How to monitor what triggers randomly starting program?

BACKGROUND INFO

Hi, so the following has happened to me: Suddenly I realize that the program on Windows 8.1 that was associated with .mp3 files randomly starts, sometimes multiple times per minute. At first I thought the app in question (think it was Xbox Music) was to blame, so uninstalled it. What happened then was that the windows chooser for "which app to associate with .mp3" started to pop up with the same randomness and also sometimes multiple times per minute.

Next step I did some virus search, using (not at the same time) Windows Defender, Avast, Avira, BitDefender. So it seemed like some cryptocoin mining software that I don't use was infected (no problem, no coins mined), so I let the virus program move all those files to quarantine. Some android root software also got marked as virus, although i suspect there were no harm in those files.

Now, virus softwares reports no error, but .mp3-program is still triggered. I didn't want to troubleshoot anymore, so decided it was time for a clean win install. This all happened while connected to my college LAN, wired connection (writing a thesis at the moment).

I stayed at home next day reinstalling windows and other stuff, seems nice and everything. When I got to college today, and connecting wired again, and in a few minutes the music player starts multiple times. Note: if the software allows multiple instances, like VLC, there will be multiple instances!

While doing the reinstall, I had quite a lot of personal files that needed to be copied back on the new win install,so that is a possible source of viruses. However, i cannot help suspect that someting on the college lan triggers this, especially since i don't remember the music player starting at home. Actually, it is now windows media player and i got the "configuration wizard" when it first started this morning at college--> first start of wmp --> did not start earlier. I naturally have internet at home.

SETUP

Windows 8.1 x64 all windows updates installed, windows defender running.

QUESTIONS

-How to monitor what triggers random starts of software associated with .mp3 files? There is never any file to be played, just the program that associates with .mp3.

-Other suggestions: virus softwares, should i contact college IT department, etc?

Schaki

Posted 2014-06-13T08:01:17.133

Reputation: 233

I will definitely check that. By the way, at the moment I'm testing to use internet through my cellphone shared wifi, nothing triggered yet. – Schaki – 2014-06-13T08:26:12.973

Well, do you have your computer locked down with the necessary permissions?? It sounds like something is accessing it and triggering this. However, I think you should contact the IT department as it only occurs on their network they may be interested to know of this (if they don't already know of it) – Dave – 2014-06-13T08:40:38.313

All settings/permissions is windows 8 default, except the UAC which is turned off. I'm not positive the following is the cause, but just recently using Kiwi application montior (--> Tools --> Windows startup processes -> local machine) i found a process in the list of other stuff(like adobe updater etc) with absolutely no info. It was an entry in the list, but completely empty. It was possible to remove, it remains to be seen if it was the cause. The process could not be seen in the task manager autostart tab. – Schaki – 2014-06-13T12:28:07.237

Process without name wasn't the cause, still get random starts. – Schaki – 2014-06-13T12:34:40.977

Answers

Run MSCONFIG (windows key + R) Select Selective startup Load system services Load startup items

Then go to Services (the tab) (You should hide all microsoft services) Check for any suspicious programs (Uncheck them if you find one, and uninstall it if you can)

Then go to startup (the tab) and do the same (The disabling and uninstalling if you find something fishy)

Exit msconfig properly (Apply the changes and ok) (I think that's the prompt)

Reboot your computer and see if the problem still persists

If it does, install antimalwarebytes and do a full scan. Reboot and see if the problem still persists

If it does, install panda cloud cleaner (the cloud scanner, not the antivirus) and do a full scan Reboot and see if the problem still persists.

If the problem still persists at this point, you probably have a nonvirus program doing the evil, so you'll have to play around with msconfig to figure out which innocent looking child it is.

user3407161

Posted 2014-06-13T08:01:17.133

Reputation: 89

OP stated it is a fresh install – Dave – 2014-06-13T19:33:16.193

I think that my original issue is gone now, not dead sure but hasn't been any symptons on same network. What I did was basically just a complete virus search of all drives from a bootable usb. I used AVG, because it was the first one i got to work. Among others i tried BitDefender, Kaspersky and they were all cumbersome to use. I mean seriously, the kaspersky image booted but then got kernel panic before loading was complete (on three separate usb drives). Someone is not doing what they're payed for. Why CD-image and not usb is still default for most companies is also a mystery. – Schaki – 2014-06-16T12:31:15.310

Anyway, antivirus software inperfections apart, my question still remains. How do i see what started a certain process? It is a relevant question also for non malicous software, e.g. was Something.exe triggered by user action or remotely by admin? – Schaki – 2014-06-16T12:34:08.037

I had the same problem. In my case there weren't any software issue. I used a multimedia keyboard, and there was a button on it, which activated the media player. I thought maybe it was stuck. I pushed it some times, and since that the problem doesn't exist!

Imre

Posted 2014-06-13T08:01:17.133

Reputation: 1