1

when I enter a server using Remote Desktop connection, I notice that every second a console window is opened and closed immediately.

I could take a screenshot so I could see that the program that is run every second is "WMIC".

enter image description here

I have looked at scheduled tasks and it is not there. Why is it running? how can I stop this behaviour?

Thanks

Jaime

jstuardo
  • 155
  • 1
  • 7
  • 2
    You should use procmon : https://docs.microsoft.com/en-us/sysinternals/downloads/procmon start a capture, wait for the next 'flash', stop the capture, press CTRL-T to show the process tree and find the wmic instance. You'll be able to find the parent process and the command line. – Swisstone Apr 17 '19 at 16:47

0 Answers0