News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • Two command prompt windows appear when logging in

    Posted on crimsoncricket Comment on the AskWoody Lounge

    Home Forums AskWoody support Windows Windows 10 Windows 10 version 1903 – May 2019 Update Two command prompt windows appear when logging in

    Viewing 6 reply threads
    • Author
      Posts
      • #2295673 Reply
        crimsoncricket
        AskWoody Lounger

        Windows 10 Pro (1903. Build 18362.239) x64 HP

        Two command prompt windows briefly appeared and disappeared on my desktop immediately after I logged in today.  I opened Task Manager to look at the startup programs and don’t see anything that obviously shouldn’t be there.  What should I do?

      • #2295675 Reply
        PKCano
        Da Boss

        Those Command Prompt windows were probably running scripts in the background. Have you recently installed a program, run updates? Has Defender or your A/V program recently updated? Thoes could be the normal results of operations completing after reboot/startup.

        1 user thanked author for this post.
        • #2295822 Reply
          crimsoncricket
          AskWoody Lounger

          It wouldn’t surprise me if Windows Defender updated its definitions recently.  I installed and ran the newest version of SuperAntispyware a few days ago.  KB4565351 was installed on August 30th.

      • #2295756 Reply
        Rick Corbett
        AskWoody_MVP

        One of them is probably the GatherNetworkInfo script (C:\Windows\System32\gathernetworkinfo.vbs), triggered as a scheduled task at every ‘logon’. The other is almost certainly one of the many other scheduled tasks that have ‘logon’ as a trigger.

        As scheduled tasks, they do not appear as startup items in Task Manager.

        Perhaps the easiest way of checking is to download and unzip Nir Sofer’s small, free and portable TaskSchedulerView (making sure to download the ‘bitness’ version that matches the ‘bitness’ of your OS… most likely 64-bit).

        Once unzipped, do this:

        1. *Right*-click on TaskSchedulerView.exe and choose Run as administrator then accept the UAC (User Account Control) prompt that appears by clicking on the Yes button.

        2. When TaskSchedulerView opens, click on the Last Run column header (a) once or twice to sort the entries so the latest run tasks appear at the top of the list.

        3. Scroll across to the Run On Logon column (b). Tasks which are triggered at ‘logon’ are the most likely cause of the 2 command prompt windows which briefly appear, even though the Hidden column (c) shows there should be no user interface.

        scheduled_tasks_run_at_logon

        For more info you can *right*-click on entries and choose Properties (or use ALT+Enter).

        Hope this helps…

        Attachments:
        3 users thanked author for this post.
        • #2295818 Reply
          crimsoncricket
          AskWoody Lounger

          Thanks for the advice.  It looks like the only “Run on Logon” entry that was last run yesterday is something called “Logon” that was published by Microsoft.  The issue didn’t happen again when I logged in today.  I did save a log if you’d like to go over it.

          Similarly, I ran Autoruns and Process Monitor after the original issue happened and can share the logs if need be.  I’m looking at the Autoruns one right now and “Gather Network Info” is highlighted in red

      • #2295831 Reply
        Rick Corbett
        AskWoody_MVP

        Thanks for the advice.  It looks like the only “Run on Logon” entry that was last run yesterday is something called “Logon” that was published by Microsoft.  The issue didn’t happen again when I logged in today.  I did save a log if you’d like to go over it.

        Similarly, I ran Autoruns and Process Monitor after the original issue happened and can share the logs if need be.  I’m looking at the Autoruns one right now and “Gather Network Info” is highlighted in red

        Autoruns is excellent but I prefer TaskSchedulerView‘s handling of ‘Properties’ for each entry.

        (Autoruns entries in red just mean that ‘Description’ and/or ‘Publisher’ info is not available.)

        If you are not seeing the command prompt windows now then I doubt that any logs would shed any light. However, if you remain concerned or if the issue happens again then attach the logs by all means.

        Hope this helps…

      • #2296085 Reply
        crimsoncricket
        AskWoody Lounger

        Thanks for the advice.  It looks like the only “Run on Logon” entry that was last run yesterday is something called “Logon” that was published by Microsoft.  The issue didn’t happen again when I logged in today.  I did save a log if you’d like to go over it.

        Similarly, I ran Autoruns and Process Monitor after the original issue happened and can share the logs if need be.  I’m looking at the Autoruns one right now and “Gather Network Info” is highlighted in red

        Autoruns is excellent but I prefer TaskSchedulerView‘s handling of ‘Properties’ for each entry.

