Slashdot Mirror
Finding a Disappearing Application in Windows?
siuengr asks: "I have a computer that has a window that pops up every few minutes, but disappears before I can figure out what it is. I have run every virus program and spybot cleaner I have, but they do not find any problems. How can I figure what is causing this window to pop-up all the time, when it doesn't stick around long enough to see anything about it? Is there any software that tracks what applications have ran over a period of time, even if they are not currently running?"
Use CamStudio (GPL), or some other desktop video recorder. Record your desktop until the event has occurred a few times, then advance to a frame in the video file that contains the dialogue box/application window. Leave the task manager (ctrl-alt-delete) running off to the side. Let the event occur once with the applications tab displayed and once with the processes tab. Make sure you can see the whole process list.
Check the event viewer (control panel->administration) for erratic messages. Try disabling processes one by one to see if one of them is the cause. What Anti-stuff are you running? Anti-stuff is only as good as the definition database. Furthermore, many malicious processes can hide their existence from the OS, and an application tracking software is almost certainly going to get this info from the OS. Make sure your video drivers are up-to-date. If you suspect that the app communicates over the netowrk, install a software firewall and set it to anal mode.
Run a benchmarking utility or simultaneously run several resource hungry applications to slow the machine down, and maybe the window will hang around for a while.
If you cant catch it there, just format and reinstall Windows--the standard fix for anything Microsoft. Cue the mac/linux comments!
FairTax baby!
Tiny Firewall provides a security module that requires the user authorize every unknown application be manually allowed to run.
While I have yet to see any unknown process start on my machine, none (not even ones started by trusted processes) are allowed to proceed without first being given the OK by me. I'd give it a shot and see if TF 2006 can catch it for you.
Prcess Explorer Options..Different Highlight Duration
It might be a better solution
Google for it. It shows recently terminated processes in red (or whatever) for a few seconds after it's terminated (all configurable)
The revolution will not be televised... but it will have a page on Wikipedia
Assumptions:
1. For a dialog to be coming up it has to be iniatated by a process.
2. Mystery process most likely isn't part of Windows
Action:
1. Disable all startup programs with msconfig
2. Reboot
3. If problem is gone re-enable startup processes one at a time.
If the problem is back/still there go to step 5
4. Goto step 2
5. Visit Slashdot. Scroll past this comment and proceed to next proposed solution, one which, hopefully, won't waste your time like this one just did.
If nothing obvious is running as a process, this might be popping up from a scheduled task.
Occassionally we ran these at my old job and it would pop up a window in front of whatever you were doing, very briefly. The task was a batch file that kicked off something else.
Unitarian Church: Freethinkers Congregate!
Your exact scenario happened to me a few weeks ago.
Do you use the TweakUI program that comes with Powertoys for Windows XP? If so, do you have X-Mouse turned on? Check Mouse -> X-Mouse and see if "Activation follows mouse (X-Mouse)" is turned on.
Some poorly written Windows apps will pop up dialogs that then disappear if they lose mouse focus. If you have X-Mouse turned on, they will pop up a dialog - and if your mouse is anywhere else on the screen, they'll think they've lost focus and close the dialog.
All I had to do was disable X-Mouse until the app popped the dialog again, then I could deal with it. Unfortunately I don't remember what the poorly written program happened to be...
The Online Slang Dictionary
It's trivial to replace the task manager with one that only shows certain processes, and this technique is used regularly by malware. If the security of your system has been breached the task manager isn't a reliable source of information.
"A Lisp programmer knows the value of everything, but the cost of nothing." - Alan Perlis
Spy++ (comes with Visual Studio and probably other packages) should be able to list the window, even after it disappears and trace it to the owning process. Used it many times to find information about "rogue" dialogs.
StarTrek.org Free Webmail
Since when did Slashdot become Experts Exchange?
At least we don't need to login to see the solution. That site is annoying.
Dedicated Cthulhu Cultist since 4523 BC.
buy a new computer? It really irks me when people cite this as a solution.
It is a solution!
Just because it's not the techiest, or generally lowest-cost, or whatever, doesn't disqualify it from being a solution. It solved his problem. Therefore, by definition it is a solution.
You fail to state what OS you are running.
;-)
If you are running Windows XP Professional (I think Windows 2000 Pro also has it), you can simply turn on process tracking in Group Policy. Every process that starts will now be logged in the security log. View it with the Event Viewer (Start.. Run.. type "eventvwr.msc")
Instructions for how to enable process tracking (for exactly the same problem!)
