{"id":1646,"date":"2016-02-16T18:25:32","date_gmt":"2016-02-16T12:55:32","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=1646"},"modified":"2025-02-26T10:31:12","modified_gmt":"2025-02-26T05:01:12","slug":"find-unknown-program-open-and-close-immediately","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/find-unknown-program-open-and-close-immediately\/","title":{"rendered":"Command Prompt Flashes and Closes Quickly at Startup or Random Intervals"},"content":{"rendered":"

If the Command Prompt, PowerShell, or an unknown program window flashes during logon or at random intervals without you doing anything, there are many chances that it’s a Task Scheduler job<\/a>. The windows popping up frequently can be a huge distraction when you’re working or playing a game on the computer.<\/p>\n

Sometimes, 2 or 3 CMD windows may open and close quickly (like 2-3 seconds) during Windows startup. You’ll need to know which program ran just to make sure that it’s not malware.<\/p>\n

\"Command<\/p>\n

By the time you open Task Manager and check the Processes or Details tab, the Command Prompt process or the unknown program will have already finished running<\/a>. The Command Prompt or the PowerShell window may close so quickly that you may not even have the time to see what it is running or even to take a screenshot<\/a> using PrintScreen.<\/p>\n

This post tells you the possible reasons why the Command Prompt or the PowerShell window pops up randomly and how to find the exact name of the unknown task that last ran.<\/p>\n

Cause<\/h2>\n

If a Command Prompt window opens up and closes quickly, it could be due to automatic maintenance task(s) kicking in. This is especially if the Command Prompt window flashes when the system is left idle for a few minutes. You can view the list of automatic maintenance tasks<\/a> using PowerShell.<\/p>\n

If that’s not the case, then it could be a non-maintenance Scheduled Task — e.g., Office 365 Updater, Norton 360 Task, Driver updater task, etc., configured to run at specific intervals. Also, there may be tasks that are configured to run only on AC Power. Some tasks may trigger when you connect the power adapter\/charger.<\/p>\n

Find exactly why the CMD or PowerShell window popped up!<\/h2>\n

What if you don’t use Office 365 or Driver Updater? If the list of tasks mentioned in the “Cause” section doesn’t apply, here are the tracking methods you can follow to narrow down the program or task being triggered.<\/p>\n

The built-in Task Scheduler lists the Last Run Time and all other details about the tasks. However, manually checking each task folder is time-consuming.<\/p>\n

To track scheduled tasks, you may use PowerShell, the built-in Task Scheduler console tool SchTasks.exe<\/code>, or the 3rd party TaskSchedulerView utility.\u00a0Here is how to determine if the Command Prompt window that last flashed on the screen was launched as a Task Scheduler job.<\/p>\n

Method 1: Using PowerShell<\/h3>\n

Launch PowerShell as administrator, and run the following command-line:<\/p>\n

Get-ScheduledTask | Get-ScheduledTaskInfo | select TaskName, TaskPath, LastRunTime | out-gridview<\/pre>\n
This shows the list of scheduled tasks, the corresponding “last run time” data, and the branch (Task Scheduler).<\/p>\n
Sort the results by LastRunTime<\/code> (descending) to know the list of tasks that ran most recently.<\/p>\n
\"scheduled<\/p>\n
Or, to get it sorted (descending) by LastRunTime automatically, run this command:<\/p>\n
Get-ScheduledTask |  Get-ScheduledTaskInfo | Select TaskName, TaskPath, LastRunTime | Sort LastRunTime -Descending | out-gridview<\/pre>\n
Or if you want to see the program name and arguments executed by each task, use the following PowerShell snippet.<\/p>\n
\n
List scheduled tasks with Program name, arguments, and Last Run Time<\/h4>\n
To get the executable file name and the arguments field for each scheduled task, sorted by LastRunTime, copy the following snippet and paste it into the PowerShell window and press Enter.<\/p>\n
\r\n$tasks = @()\r\nforeach ( $task in (Get-ScheduledTask)) { \r\n    $taskinfo = Get-ScheduledTaskInfo $task\r\n    $tasks += [PSCustomObject]@{\r\n        URI = $task.URI\r\n        Program = $task.Actions.Execute\r\n        Arguments = $task.Actions.Arguments\r\n        LastRunTime = $taskinfo.LastRunTime\r\n    }\r\n}\r\n$tasks | Select URI, LastRunTime, Program, Arguments | Sort LastRunTime -Descending | OGV\r\n<\/pre>\n
The output looks like below. Open the link in a new window to see the maximized image.<\/p>\n
\"scheduled<\/p>\n<\/div>\n
Now, you can easily narrow down the task that ran recently by matching the above timestamp with the approximate time you saw the CMD or PowerShell window popping up. From the narrowed-down results, it’s very easy to find the task that initiated the Command Prompt or a console program that, inturn, started the command shell.<\/p>\n
Method 2: Using TaskSchedulerView Utility<\/h3>\n
TaskSchedulerView<\/a> from NirSoft shows you all the information about Tasks. This tool displays the list of all tasks from the Task Scheduler and lets you disable or enable multiple tasks at once. For every task listed, the following information is displayed:<\/p>\n