Identifying Console Window Popups by Monitoring Process Starts

I recently noticed a console window pop up for a fraction of a second on my desktop. About an hour later, it happened again. Random windows appearing out of nowhere is not something I like to see on my machines. Read on to learn how I investigated the issue.

Monitoring Process Starts

Obviously, something was starting processes on my machine at a certain schedule. I wanted to find out what that was.

uberAgent, our user experience and application performance monitoring product, detects any process start on a monitored endpoint. Process starts are recorded with the exact timestamp, process name, PID and the name of the parent process.

Detecting Console Process Starts

Identifying starts of console processes is easy if you have uberAgent. For every console process there is a console host child process called conhost.exe. All we need to do is look for conhost.exe processes and then list the names of the parent process. The following Splunk search does just that:

index=uberagent sourcetype=uberAgent:Process:ProcessStartup host=hkx1c ProcName=conhost.exe ProcParentName=* | table _time ProcParentName

Above search looks for process start events on my machine where the process name is conhost.exe. For every matching process start it lists the time the process was started and the name of the parent process. Please note that uberAgent’s configuration setting EnableExtendedInfo needs to be enabled in order for this to work. A listing of all sourcetypes and field names collected by uberAgent can be found here.

Finding the Console Process

When that offending console window popped up the next time I took note of the time and then ran the search from above. The result looked like this:

The console process started at around the time I noticed the window pop up was officebackgroundtaskhandler.exe. A while later I repeated the process, and again officebackgroundtaskhandler.exe turned up. So what’s the matter with this process apparently belonging to the Microsoft Office suite?

Why is officebackgroundtaskhandler.exe Flashing Console Windows?

A quick search for officebackgroundtaskhandler.exe led me to this Microsoft Answers post. Apparently the flashing console window is a know bug that will be fixed in a future update.

Phew, looks like this one is harmless and going to go away on its own. Unfortunately, that is not always the case. Make sure you understand the processes running on your machines. uberAgent can help with that.

Leave a Reply

Your email address will not be published. Required fields are marked *