29

I keep seeing a console window pop up for a fraction of a second every couple of hours. Seems random, I can't pin it to any one particular event. Is there any way I can trap the window and see what it's doing?

I'm on Win 10, latest updates, Norton.

migrated from security.stackexchange.com May 27 '17 at 14:29

This question came from our site for information security professionals.

  • Can't you find process which started cmd.exe? Did you check process tree for conhost.exe parents? – de6f May 26 '17 at 19:59
  • @de6f Let's pretend I'm not a Windows guru :) I don't understand any of the above unfortunately. Can you dumb it down for me? I'm a code monkey but I don't know sys / net / win stuff. How do I do that? – Absinthe May 26 '17 at 20:11
  • Noticed the very same thing today. When it first happened I've noticed Office Click To Run was working, probably on an update, so I didn't bother,, but I've seen it 2-3 more times over the afternoon and Office is no longer active. – Mario May 27 '17 at 14:08
36

Did some further investigation and considering the fact the first time I've noticed, Office Click to Run was active, I have the suspicion that this is indeed the issue also described here on Reddit:

Yesterday I noticed something weird at my Desktop PC, CMD popped up with an hour between, exactly, but it disappeared again too fast for me to have any chance of seeing what the title is, or if there's any text, or anything, in fact I'm not 100% sure it's CMD, but it has the shape and color. I thought this was a specific program doing it, so I went through the event viewer, unable to find anything, but just gave up there.

Today on my Laptop, an hour after turning it on, the excact same thing happened to me, though Chrome and Spotify were running on both PC's I believe it has something to do with Windows... If anyone knows anything about it, please help, because it's annoying as hell to be tabbed out of your game, or concentration because of such a little thing.

So it seems several Reddit users noticed the same problem and they've come to a similar conlusion as me:

I went to the Task Scheduler > Task Scheduler Library > Microsoft > Office and found and disabled "OfficeBackgroundTaskHandlerRegistration"

So I checked my Scheduled Tasks, opened the Microsoft and Office categories and indeed the OfficeBackgroundTaskHandlerRegistration task ran the exact moment I've noticed the popup the last time.

Running the task by hand led to the exact same result: a console window popping up for a split second.

So guess Microsoft changed something in the program ran for this task. You can probably disable the task for now, although I don't know whether there's any impact on doing so.

  • 5
    This was affecting me, too! And the window seems to grab focus, which completely destroys PC gaming. Wow, what a flub, Microsoft! – allquixotic May 28 '17 at 0:07
  • 2
    This same thing happened to me since the last Windows update, which I did on the 29.05.17. It was set to trigger once every hour or so. Im just glad you worked it out, I thought I got a virus or something... – John H. K. Jun 2 '17 at 17:45
  • As per Microsoft, the fix for this is in the 6/6/17 build of Windows 10. – Andrew Jun 9 '17 at 20:27
3

SOLUTION: Run Task Scheduler > Microsoft > Office > Right click "OfficeBackgroundTaskHandlerRegistration" > Disable.

Here's an image of the location I created in case you need extra help:

enter image description here

1

This solution might be a bit hackey, but I had a similar issue once so I recorded my screen with the slowmo feature of my phone. I was actually able to pause the video at a frame that showed the console window and figured out that it was just a silly Easteregg of a game I had, but it worked!

  • 2
    Similar but you could use a screen capture piece of software that records the screen as a video. You might get a better picture. Just a thought – ISMSDEV May 26 '17 at 19:53
  • That's even better, I just didn't want to go out of my way to install anything vs. pulling out my phone and just pressing record :) – PositriesElectron May 26 '17 at 20:06
  • It's low tech but I like it :) I guess this is a long shot as I have no knowledge of Windows programming but is there no way to listen for the console being opened and trap it? – Absinthe May 26 '17 at 20:13
1

Since you understand the code and assuming can read the stack trace, look at Sys internal tools especially Process Monitor. It lets you look at the file system calls, registry checks etc., so you can find which process is creating console and take necessary actions.

You can filter API calls by using Filter option of the tool, can even save the state or reduce the capture by restricting it to cmd.exe or any application.

Here is a nice tutorial of all things you can do with Process Monitor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.