Member Avatar for Stuugie

Hi All,

I have recently viewed something that I have never seen before with regards to a computer. I saw a window close and open really fast, at least 10 times upon startup. It looked like the cmd.exe window but I only saw a video of it happening and it was really quick. Anyhow, is something like this a memory leak of some sort or?.... The OS is Windows Vista.

  • 3 Contributors
  • 4 Replies
  • 390 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by hithirdwavedust

Dani AI

Generated

A few short notes that build on the thread: the rapid open/close of what looks like cmd.exe at logon typically means a script or short-lived process is being launched and exiting — it is not itself evidence of a memory leak. reported the symptom on Windows Vista, rightly observed that it can be routine, and ’s Autoruns tip is the right direction. The goal is to identify the exact invoker (which script/task/program calls cmd.exe) rather than guessing.

A practical, safe workflow to identify the caller:

  • Isolate first: boot Safe Mode or perform a Clean Boot (msconfig -> hide Microsoft services -> disable non-Microsoft services) to see whether the behavior stops. If it stops, the culprit is a third-party start item.
  • Inspect scheduled tasks and startup locations: Task Scheduler tasks triggered “At startup” or “At log on,” the user and All Users Startup folders, and the registry Run/RunOnce keys often host batch/script launches.
  • Use a process/boot inventory tool and a process-capture tool (run with elevated rights). Look for entries whose image path or action points to cmd.exe or a .bat/.cmd file and check the Publisher/Signature information. Capture process-creation events filtered for cmd.exe (Process Monitor can do this) and read its Command Line field to see the exact script or arguments.

When a script is suspected, avoid overwriting originals; point a copy at a tiny logger to prove invocation. Example logger (place safely and back up originals first):

@echo off
mkdir C:\Temp 2>nul
echo %date% %time% %username% %computername% >> C:\Temp\cmd_invocations.log
echo CMDCMDLINE=%CMDCMDLINE% >> C:\Temp\cmd_invocations.log
echo ---------- >> C:\Temp\cmd_invocations.log
exit /b 0

Additional cautions: back up registry/startup items before editing, verify digital signatures where available, and run a full AV/malware scan if the caller is unknown. If the machine is running Vista, note the OS is long out of support and poses an increased security risk.

Recommended Answers

All 4 Replies

Member Avatar for Reverend Jim

I suggest you use Sysinternals Autoruns to see exactly what is running on startup. It's a free utility that I have on all my coomputers.

Member Avatar for Stuugie

Thanks RJ, I will install that on my pc as well as the OPs and see what's what.

Member Avatar for Reverend Jim

There are a number of other free and very useful SysInternals utilities available at the same site.

Member Avatar for hithirdwavedust

Now that you've seen CMD windows flashing at startup once, you may begin to notice them more often. It is not a terribly uncommon occurrence and could be a normal part of a wide variety of software functionality.

It could also be some unwanted garbage, so it is a great idea to have some sort of utility like the Reverend mentioned to keep careful account of what is really happening at startup.

A memory leak is when a part of memory is assigned a particular task but isn't appropriately allowed to return to the resource pool when the task is done. The 'leaked' memory is no longer actually being used, but it cannot be reasigned to do anything else either.

What you're describing does not by itself imply to me any sort of memory leak.
It is certainly some barrage of autorun/startup commands and/or applications being executed.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.