        (Autoruns entries in red just mean that ‘Description’ and/or ‘Publisher’ info is not available.)

        If you are not seeing the command prompt windows now then I doubt that any logs would shed any light. However, if you remain concerned or if the issue happens again then attach the logs by all means.

        Hope this helps…

        I’m not seeing any more command prompt windows, but figured I might as well play it safe.  Please let me know what you think of the logs.

        Attachments:
      • #2296191 Reply
        Rick Corbett
        AskWoody_MVP

        I’m not seeing any more command prompt windows, but figured I might as well play it safe. Please let me know what you think of the logs.

        Unfortunately the TaskSchedulerView.zip file only contains its config file. Please re-run TaskSchedulerView (as administrator) then press SHIFT+CTRL+S together. Important: In the Save dialogue that appears, please change the Save as type dropdown to Comma Delimited Text File (*.csv) before saving to a file, zipping and attaching. Not only is the resulting .CSV file very much smaller than the corresponding .TXT file but, more importantly, it will let me sort by columns.

        Whilst AutoRuns is an excellent utility to show *what* runs, unfortunately it doesn’t provide sufficient information about *when*. As a result the Scheduled Tasks tab isn’t helpful… because it doesn’t show the necessary Last Run info. The only time/date info is a Timestamp column which is almost farcical in the results shown. For example:

        autoruns_timestamp

        However, what is does show is that your device appears to have been upgraded from Windows 7 to Windows 10 and that a number of no longer needed Media Center tasks are still active, even though the files are now missing.

        autoruns_no_longer_needed

        I doubt that any of these failed tasks are responsible for the flashing command prompt windows but you can always disable these tasks (by removing the tick in the first checkmark column) or just delete them.

        You DO have the GatherNetworkInfo task enabled but I suspect the two flashing command prompt windows were caused by the 2 commandline-driven Office 16 Feature Update tasks:

        autoruns_office_16

        In TaskSchedulerView see if the Last Run coincides with when you saw the two command prompt windows briefly appear.

        Hope this helps…

        Attachments:
        • #2296595 Reply
          crimsoncricket
          AskWoody Lounger

          You’re correct, I did upgrade from Windows 7 to Windows 10.  I also think you’re onto something about those Office feature updates.  Here’s the proper log.

          Attachments:
      • #2296610 Reply
        Rick Corbett
        AskWoody_MVP

        You’re correct, I did upgrade from Windows 7 to Windows 10.  I also think you’re onto something about those Office feature updates.  Here’s the proper log.

        Your original post was Sept 11th… but there’s no entries in the TaskSchedulerView log for *any* tasks on that day, let alone any ‘logon’ tasks.

        If either of the command prompt windows were due to background MS Office updates then it looks like one may be ‘Work Folders Synchronisation’ and another may be ‘Office Feature Updates’ – both recurring ‘logon’ events.

        Do you use Cyberlink’s ‘Virtual Drives’ app? It’s set to run every ‘logon’?

        Similarly, do you actually use CyberLink’s ‘MediaLibrary Service’ (also triggered by ‘logon’)… or was CyberLink software just bundled by HP with your PC?

        Is your PC still within warranty? ‘Cos it looks like it’s going to be checking with HP today/tomorrow. (Sorry, I’m in the UK  and have no idea where you are so this is vague.)

        Then, of course, you have your ‘Adobe Acrobat’ software doing an update check every ‘logon’.

        (Is your PC sluggish just after logon but then speeds up after ~5-10 minutes?)

        Hope this helps…

        1 user thanked author for this post.
        • #2296640 Reply
          crimsoncricket
          AskWoody Lounger

          Thanks for checking the log, this was all very helpful!  I checked against a quick screenshot I made on the 11th and it showed that the three things (SpeechModelDownload, MP Scheduled Scan, and Logon) that ran that day were scheduled to run again on the 13th, so that’s probably why the new log doesn’t mention anything from the 11th.  Logon appears to be linked to ProvTool.exe while the others are linked to Cortana and Windows Defender.  So no matter what caused the command prompts to appear, it looks like it’s nothing to worry about.

          All that CyberLink stuff came preinstalled on my computer.  I’ll have to look into my warranty and the other stuff you mentioned.  Thanks again for all of your help!

    Viewing 6 reply threads

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Two command prompt windows appear when logging in

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.