Flashing “DOS Boxes”

Topic

New Reply

Hello All, and thank you ahead of time!

I have an issue where sporadically, I get an instantaneous “flash” of four or five DOS boxes. This happens regardless of whether I am active on the computer or merely reading something: a word doc. a post on the web, regardless.

I *think* that the title on the boxes says they are coming from C:\Windows\System 32, but it is visible only for an instant, usually four or five boxes in a row; each visible for only a split second.

Is there a program, etc., that I can use to “capture” the boxes in order to identify what is causing it?

I am using a Dell Inspiron I7 3000 and running Win 10 v. 2004 version 19041.746.

Thanks and Regards, Bob

Reply | Quote

Replies

Is this only on startup, or many times throughout the day?

Reply | Quote

krism,

Thank you for your reply!

No, this happens all the time. This computer is in my home office where I work all of the time.

Reply | Quote

Those are most likely Windows service host processes starting for all manner of normal situations.  Open Task Manager and scroll down to Windows processes near the bottom and you will see very many “Service Host …” processes.

They can also be the initiation of Runtime Broker for various and sundry things.  The main thing is that this is normal activity, and nothing to be concerned about.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

bbearren,

Thank you for your insight.

I understand what you are saying, but this is something different and not normal activity.

Reply | Quote

Okay, all the time… so…
1. windows defender?(which wouldn’t do that), or are you using other 3rd party for AV, firewall, malware, realtime security, or the like?

2. 3rd party software that dynamically accesses internet for updates to system like Intel, Lenovo, Dell, etc etc ?

3. UPNP active/open?

4. check Gibson research shields up for vulnerabilities you might not know about…

Reply | Quote

1. I use Norton 360 – not Defender.
2. You know, that thought crossed my mind, because the most recent change I recall making was installing a new HP printer, and when “HP Smart” (all of the printer operations, etc.) opens, it is now in the “cloud”.
3. not familiar with UPNP . . . Pls describe for me.
4. Thanks for reminding me about Gibson – I will check his web site.

Reply | Quote

HP drivers when first installed have opened a few new command prompt windows and also on first reboot sometimes. (HP does interesting software installations.)

Antivirus program may also rarely show a command prompt windows when updating themselves, it may the quickest way to update one of their many software bits.

Reply | Quote

Thank you for your reply!

I am still stumped on this. It doesn’t seem to create any adverse effects, but regularly about four or five “DOS Boxes” flash on the screen so rapidly that I cannot capture what they are from except that  they seem to originate from C:\windows\system32 . . .

Regards, Bob

Reply | Quote

You could get some insight using https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

The process monitor is capable of capturing information about all those instances of cmd.exe that start and stop quickly (flashing dos boxes) as well as showing their command lines and details of system access.

1 user thanked author for this post.

Robtl

Reply | Quote

Thank you, Eric!

That is what I am looking for!

Although I have not yet seen the pop ups since launching Process Explorer, it does show two files in \System32; PrintCtrl.exe and PrintDisp.exe have launched a number of times.

I will keep you apprised and *Thanks Again* !

Regards, Bob

Reply | Quote

You can filter the voluminous information that process monitor presents.  For example, add a filter so that it only displays information for cmd.exe –

While the filter for cmd.exe is applied you can see a summary by selecting Tools->Process Activity Summary which will display something that looks like this –

Note that the command line passed to cmd.exe is displayed.

1 user thanked author for this post.

Robtl

Reply | Quote

Eric,

Thank you again!

Setting a Filter is a great idea and a way to reduce the reading.

Regards, Bob

Reply | Quote

UPnP Univ plug and pray(play) would only be a factor if devices are being added and removed constantly – that can cause DOS popups.

I am diametrically/philosophically/spiritually opposed to Norton (I just use WD)(have for years w/o probs) – the last time I tried norton I rebooted and it booted to a picture of a bomb – you know – that round thing with a fuse. I removed it. It is a package that imho works very hard to try to convince you that you will die and the world will end without it. Like I just tried Acronis TI moments ago as a potential alternatitive to Macrium – it told me that Irfanview and Openoffice (now Apache OO) are EXTREME risks. I uninstalled Acr TI immediately.
Good luck trying to remove norton or even just disable it from your system but I would suggest at least trying for a day or a week. Do consider eliminating it entirely from your plate…

Yes, do check Gibson occasionally just to be sure.

Reply | Quote

Tasks in Task scheduler that use cmd.exe to start/restart another process at regular intervals can cause this.

Reply | Quote

Aleir,

Thank you – I will check Task Scheduler.

Regards, Bob

Reply | Quote