Slashdot Mirror
Finding a Disappearing Application in Windows?
siuengr asks: "I have a computer that has a window that pops up every few minutes, but disappears before I can figure out what it is. I have run every virus program and spybot cleaner I have, but they do not find any problems. How can I figure what is causing this window to pop-up all the time, when it doesn't stick around long enough to see anything about it? Is there any software that tracks what applications have ran over a period of time, even if they are not currently running?"
Open up the Task Manager and be patient. Watch the processes.
Same thing! Be interesting to see if anyone tracks this down. My solution was to buy a new computer (old one severely needed an upgrade anyway). I looked through my processes and didn't see anything. Tried windows live antivirus too. Happens every few minutes here. Try killing your processes or using msconfig to kill startup stuff. There's several sites that list known windows processes.
Nuking windows and/or wiping drives or partitions will of course work as well.
Use CamStudio (GPL), or some other desktop video recorder. Record your desktop until the event has occurred a few times, then advance to a frame in the video file that contains the dialogue box/application window. Leave the task manager (ctrl-alt-delete) running off to the side. Let the event occur once with the applications tab displayed and once with the processes tab. Make sure you can see the whole process list.
Check the event viewer (control panel->administration) for erratic messages. Try disabling processes one by one to see if one of them is the cause. What Anti-stuff are you running? Anti-stuff is only as good as the definition database. Furthermore, many malicious processes can hide their existence from the OS, and an application tracking software is almost certainly going to get this info from the OS. Make sure your video drivers are up-to-date. If you suspect that the app communicates over the netowrk, install a software firewall and set it to anal mode.
Run a benchmarking utility or simultaneously run several resource hungry applications to slow the machine down, and maybe the window will hang around for a while.
If you cant catch it there, just format and reinstall Windows--the standard fix for anything Microsoft. Cue the mac/linux comments!
FairTax baby!
Tiny Firewall provides a security module that requires the user authorize every unknown application be manually allowed to run.
While I have yet to see any unknown process start on my machine, none (not even ones started by trusted processes) are allowed to proceed without first being given the OK by me. I'd give it a shot and see if TF 2006 can catch it for you.
Prcess Explorer Options..Different Highlight Duration
Google for it. It shows recently terminated processes in red (or whatever) for a few seconds after it's terminated (all configurable)
The revolution will not be televised... but it will have a page on Wikipedia
If nothing obvious is running as a process, this might be popping up from a scheduled task.
Occassionally we ran these at my old job and it would pop up a window in front of whatever you were doing, very briefly. The task was a batch file that kicked off something else.
Unitarian Church: Freethinkers Congregate!
If you have an HP printer/scanner it might be their updater program.
Look on sysinternals.com - the best bet would be Filemon - then you can track which files are being opened.
Your exact scenario happened to me a few weeks ago.
Do you use the TweakUI program that comes with Powertoys for Windows XP? If so, do you have X-Mouse turned on? Check Mouse -> X-Mouse and see if "Activation follows mouse (X-Mouse)" is turned on.
Some poorly written Windows apps will pop up dialogs that then disappear if they lose mouse focus. If you have X-Mouse turned on, they will pop up a dialog - and if your mouse is anywhere else on the screen, they'll think they've lost focus and close the dialog.
All I had to do was disable X-Mouse until the app popped the dialog again, then I could deal with it. Unfortunately I don't remember what the poorly written program happened to be...
The Online Slang Dictionary
We have an HP PSC 2355 printer and we installed the software that came with it. Anyhow, every half an hour or so, a program would randomly appear in the taskbar and disappear very quickly afterwards, usually minimising any full-screen applications. In the end, we had to disable it in msconfig. I honestly can't remember what the entry was in msconfig, but I could find it somewhere if it's actually the problem. Of course, it probably begins with "hp" anyway.
If we can hit that bull's-eye, the rest of the dominoes will fall like a house of cards... Checkmate.
