TR Forums

I recently noticed a very brief command window open and close when Windows starts. When I looked up my Startup programs, I saw this "Program" (highlighted; previously enabled):



Unlike every other program listed, when I right click on "Program," Open File Location and Properties are greyed out.

How can I find this Program on my PC?

Have you modified or removed any programs recently? It may be a placeholder for a program that previously loaded at startup and was recently disabled or uninstalled, but wasn't fully purged from the registry.

Actually, I had just finished a remote support session with my antivirus provider because their Chrome extension isn't working. He had me install a report gathering tool. However, it said it would uninstall itself when it was done. I have checked my most recently installed programs and there's nothing new listed.

How can I find it in the registry?

[Edit] Also, the command window stopped appearing when I disabled Program, so I don't think it's just a placeholder.

Have you tried the Autoruns Sysinternals utility? It's from Microsoft itself.

It shows you the command line being run, and allows you to jump to its location in the registry by double-clicking it.

While you're at it, snag the entire Sysinternals Suite, it contains a bunch of useful tools.

It could be launching a command window which in turn tries to launch something that has been uninstalled. That would explain why it pops up and disappears immediately.

But yeah, I agree you want to get rid of it, because there's no way to know for sure that it is harmless until you've figured out what it is doing.

arunphilip wrote:

Have you tried the Autoruns Sysinternals utility? It's from Microsoft itself.

It shows you the command line being run, and allows you to jump to its location in the registry by double-clicking it.

While you're at it, snag the entire Sysinternals Suite, it contains a bunch of useful tools.

That would be my first stop.
I suspect it was an app that was in your startup and has since been removed.

Right click any of the tabs in that window and choose "Command Line," and it will show you the path.

arunphilip wrote:

Have you tried the Autoruns Sysinternals utility?

That was immensely helpful! I was able to identify "Program" and remove it from the registry. (It was a leftover "helper" program for a video editor I tried and then uninstalled.)

Pagey wrote:

Right click any of the tabs in that window and choose "Command Line," and it will show you the path.

Which "that window" are you referring to? The disappearing command line window? The Startup programs window? The Sysinternals Autoruns window?

Sorry. When you have Task Manager open and are on the Startup tab, you can right click on any of the tabs (e.g., Name., Publisher, etc.) and it will open a menu. Click on Command Line, then.

does msconfig.exe still exist for Win10? I am at work so cannot check easy.
it was/is a great part of Windows for checking startup.

Arvald wrote:

does msconfig.exe still exist for Win10? I am at work so cannot check easy.
it was/is a great part of Windows for checking startup.

It does, but it only shows a subset of what Autoruns does.

bthylafh wrote:

Arvald wrote:

does msconfig.exe still exist for Win10? I am at work so cannot check easy.
it was/is a great part of Windows for checking startup.

It does, but it only shows a subset of what Autoruns does.

I don't doubt it. I was using sysinternals before M$ bought them.

I believe you could right click the entry and select "Open file location". That will open up explorer and select that particular file... probably you can investigate from there. If it doesn't exist, it could be a rogue entry (meaning a deleted program, but the registry key is still there) - Autoruns will help you identify something weird like that.

As for the window that opens and closes and has a look of a Command Prompt... There are many reports of the "UsoClient.exe" executable that's causing this behavior on some Windows installations (including my own). I've investigated about the subject and it seems that this may be expected (annoying though).