0

I've noticed that an unknown cmd opens up exactly every 10 minutes and disappears almost instantly. To try and figure out what's doing this i downloaded an application called focus.exe which prints out the pid and application that stole the focus. The log shows this:

23228:C:\Windows\System32\cmd.exe | Fri Jan 15 17:16:50 2021
13640:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Fri Jan 15 17:16:50 2021
26704:C:\Windows\System32\cmd.exe | Fri Jan 15 17:26:50 2021
13640:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Fri Jan 15 17:26:50 2021
31644:C:\Windows\System32\cmd.exe | Fri Jan 15 17:36:50 2021
13640:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Fri Jan 15 17:36:50 2021
21264:C:\Windows\System32\cmd.exe | Fri Jan 15 17:46:50 2021
13640:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Fri Jan 15 17:46:50 2021
17032:C:\Windows\System32\cmd.exe | Fri Jan 15 18:06:50 2021

I need help finding out what's causing this. I googled and found some some old bug with an office background task but i've looked and it doesn't seem to be the same problem (it's been patched as well). Does anyone have a clue what could cause this? My games get tabbed when this happens.

I do not think that chrome has anything to do with this, i believe chrome was in focus and when cmd opened up and closed chrome went back to focus.

Robert Danielsson
  • 101
  • 2
    I think the important piece will be on the command line given to cmd.exe. Do you have anything on scheduled tasks that could be spawning this? You can probably with [Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer) (it will take a few seconds to disappear, in which you may be able to get extended status of its command line, plus, it should show its parent process, which would be very relevant here) or [ProcessMonitor](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) – Ángel Jan 15 '21 at 23:42
  • Check the Windows task scheduler. – elsadek Jan 16 '21 at 07:17
  • Turn on [process auditing and include command-line](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing#you-must-have-audit-process-creation-auditing-enabled-to-see-event-id-4688). – brynk Jan 20 '21 at 13:07

0 Answers0