Try Process Lasso, it has a process log feature. Very handy.
http://www.bitsum.com/
--nomax
Yes the HP software was doing it to me too, I would be playing a game and it would actually drop me to the desktop. At first I thought the game had crashed but I was able to alt-tab back to it. I ended up uninstalling all the HP software that came with that printer.
For any windows problem to which you do not know the answer immediately or through a quick google search.
Visit http://www.sysinternals.com/
Look through all the categories and short descriptions until you find a tool that could provide a diagnostic clue.
In your case Process Explorer will do the trick, just turn the highlight time up and you should see process creation (provided it is caused by a process).
If no new process is spawning, an existing one is launching the window, so compare the process listing against a similarly configured pc without the problem or a clean one and slowly remove processes until the one causing the problem is destroyed.
If all the processes listed are valid, then you may have a compromised exe or dll, so use the dependency walker to find all the files used, then use md5sum or similar to hash them and compare the hashes against a clean machine.
If you think the problem may be using a network connection you get additional options; you can use tcpview & process explorer to find the process in question and then kill it. You can also use wireshark (formerly ethereal) from http://www.wireshark.org/ either on the machine itself or another machine to monitor the network traffic.
If all these steps are ineffectual, you may have a rootkit, so run rootkit revealer also from sysinternals.
If you suspect a virus/spyware then it can be difficult to use the machine itself to diagnose; instead grab a copy of Barts PE with Mcaffee/Sophos & lavasoft adaware and the registry redirector to scan the local machine. This usually will allow you to get the machine to a state where other tools can be effective.
Check out the Windows Resource Kits from Microsoft; they have a wealth of tools that may not be immediately useful, but can prove invaluable.
On domain machines, the first step is always to check any logon scripts/group policy.
Yeah, parent is probably Old School like the Old School. They don't require people to login anymore, but they used to a few years ago. I'm not sure when they changed it.
https://www.eff.org/https-everywhere
You fail to state what OS you are running.
;-)
If you are running Windows XP Professional (I think Windows 2000 Pro also has it), you can simply turn on process tracking in Group Policy. Every process that starts will now be logged in the security log. View it with the Event Viewer (Start.. Run.. type "eventvwr.msc")
Instructions for how to enable process tracking (for exactly the same problem!)
I don't think the same can be done for Windows XP Home... but I've been wrong before
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
Write a script (VBS, Perl, whatever) to monitor your process list. Have it poll the process list every quarter of a second or something, and keep a running list of processes that are found. On the first iteration, write the list to one file. On succeeding iterations, compare the list of the i-th iteration to the list of known processes -- if a new process appears that wasn't in a previous iteration, spit it out to another file...
Is Capitalism Good for the Poor?
Available at robotgenius.net
Spyberus is free of charge. Check out the tutorial
There is probably a dll that is tied into explorer or something to repopulate when you clean.
Also, use Spybot Search and Destroy in safe mode with all of the updates, but use all of the immunize functions first. It can spot some zombie process that "look" normal, but which sure as heck aren't. and then kill them.
Do a maximum amount of cleaning in safe mode.
Check out Spywarewarrior.com for a comperhensive list of bogus cleaners that are really infectors. For an example, see this illustration.
I make a decent living doing nothing but cleaning things like this up. I can't give you a ten page How-to, but the links will put you on the right trail.
"It is a greater offense to steal men's labor, than their clothes"
Macs aren't safe from injecting code into an existing process. Trojans can do the exact same thing on Mac OS X as on Windows. See the vm_write() Mach API call.
Same applies to Linux's ptrace().
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Somebody please mod parent up! It needs to be +5 Informative.
First thing I thought of was the Borland version (Winsight), and this is exactly how you figure this kind of nonsense out. These apps actually enumerate all current window handles and will give you owning pids, parent/child windows, message queues, etc. If you don't already have a Borland IDE license, Borland now offers free (beer) and trial versions of their products, just dl a windows version and it ought to come with this tool.
If not, I also found another similar standalone app called Winspector (not to be confused w/ Borland's Winspector, which does something different) at http://www.windows-spy.com/, but I have not used it and can't vouch for it.