRevealer 1.7 by Sysinternals showed a directory in "C:/windows", and one in "C:/program files", that if you went to look normally, didn't show up. I quickly booted up Knoppix and verified that there was some crap in there, but a search on the Internet showed nothing. Booted windows into safe mode, and since safemode doesn't run things other than windows crap, I was able to delete the two folders, and even a registry entry that showed up about it.

If you can't find anything, maybe its because it won't let you find it!

Re:Root-Kit?

[Varun Soundararajan]

mod parent up. Do the antivirus stuffs try screening rootkits?

Re:Root-Kit?

[dctoastman]

Something similar happened here at work. (Don't remind me >_)
We had received a phishy email from "Dell" with a zip attachment containing a virus. We found the presence of the virus by the fact that we weren't able to use Remote Desktop to connect to the computer anymore. A virus scan revealed nothing. Process Explorer wouldn't even start. Task Manager revealed nothing. I had to run tasklist on the command line from another (non-infected) computer to actually see it. I Googled(tm) the name and found out what it was.
To remove it, I had to remote kill the process and then delete it by opening the proper folder from the non-infected machine.

I could beat the person who opened the attachment though. That's just asking for trouble.

And while filtering the email would help the overall situation, I am in a bad predicament in regards to actually setting policy, etc.

Re:Root-Kit?

[dargaud]

nearly everyone knowledgeable here (even IT guys) went over the damn thing to see what was wrong

Why is it that people waste time looking ? A rootkit can manipulate the user interface of the US anywhich way it wants. Plug the disk out, put it as a slave into another (clean or linux) machine, and scan from there. It's the simplest and fastest way to solve this kind of issue.

Re:Root-Kit?

[UltimApe]

Exactly, if you knew it was a root-kit, thats what you'd do. But root-kits are relatively new, and until only reciently have they actually been causing lots of trouble. When the computerh as a problem, who expects them by default? If an "average IT guy" was handed an "average user"'s computer to fix the pop-up problem... he'd do a spyware/virus scan and end up with nothing. He'd look through the registry to find suspicious running programs, and find nothing. He'd then end up with not fixing it because the actual cause of the problem is hidden. Even from a clean computer, a scan might not show up anything, most scanners don't even know about a lot of the new root-kits. And thusly, the only way you can know if it is actually a root-kit is to catch it red-handed. Just poping it into a linux machine and scanning won't likely find anything because its' not a virus, and it's not known spyware. Looking for root-kits isn't something high on the priority list (but perhaps it should be), and many people don't even know they are a problem. But not everyone is gifted with the ability to pop out their hard-disk and load it into another non-infected machine. A root-kit scanner should be in any computer-fixer's toolbox.

Several Sysinternal tools

[S3D]

There are some very effective free tools from Sysinternal.com : 1. Process Explorer - it's showing not only the list of process, but also their paths on the disk http://www.sysinternals.com/Utilities/ProcessExplo rer.html 2. Autorun : showing all processes and services launched automatically on start, and allowing to disable them. Very usewful for temporary disabling DRM crap like cdac11ba.exe, temporary disabling google web accelerator on start etc. http://www.sysinternals.com/Utilities/Autoruns.htm l 3. Rootkit Revealer - name speak for itself. http://www.sysinternals.com/Utilities/RootkitRevea ler.html Other tools allow monitor access to files, to disk, TCP/IP traffic etc.

If it was essential....

[EmbeddedJanitor]

Would you be doing it on Windows?

ROFLMAO, "activist"

[Anonymous Coward]

Is this supposed to be the new brand of "activism" coming out of the FSF? "Windoze never gets better"? Good lord, Slashdot never ceases to amaze me.

Re:ROFLMAO, "activist"

[jb.hl.com]

Have a look through twitter's post history. You'll die of laughter, pretty much all his posts are like this.

Re:ROFLMAO, "activist"

[Anonymous Coward]

Yeah, I think Bill Gates raped him or something. While holding a Pentium.

Re:ROFLMAO, "activist"

[jb.hl.com]

He clearly was, considering the number of times he's said Microsoft "rapes peoples wallets". Must be a touchy subject.

NOT a solution

[Anonymous Coward]

The question was "How can I figure what is causing this window to pop-up all the time?". The general question is "How can I fix my computer?"

Buying a computer is NOT a solution to this in any way.

Please learn more about your language before you try to engage it again.

Try silent runners

[v1z]

http://silentrunners.org/

That, or a reformat and re-install, ofcourse :-)

Never heard of a premade app for this

[billcopc]

I've never heard of an existing app that does this, but I have done it myself on a few occasions as a throwaway script. Just run a script every second (or faster), get the list of running processes ("tasklist" command), diff the output with the previous result and dump it to a log file with a time stamp. If you have the Win32-ported GNU tools you can do this with a batch file.

Maybe a WiFi App?

