Technology

Hi there! Information security guy here. This is essentially a super quick Incident Response run-through of the basic tools I use for malicious process discovery on Windows hosts. I'm assuming this is your own personal machine, or you have permission to do this.

1. Grab the Sysinternals suite's installer here and install:

• TCPView
• Process Explorer
• Process Monitor
• Autoruns

They are all included in the rollup installer, or you can grab them individually at those links. Don't install everything, or at least don't leave it all installed when you're done. It includes a lot of tools for debugging, which you don't want to leave lying around on your system.

2. Fire up Autoruns, and check under Logon and Scheduled Tasks tabs for any unusual entries. If you don't know what something is, and the Publisher is listed as Microsoft, don't mess with it. Any non-MS stuff in those 2 areas should be safe to disable without hurting your system.

3. Process Explorer gives you a live view of the processes running on your system, basically a more advanced version of Task Manager. You can scroll through it for unusual processes, and you can even check stuff like rundll.exe processes to see the arguments used to launch it, which is SUPER useful.

4. Process Monitor is essentially a history/ log view of all processes on your system, starting from when the program is run. Think wireshark, but for processes. You can filter out known-good processes. You can search for strings. If the process is launching, executing, and terminating too quickly to catch in Task Manager or Process Explorer, it will still show up in Process Monitor.

5. TCPView is sort of like netstat, but with lots more info. You can use that to watch for unknown network connections, in case the thing you're seeing is performing some kind of network beaconing.

6. Lastly, I would personally check for 3rd party driver software like printer software, Razer or other HID controllers, sound card software, etc. I've seen third party hardware controller software do weird stuff like this, because most of it is so badly written. I'd almost be more surprised if it turns out to be malware, than if it turns out some HP Printer software is doing an ink check every 10 minutes or something.

You might also want to check if there's anything set to periodically do something in Task Scheduler, search for it in windows start menu

Guys, thank you so much for all the great ideas. Given that everyone made a big effort to help me, I'm a bit embarrassed to report that it looks like it went away? I tried rebooting before and that didn't help. I rebooted a second time for an unrelated reason and that "fixed" it. I have no idea why. I feel like an idiot now. I will report if it comes back, but, for now, I think that was solved.

Thanks!

Most likely an app updater written by someone who is too lazy to make their updater hidden.

As others suggested, look in task scheduler, but make sure you run it elevated. Focus on any updater that's calling an app from a bat file, and move out from there.

First place I'd look.

Run MSConfig and see what's running on startup.

Turn off any services you don't want and any programs you don't need. I suggest hiding Microsoft services unless you're confident, it's easy to break something and they're unlikely to be causing that.

I had a similar issue and in my case it ended up being some AMD crap (I think an updater or something) that probably didn't install properly or something.

IIRC I just ended up disabling the scheduled task that was running it and that was the end of it.

You could try recording your screen with screencasting software, to see if there’s some text in the terminal window to provide clues.

how long has it been happening? have you installed any new sw that might be causing it? it could be some licence check for some program or even a failed windows update but just to be sure you don't have something malicious running there, i would do a reinstall just to get peace of mind. it'll probably be faster than trying to troubleshoot.

I'm confused by the it in your last sentence.

Using a screen recorder (there's a built in one in the Xbox games app depending on version of Microsoft, or if not, people always seem to use FRAPS) to capture whatever is in the window to get more information could help.

Someone else will likely be along shortly with more helpful info.

I'd second the one about work laptops having powershell scripts for whatever the IT wants them for. However if it's your personal property then it could be just about anything, maybe something innocuous you've installed that you wnat but maybe something malicious..

Personally, I'd take this as a sign to do a fresh install of the entire OS. That can feel like a chore, sometimes, but it's the best way to be nearly absolutely sure your computer is clean.