Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Popup that instantly disappears


  • Please log in to reply
1 reply to this topic

#1 xr280xr

xr280xr

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:34 PM

Posted 14 June 2017 - 10:26 AM

I am seeing a window briefly appear and immediately disappear before I can see any details about it. It happens very infrequently, maybe around every 4 hours but I can't confirm it's on a regular interval. It does seem to be a white background and not a console window, but it's so fast, I can't even be sure of that. I've seen it happen with Chrome or Firefox open so it's not specific to one browser if it's browser-related at all. I'm using Windows 10 Pro x64. 

 

My laptop is only a few months old and I haven't done much that should've been very risky. The riskiest things I can think of are:

  • I've visited a couple websites that were very pop-up ad-heavy. I always just closed the browser window without interacting with the content. I use Chrome which is currently updating from v58.0.3029.110.
  • I've been getting a lot of spam in Outlook 2010. When I click a message to delete it, it automatically opens it in the reading pane. Any images are automatically blocked. I haven't opened any attachments if there have been any.
  • I've downloaded a few Visual Studio 2013 extensions listed in the VS Gallery. A couple of those I did have to visit the developers' websites to download and then run an installer myself.
  • Downloaded and opened a visual studio project from here: https://github.com/mehdime/DbContextScope.
  • Installed FreeConferenceCall.com windows app and Chrome plugin.
  • Downloaded and run ILSpy from github.
  • Installed KeePass from https://superb-dca2.dl.sourceforge.net/project/keepass.
  • Installed Paint.NET with a few user created plugins that I had been using for a long time on Windows 7.
  • Installed Share.IT from the Windows store (for transferring files with iphone)

And maybe a few other things along these lines. The Paint.NET plugins are probably the biggest risk, though I would be surprised if they were dirty.

 

I tried my old go-to from a decade ago, Spybot Search & Destroy, but it failed to install its virus definitions so I uninstalled it. That made me more suspicious of malware. I've also noticed Chrome will lock up after I delete a range of browser history. For instance if I search google.com and delete all results. I assumed it was a Chrome bug, but now am wondering if that's malware too. Windows defender has real-time protection on and didn't find anything in a quick scan. Any tips for a way to identify this popup window or a good scan to run?


Edited by xr280xr, 14 June 2017 - 04:25 PM.


BC AdBot (Login to Remove)

 


#2 xr280xr

xr280xr
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:34 PM

Posted 15 June 2017 - 02:30 PM

I think I've figured it out. I started a screen recorder on a continuous 2 minute loop and finally caught it and froze on the frame where it appeared. It was a console window running C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe. It's kicked off every hour by OfficeBackgroundTaskHandlerRegistration in Task Scheduler. Apparently this is a known issue since mid April. The description of the task is, "This task initiates Office Background Task Handler, which updates relevant Office data." Since that's all they've got to say about it, I've disabled the task.

 

 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users