I don't think the same can be done for Windows XP Home... but I've been wrong before
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
Press the "turbo" switch and run your PC at 8mhz instead of 12. The window will stay on screen longer, giving you enough time to see what it says.
Accepted Answer!
It's like "hey, my brakes squeal, how do I solve this?" And instead of really solving the squealing brakes by replacing them you just buy a new car. Do the brakes still squeal? Yes, but since you're not driving it anymore you no longer care.
Yes. It is like that. But it is still a solution !
Just because you find it a bit silly to replace a whole computer because of spyware, or replace a whole car because of squeaky brakes, doesn't disqualify it as a solution. No matter how silly you find it, it's still a solution to the problem of the user experiencing spyware on his computer, or squeaky brakes on his car.
In the case of the computer, as a techie, I would actually recommend this to non-techies. A new dell costs about the same as you could expect to pay if you would pay someone to fix the problem. In addition you get a new and better computer. If you were to pay someone to fix it, you would still solve the problem, and still part with your money, but you would not have a new and spiffy computer. If you invested the time into learning enough about computers to fix it yourself, by the time you were finished fixing the probem, if you'd been working overtime instead, you could have bought at least 50 dells.
As for the car, the same logic applies. If it's an old car, which you know sooner or later will need a major (costly) overhaul, you can just as well ditch it when a problem shows up, such as squeaky brakes. You don't need to fix it yourself, or pay someone to do it, when you are going to need a new car soon enough anyway.
It could be that the process isn't actually a process, but a dll loaded into a process.
/u thenameofthe.dll into a cmd window. Then you'll want to move or remove the file.
You'll need to get Process Explorer as explained in the above posts. Then when you find the nasty, you'll want to kill the process housing it, and then type regsvr32
"Build a man a fire warm him for a day, set a man on fire and warm him for the rest of his life."
Available at robotgenius.net
Spyberus is free of charge. Check out the tutorial
There is probably a dll that is tied into explorer or something to repopulate when you clean.
Also, use Spybot Search and Destroy in safe mode with all of the updates, but use all of the immunize functions first. It can spot some zombie process that "look" normal, but which sure as heck aren't. and then kill them.
Do a maximum amount of cleaning in safe mode.
Check out Spywarewarrior.com for a comperhensive list of bogus cleaners that are really infectors. For an example, see this illustration.
I make a decent living doing nothing but cleaning things like this up. I can't give you a ten page How-to, but the links will put you on the right trail.
"It is a greater offense to steal men's labor, than their clothes"
Good point. Maybe download Process Explorer instead.
-Mike
I'm sorry; I don't know what I was thinking!
Why hasn't anyone mentioned root-kits?
a ler.html - RootkitRevealer 1.7 by Sysinternals showed a directory in "C:/windows", and one in "C:/program files", that if you went to look normally, didn't show up. I quickly booted up Knoppix and verified that there was some crap in there, but a search on the Internet showed nothing. Booted windows into safe mode, and since safemode doesn't run things other than windows crap, I was able to delete the two folders, and even a registry entry that showed up about it.
My gf's computer had a root-kit on it. I go to a tech school, and nearly everyone knowledgeable here (even IT guys) went over the damn thing to see what was wrong. It kept doing pop-ups, like it had some type of ad-ware, but it didn't appear to have anything abnormal running. It didn't matter if it was IE or firefox, the ad would pop up on pretty regular intervals. Every possible thing was checked, from using standard tools like spy-bot-s&d, any number of free and bought virus scanners... Some people (including me) even poured over the registry by hand to find out if anything was running. absolutely nothing.
It turned out to be a ROOT-KIT (2 actually, they hid each other. One user-mode, and one kernel-mode). The rogue programs actually were able to make windows "not see" the file. On boot, windows would see it just enough to turn it on, but after it was running it prevented anything from actually finding it, injecting code between the hard-disk access and low-level windows stuff. not windows-explorer, not regedit, not task-manager, not even 3rd party apps like win-task, or even defraggers.
http://www.sysinternals.com/Utilities/RootkitReve
If you can't find anything, maybe its because it won't let you find it!
"Infecting minds with my own memetic virus, one post at a time." Ultimape
Tell me about it, I installed a new HP multi-fuction printer/scanner/fax on Tuesday. As soon as I connected it to the phone line, it called up the phone company, pretended to be me, got my phone records, and faxed them to HP corporate headquarters.
~~~~~ BigLig2? You mean there's another one of me?