Look at the following events to find one whose Creator Process ID is the same as the conhost's New Process ID. Its Creator Process Name value will tell you how it was launched. There should be a "C:\Windows\System32\conhost.exe" process, which is the Command Prompt window that you see.
You're interested in the Process Information bit, specifically the New Process ID, New Process Name, Creator Process ID and Creator Process Name. You'll probably see a few events look at the General tab in the details. You should see a number of events you're interested in the ones with Task Category "Process Creation" with Event ID 4688, at about the time that you recorded. The next time the window appears briefly, record the system time (not the time on the clock on the wall), run Event Viewer (in "Control Panel"->"Administrative Tools") as Administrator (see above) and expand "Windows Logs" to select "Security". Tick "Configure the following audit events:", and "Success", then click on to save the setting. Select "Detailed Tracking", and on the right-hand side, double-click on "Audit Process Creation" to bring up the properties dialog. To do this, run Local Security Policy editor (in "Control Panel"->"Administrative Tools") as Administrator (right-click on its icon and select "Run as Administrator"), and expand the left-hand tree "Advanced Audit Policy Configuration"->"System Audit Policies"->"Detailed Tracking".
If your version of Windows allows you to run Local Security Policy or Local Group Policy editor, you can enable advanced audit logging of process start and stop in the system, and the next time it occurs, look in the Security event log to see what process was launched.
0 kommentar(er)
