Question Random process window on startup: "npm install winreg" ?

[sonmate]

Everytime i login after startup or switch account, a process window with "npm install winreg" randomly appears for few seconds. Anyone can help me to find out what that is?

 

[Ralston18]

Strange.

I found the following links:

https://medium.com/adroit-group/accessing-windows-registry-in-electron-or-node-js-2bf5de82f4fe

https://www.supportyourtech.com/tec...indows-11-a-step-by-step-guide-for-beginners/

https://www.geeksforgeeks.org/npm-install-command/

And other similar links as well.

Did not find any such references on my system....

Windows 11 - Source? Edition and version information?

Likely that the install is being launched or attempted via Task Manager > Startup or perhaps being triggered via Task Scheduler.

If possible take a screenshot of the pop-up Window and post the screenshot here via imgur (www.imgur.com)

Failing that look in Task Manager > Startup and Task Scheduler and take screenshots showing anything "npm".

More needs to be known.

 

[sonmate]

The links didn't help me, I know what npm does but it doesn't make sense to see it running every time I login. I tried to look in Task Manager and Task Scheduler but didn't find anything.

Windows 11 - Source? Edition and version information?

Pro - Version 10.0.22631 Build 22631

 

[Ralston18]

Look in Task Manager > Services.

Is it listed there?

If so right click the corresponding entry in the Status column.

What is the status and what other options are available?

Note: You can sort the Name column by clicking the column header.

 

[sonmate]

Unfortunately it's not there, and I don't even know what to look for exactly, since npm is just a cli command and not a service

 

[Ralston18]

Okay.

Try a different way to find it: Powershell.

And the Get-Process cmdlet as admin.

FYI:

https://powershellfaqs.com/powershell-get-process/

Start with the basic cmdlet.

Likely a lengthy list. Look in ProcessName

Keep in mind that that "npm install winreg" may be being attempted by some other process.

FYI:

https://www.npmjs.com/package/winreg

https://www.squash.io/how-to-set-npm-registry-configuration/

So look for any processes Registry related.

The purpose of the links is to just provide you with some additional insight.

The objective is to make that pop-up/process window go away.

To do that we need to discover what is opening the window to begin with and the links may help you recognize some other relevant factor.

 

[sonmate]

I tried to do it, but the window disappears so fast that the process is not there anymore when I launch the command.

 

[Ralston18]

Download Process Explorer (Microsoft, free).

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Run and look for any references/listings regarding "npm install winreg" etc..

Premise being that there has to be something running to cause/create the pop-up window.

Another way is to examine the Description, Company Name, and Verified Signer fields. Any that are blank would warrant further investigation.

= = = =

Open Task Manager > Startup.

Take a full screenshot(s) and post the screenshot(s) here via imgur (www.imgur.com).

 

[sonmate]

Open Task Manager > Startup.

Take a full screenshot(s) and post the screenshot(s) here via imgur (www.imgur.com).

https://imgur.com/a/1NXYLtI

View: https://imgur.com/a/1NXYLtI

Another way is to examine the Description, Company Name, and Verified Signer fields. Any that are blank would warrant further investigation.

Didn't find anything about the winreg command, but I found this Nvidia process running Node (i don't think it's related to the concern though)

https://imgur.com/a/7Jf37IV

View: https://imgur.com/a/7Jf37IV

 

[Ralston18]

The Nvidia process appears legitmate. I found a number of links describing what the process is and what it does. You can easily go to Nvidia's website or other sites as well to learn more.

What is more interesting are those enabled Startup Apps.

For example "Hotkey for Dev Diagnostics": that is the sort of startup app that I would consider as a potential culprit. Especially if you do not knowingly use the app. [It does not appear on my computer.]

The startup app may have some purpose. Hopefully an app that you recognize and use.

Fair enough but it could also be buggy or corrupt.

What to do - simply disable the app from Startup. Make no other changes and keep track of any settings that may be involved.

Determine 1) Does the pop-up window stop appearing, and 2) does anything else go wrong or stop happening?

If that does not work then disable some other startup app that you do not need or recognize. Go online and look for more information just in case the startup app is part of something else you run.

Even if the startup app is necessary - again it could be buggy or corrupt.

Working through the list will take some time and effort. You must be slow and methodical.

Ideally you will discover some startup app that when Enabled = Pop-up Window and Disabled = No Pop-up Window".

As always, ensure that all important system data is backed up at least 2 x to locations away from the computer in question. Verify that the backups are recoverable and readable.

= = = =

Try running the Get-Process cmdlet again.

Open Powershell as Admin and type "Get-Process" (without quotes) at the PS> prompt.

There should be a long list of processes presented. The only part that is immediately meaningful is the ProcessName column. Look for names in the ProccessName Column may include or imply "npm". "reg", etc..

Indeed the process may be being launched/enabled and immediately disabled. There could still be other processes involved. Just look.

 

[sonmate]

Nothing changed disabling that startup app, and still nothing appeared when running again the command Get-Process, this is so strange..