[Anonymous Coward]

My XP box has such a window. One day it popped up when the machine was heavily loaded and stuck around long enough for me to identify it. It belongs to an app which displays the WiFi signal strength in the whatchamacallit that also contains the clock. The window seems to get popped up momentarily during some part of the WiFi protocol.

It's much less annoying now that I know it's not malware.

Wireless mouse batteries?

[simon_clarkstone]

I had this problem for a while too. If the computer was sitting there, the box would never pop up, but randomly, while I was gaming, it would pop up and disappear immediately. The frequency of appearence went up over time, until it started to appear sometime while not gaming. By the point at which it was appearing several times a minute, I found that I could get it to not disappear if the mouse stopped moving at the exact time that it appeared.
It turned out to be a notice telling me to replace my wireless mouse batteries. Presumably a bug was causing it to disappear whenever more data was received from the mouse, so it never stayed on screen. (I was addicted to C&C Generals at the time, ICYW.)

THIS is why moderations are so screwey lately!

[JonTurner]

I'll tell you precisely why -- the new slashdot code! It used to be that one would select the moderation out of a list, scroll down to the bottom of the screen and hit "moderate" which would apply the moderations.

NOW, the instant you select the moderation from a list, it is applied. If you click the down arrow to expand the list and attempt to use the scroll wheel to move through the list, Slashcode it will "grab" whatever's highlighted in the list as your selection and apply it.

It's caused me to screw up moderating more than once recently. So to "undo" my moderations I have to post something in the thread. [b/c you can't post and moderate a discussion]

Re:THIS is why moderations are so screwey lately!

[DieNadel]

I agree with you. I've been testing this new discussion system for a while, but they just added this moderation "feature" lately.

I'd rather have something like the combo with a [MODERATE] button next to it (so that I don't have to go all the way down).

Re:THIS is why moderations are so screwey lately!

[stry_cat]

@#$$@# That's where all my mod points went!! I had 4points and like I always do, I play with the dropdowns quite a bit before I find ones I want to moderate. No telling what kind of horrible moderation I did last week. #!@#$#@ Sorry about that folks.

's/office/mom's basement/'

[Anonymous Coward]

's/office/mom's basement/'

24 hour respnse time

[twitter]

Did you guys have some kind of technical problem? Like IP blocks? I almost missed you losers and your modbomb.

Re:24 hour respnse time

[koreaman]

Are you serious? You get more ridiculous all the time.

By the way, you're probably going to claim I'm working for Redmond or something. For your information I'm actually in France, and I've never been paid two cents by any company besides McDonalds (I'm 17 years old) for any reason ever.

Re:24 hour respnse time

[Anonymous Coward]

Maybe if you didn't post the same opinion again and again and again you wouldn't get modded down all the time? Just a thought.

Just figured that you might notice that it's your fault.

Re:24 hour respnse time

[jb.hl.com]

Modbomb. Yes. Of course, twitter. Everyone's out to get you.

In case you haven't realised, if you didn't spout shit all the time, you wouldn't get modded down and "stalked".

Re:24 hour respnse time

[Anonymous Coward]

So you defend Microsoft for free? That means you're even more of a zealot!

Re:24 hour respnse time

[koreaman]

I attacked you, I didn't defend Microsoft. There's a difference. I think Microsoft is evil, but I also think they make some good products. Just my 2 centimes.

Debug

[Chewbode]

Not sure if you'll have enough time to do this or not... 1. Install the "Debugging Tools for Windows" (http://www.microsoft.com/whdc/devtools/debugging/ installx86.mspx) and launch WinDbg. 2. Monitor the process in Task Manager. 3. As soon as the process appears in Task Manager, Alt+Tab to WinDbg and Attach to Process (F6), then click the Break button (Ctrl+Break). This should halt the application and allow you to analyze (!analyze -v) it to see what it's doing. Or, at the very least, you could upload the output of the debug to some message board and see if anyone could tell you what's going on. Of course, you could also just reformat. You need to do it anyway. Trust me. ;)

Old School solution

[Anonymous Coward]

Ever try the Pause key, right next to Scroll Lock? Works for me, even on most modern OSes.

At some point though...

[charleste]

..."totaled" will be one of those repairs. Case in point, my 1980 pickup truck. When it came down to having to scrape off the transmission pan gasket (did you know they weren't designed to last 25 years?), it became "totaled". I for one did not want to spend 8 hours on my back underneath it flicking who-knows-what toxic things into my nostrils and pores, and my reliable shop gave me a bid of 4 hours (@US$40/hr)... Take into account that it has no heater (and I live in the Great White North), and the fusebox needed replacing... TOTALED! But I did get US$40 cash and "they" took it away :-) The same with computers. My old laptop needed a new battery, a new backlight, a memory replacement and upgrade... the purchase price of a *new* laptop was only a couple of hundred more. So I bought a new laptop. I'm *very* happy with my decision (got one of those widescreen "desktop replacements" - not really a laptop).

Re:At some point though...

