4

Since I upgraded to Windows 10 the calculator has started randomly opening when I go away from my computer. After googling I found out that there could be a worm doing this, but I can't recall downloading any suspicious files and BitDefender's scan came up clean.

I tried to track down where the file was opened from by turning on "Audit process tracking" and looking in the event viewer for clues.

After ~1 hour I got this:

Process Information:
New Process ID:     0x1f30
New Process Name:   C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1507.15010.0_x64__8wekyb3d8bbwe\Calculator.exe
Token Elevation Type:   %%1938
Mandatory Label:        Mandatory Label\Low Mandatory Level
Creator Process ID: 0x38c
Creator Process Name:   C:\Windows\System32\svchost.exe
Process Command Line:   

Which doesn't tell me a whole lot. Does anyone have any idea how to track down the process that keeps starting it?

4
  • Did you check application list in "windows Startup" to see any suspicious program? Aug 24, 2015 at 18:15
  • 1
    It is unlikely a "worm" since your research actually was actually about the old legacy Win32 calculator.exe which isn't present on Windows 10 to my knowledge. Even if it is present, it isn't being started, so its not applicable.
    – Ramhound
    Aug 24, 2015 at 18:29
  • I had this problem too. If you use "DisplayFusion", it's probably the cause. the newest Beta fixes it. displayfusion.com/Download/Beta
    – JimDel
    Aug 26, 2015 at 16:36
  • Oh, wow @JimDel I was just about to go in and accept Techie's answer. If you repost your comment as an answer I will happily accept it
    – Semicolon
    Aug 26, 2015 at 17:10

2 Answers 2

1

I had this problem too. If you use "DisplayFusion", it's probably the cause. the newest Beta fixes it. displayfusion.com/Download/Beta

0

It tells you it was SVCHost.exe that ran it ("Creator Process Name"). Use the PID ("Creator Process ID") and Task Manager to figure out which SVCHost.exe is the one in question, and then use Task Manager to figure out which services are running under that specific SVCHost.exe process...

Once you have that list, disable and re-enable your suspects one at a time until you figure out the culprit.

2
  • Oooh, in the details tab of the event viewer there is "NewProcessId" and "ProcessId". In the General tab it's not called "ProcessId", but "Creator Process ID". I only looked in the details tab so I didn't realize that ProcessId was actually the creator's ID. Turns out it's "Service Host: DCOM Server Process Launcher" which hosts a bunch of seemingly essential processes. I'll have to look into it tomorrow.
    – Semicolon
    Aug 24, 2015 at 21:34
  • I have the same problem: calculator.exe is started by svchost.exe which is responsible for DcomLaunch, BrokerInfrastructure, SystemEventsBroker and Power. I have not figured out how to stop autostarting calculator.exe. Semicolon, did you solve it?
    – floppes
    Apr 24, 2019 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .