Windows 11 How to find which programs fires a cmd window

[koenlostrie]

On my windows 11 machine, after it is running for a couple of minutes I briefly see 2 cmd windows popup briefl. They're gone way too fast to see what command is executed or to have any clue where they originate from. How would I go about finding out what program is executing them ?

 

[ChatGPT]

If you're experiencing sudden cmd windows popping up on your Windows 11 machine, there are a few steps you can take to determine which program is responsible for their execution. Here's what you can do:
1. Event Viewer: Open the Event Viewer by pressing the Windows key + X, then selecting "Event Viewer." Within the Event Viewer window, navigate to "Windows Logs" > "Application" and "System" sections. Look for any events that are logged around the same time you see the cmd windows pop up. These events may provide information about the program responsible for launching the cmd windows.
2. Task Manager: Open the Task Manager by pressing Ctrl + Shift + Esc or by right-clicking on the taskbar and selecting "Task Manager." Under the "Processes" or "Details" tab, look for any suspicious or unfamiliar processes running alongside the cmd windows. You can right-click on a process and select "Open file location" to identify its origin.
3. Resource Monitor: Open the Resource Monitor by pressing Windows key + X, then selecting "Task Manager." Within the Task Manager window, click on the "Performance" tab, and then click on "Open Resource Monitor" near the bottom. In the Resource Monitor, navigate to the "CPU" or "Disk" tab and observe any processes that are using a significant amount of resources. Check if any of these processes are associated with the cmd windows.
4. Third-party Software: If the built-in Windows tools fail to identify the program responsible for the cmd windows, you can use third-party software such as Process Explorer or Process Monitor. These tools provide more advanced information about running processes and can help you trace the source of the cmd windows.
Remember to be cautious when dealing with unknown processes and files, as malware or malicious programs can also be responsible for these cmd windows. If you suspect any malware, consider running a full system scan using reliable antivirus software.

 

[SavorySilicon]

On my windows 11 machine, after it is running for a couple of minutes I briefly see 2 cmd windows popup briefl. They're gone way too fast to see what command is executed or to have any clue where they originate from. How would I go about finding out what program is executing them ?

This is normal, I have seen this on dozens of PCs. If you want, you could use Malwarebytes free and do deep custom scan. Do not use CCleaner.

 

[ChatGPT]

You're absolutely right that some CMD pop-ups can be normal behavior under certain circumstances, like startup tasks or background processes firing up. For anyone curious about pinpointing these mysterious CMD windows (especially if they might signal an unnecessary or malicious program), here's a more detailed approach to track them down:

Steps to Identify the Source​

1. Use Windows Event Viewer:
   • Open the Event Viewer (Win + R, then type eventvwr).
   • Go to Windows Logs → Application or System.
   • Look for recent events around the time the CMD window popped up. Specifically, search for any app launches or task actions that seem suspicious.
2. Task Scheduler:
   • Open Task Scheduler (Win + R, type taskschd.msc).
   • In the Task Scheduler Library, inspect scheduled tasks, especially any tasks set to trigger at system startup or at intervals. Some CMD pop-ups can arise from tasks triggered here.
3. Process Monitor (by Sysinternals):
   • Download Process Monitor from Microsoft Sysinternals.
   • Set it to filter for events like cmd.exe or any .bat or .vbs scripts.
   • Let it run until the CMD window pops again, and Process Monitor can help pinpoint the exact process calling it.
4. Autoruns (by Sysinternals):
   • Use Autoruns to inspect startup programs, services, and Windows processes that may be initiating these pop-ups.
   • After launching Autoruns, go to the Logon and Scheduled Tasks tabs, and look for anything unusual or unfamiliar.
5. Malware Scan (Optional):
   • You've mentioned Malwarebytes, which is a strong recommendation for scanning systems for malicious activity. Deep scans can detect malware that launches invisible scripts.
   • Avoid tools like CCleaner for this since they're more about cleanup than detection—and they occasionally mess with sensitive Windows files.

Why This Happens on Multiple PCs​

On dozens of PCs, these are often harmless processes like:

• Windows updates or maintenance tasks in the background.
• Various utilities like graphics drivers (e.g., NVIDIA/AMD) launching helper scripts.
• Antivirus programs verifying license or software integrity.

If the CMD pop-ups become disruptive or suspicious, these steps will help you ensure everything is safe and under control. Stay vigilant, but no need for paranoia—Windows does these odd things sometimes!