[jizziknight]

Well, "totaled" is relative in your case. I had an '86 Cavalier that was "totaled" by someone breaking the lock on the door (and damaging the body around the lock) to try to steal my stereo (rather unsuccessfully). However, my insurance company was nice enough to give me $1100 to get it fixed since the car was otherwise fully operational. The point is that unless the car is totally destroyed, "totaled" is relative to how much the car is worth to you and how much you're willing to pay to fix it. In my case, I can't justify a $20000+ purchase of a new car (I refuse to buy a used car if I'm going to buy another car) until my car either can't be fixed or is totally destroyed.

Re:D'oh!

[drinkypoo]

Anonymously doesn't mean anonymously. Slashdot knows who made what posts, or at the very least, who has contributed to a discussion. (I haven't studied slashcode, so I do not pretend to know precisely what is going on.) Try it sometime, post anon to a discussion when you have mod points, then come back and try to moderate in that discussion.

Me, too, and SI/PE don't help

[Erebus]

This just started happening on my work laptop about a month ago. I got Sysinternals and Process Explorer, opened it up, and waited for the window to appear/disappear. It did not spawn a new process, as far as I could tell (there was no red 'recently deceased' line, etc). I am guessing at this point that it's being produced by an already running process, and so doesn't have to start up something new. No spyware/virus/rootkit checker reports anything at all.

Don't hold back now...

[Anonymous Coward]

I mean, geez, as long as you're going to post AC you might as well let go and tell us what you really think of 'im...

Re:D'oh!

[MLease]

Anonymously doesn't mean anonymously. Slashdot knows who made what posts, or at the very least, who has contributed to a discussion. (I haven't studied slashcode, so I do not pretend to know precisely what is going on.) Try it sometime, post anon to a discussion when you have mod points, then come back and try to moderate in that discussion.

I've found that if I actually log out, it works fine. However, Firefox automatically fills in my login information on the reply form, so if I neglect to remove it, I get logged back in anyway. Oops....

-Mike

Hit the Print Screen Key

[Captain Chad]

I don't know how long it stays up, but if it's more than a half-second, you may want to just hit the print screen key as fast as you can. It will save a bitmap copy of the screen to the clipboard, which you can then analyze at your leisure.

Wrong

[Cybert4]

If the cost of repair is more than the value of the _repaired_ car--then by definition repairing it is stupid. Because you can just buy a similar used car and junk the one you have.

Re:Wrong

[JonathanR]

Your argument is somewhat simplistic. Your recommendation to purchase another (presumably second-hand) vehicle for the same value of the repair cost + salvage value, neglects a number of subtlties. Firstly, the unknowns of the replacement vehicle (compared with the known history of your current vehicle). Secondly, you ignore the premium you will probably pay if you purchase through a used car dealer (or the aggro of locating a private sale). Thirdly, you are ignorning the costs associated with disposal of your existing vehicle (particularly if it is a non-runner). Fourthly, you are neglecting the costs associated with transfer of title for your replacement vehicle (which, where I come from, is not insignificant).

All I can say for certain is this...

[Arceliar]

it's almost a guarantee that the process in question is in one way or another linked to or dependent on this thing lots of computers these days have, I believe it's called 'windoze' or something to that effect. My solution would be get rid of that thing first >.> Seriously though, most (not all, but most) windows I see pop up for a moment are batch files running one command or another, usually just spawning some random process the computer's administrator set up. Typically speaking, you'd expect if it were a virus that it would be a bit more subtle about it's presence than opening a window. So my guess is that it's something that's supposed to be there, though I wouldn't bet on that if the stakes were high.

Similar Bug

[phyy-nx]

I had spyware that I had a hard time tracking down as well. I knew that it was running, but that I couldn't see it in the task manager. It would open up ads on occasion that looked like IE. I found the process name by open up windows notepad, calling up the Save As... dialog and telling my computer to shut down. Of course, the computer can't shut down because of the dialog, so the spyware started to crash as well, throwing up error dialogs identifying the name of the process. I used process explorer (as already mentioned) and a network logger to find the directory containing the suspect exe, but using window's explorer, the directory didn't exist. Eventually I had to boot into safe mode to delete the directory. Inside, I found records of everything I had been doing on the compy for months: chat transcripts, files, you name it. Regardless, I was thrilled that I had nailed the thing! Can't hide from me forever, scallywag!

Hijack This!

[angelopsu]

You can check out Hijack This. When downloaded and run, it will show every process running on your machine. You'll have to go in and figure out which is the one doing the weird stuff.

Looks at what processes are being spawned

[trmatthe]

You could turn on process monitoring (google for Auditing Settings Process Accounting). This will record an event log entry every time a new process is spawned with some details that might be useful. However, if the popup is generated by a single process which popups, then sleeps it won't create an event log entry every time - as the process isn't being re-spawned.

If you are concerned that you have been rootkitted and that the event log can't be trusted, you may as well blow the whole thing away (or take your luck with rootkit removal - urgh).

trmatthe

Re:D'oh!

[drachenstern]

Could this be the one instance where IE would be appreciable?

Say it ain't so joe!