How can i figure out what program is quickly running during start up?

Question

When i turn on my computer for the first time then start opera, a few seconds later i will see a cmd.exe window open like something is running in it, then it will close a second later.

I think this just started happening since i updated opera from 24 to 25 (web browser) a couple weeks ago. It might have been happening before then, but the program opens and closes quickly i could have just been missing it. I beleive it get launches after opera. its hard to test because it feels like sometimes there can also be a delay of dozens of seconds before i see it.

Using my camera and having the task manager open i think i caught that the name of the program is MSCORSVW.EXE, which is related to microsoft .NET (and search results on google claim its not malicious). Though those pages often complained about it taking a lot of CPU power at start up, not that it appears and dissapears rapidly.

I'm not totally sure that is whats happening or if i "found" the right program.

is there a way i could force the command prompt to stay open to see what it says? or somehow see its history? When i see it flicker open like that it makes me feel like something malicious could be happening.

Answer 1

Get Process Explorer from Sysinternals. It can record process creation and exits during a reboot.

Use Autoruns, also from Sysinternals, to see what's going on and easily disable individual items.

Answer 2

As the other poster stated, disable Opera from starting on boot, see if it still pops up (which means it's unrelated to Opera) or if not and you start Opera and it then pops up, you'll know what it's related to. Process Explorer from sysinternals can give you the IMAGE PATH and parent window of the window that flashes open. Also check out Process Monitor from SysInternals to log the activity on the workstation while it's happening and to review after to see what was run and what was accessed.

Answer 3

You can see if it's related to Opera by disabling Opera from starting up during boot and then rebooting.

• Open the Start menu and type msconfig into the Search box.
• Click the Startup tab. You'll see a list of programs that start when your computer starts.
• To stop a program from automatically launching when you boot the PC, uncheck the box next to its entry.

If this doesn't solve the popup Window, you can disable any other apps one-by-one.

When i see it flicker open like that it makes me feel like something malicious could be happening.

This is simply because whatever script(s) it is running are either completing very quickly or erroring. I doubt it's something malicious as it would be much 'quieter' in that it wouldn't run something in CMD like that and be obvious.