Unidentified application window - visible for 100th of a second

May 23, 2020 1:13 PM

I have a window that pops up very briefly, probably for less than a 100th of a second. It does it about maybe 15 times a day and interrupts some actions, like if I'm typing. How do I find out what it is and kill it?

I don't think it interrupts all applications when it occurs. I'm not even sure when it started, maybe a month ago. Any ideas welcome. It's black-ish and covers about a fifth of my screen.


System
Win10 Home 64bit
A lot of CAD and GIS software

In this time period I have installed these:
Pandoc 2.9.2.1
MiKTeX 2.9
Microsoft Office 365 Business - en-us
Adobe Flash Player 32 NPAPl
Ditto
Epic Privacy Browser
Everything
Affinity Designer
Take Control Agent
Jitsi
Cisco Webex Meetings
Mozilla Firefox 74.0

posted by unearthed to Computers & Internet (6 answers total)

I don’t know what’s causing it but black and a fifth of the screen sounds a lot like a quick flash of the Windows command prompt. In which case something is quickly executing a script.
posted by matthewr at 1:58 PM on May 23 [7 favorites]

Sysmon would be able to tell you what's doing it, though there's a firehose of information that you'd have to go through.
posted by Candleman at 2:39 PM on May 23

You could open Task Scheduler and see if there's something scheduled. You could follow these instructions to turn on and search event logging.
posted by inkyz at 2:50 PM on May 23

Sysmon is what i would use, but it's definitely for technical users. For your case, stop capture after you see the window, and then search for createprocess.
posted by Horselover Fat at 3:08 PM on May 23

You could set up something like a dashcam which records constantly in a loop and can be locked after an event. Perhaps it can catch the window for the short moment it appears.
posted by ShooBoo at 7:12 PM on May 23

I ended up using Process Explorer (PE) and setting Difference Highlight Duration to 9 seconds, and then leaving a window running, when the event happened I had it in PE and it was Clavier keyboard shortcut tool. As to why it's doing this is another matter but at least I know the what.

Thanks Candleman, if ever I get a serious problem I'll try that route.
posted by unearthed at 11:53 AM on May 24 [1 favorite]