CMD or PowerShell keeps popping up?
Find out what opened that black window. WindowWatch is a free Windows app that records flashing CMD and PowerShell windows and helps identify their source. Run it in the tray to catch the next appearance.
About this project
WindowWatch is a free Windows tray utility for the moment a black terminal appears and disappears before you can read it. Open history to see the source script or executable, its path and who launched it.
New marks a first appearance, Regular a repeated launch, and Changed a file whose content differs from its previous local check. Search, grouped repeats and short Unknown reasons keep the history practical. These labels describe observed history, not whether a file is safe.
This is an early version. Very short or inaccessible processes may remain Unknown. History stays on your PC; version checks request only the public release information. The video is an illustrated presentation with sample data.
System requirements
Windows x64 with .NET Framework. No installer or cloud account required. Ordinary monitoring works without administrator rights; protected processes may expose less information.
How to run
Download WindowWatch-0.3.0.exe into a writable folder and run it. The app creates its local data folder automatically. Close the main window to keep watching in the tray; double-click the tray icon to open history.
Notification On/Off controls popups. All launches also shows repeated appearances. Check for updates on startup checks once each time the application starts, when enabled. There are no periodic checks. Check for update now runs a manual check.
Limited process capture means Windows did not allow process event subscriptions. Window monitoring continues, but an immediately exiting process may leave an Unknown source. Relative script names cannot be located without a full path.
A black box pops up on my computer and disappears. What was it?
A small black window flashes, shows a few lines of text and closes before you can read it. It may be a command window opened by another program. You do not need to know whether it was CMD or PowerShell to start investigating.
WindowWatch watches for these brief terminal windows while it is running. When the source is available, its history shows the script or executable, the file path and the parent process — the program that launched it.
How to find what opened the window
- Download WindowWatch into a writable folder and run it.
- Close the main window to keep monitoring in the tray. Leave it running until the popup happens again.
- Double-click the tray icon and open the recorded event in history.
- Check the source file, its path and the parent process to identify the app or script to investigate.
No installer or account is required. The history stays on your PC.
Can I identify a window that already disappeared?
If WindowWatch was running and captured it, you can inspect the saved event after the window closes. It cannot reconstruct an event from before monitoring started. Start the app now to catch a future appearance.
Very short or protected processes may leave an Unknown source. A recorded window does not guarantee that Windows exposed its script or full launch details.
Why does PowerShell keep popping up?
An app, a startup item or a scheduled task can launch PowerShell. The window alone does not tell you which one did it. Whether Windows PowerShell opens randomly, at sign-in or while you are playing a game, the useful clue is what launched it.
Use a captured event to look for the source script and parent process. Repeated appearances are grouped in WindowWatch history, so you can examine them after the popup has gone.
Why does CMD keep opening and closing?
A command prompt can open briefly while another app runs a command or script, then close when the command finishes. If CMD keeps popping up unexpectedly, identifying the file and the app that launched it gives you something concrete to check.
WindowWatch records observed appearances; it does not keep another program’s console open or automatically stop the command from running.
How do I stop unwanted PowerShell or CMD popups?
First identify the source. If it belongs to an app you recognize, check that app’s settings and updates. For a popup at sign-in, check Windows startup apps; for one that repeats on a schedule, inspect the relevant Task Scheduler entry.
WindowWatch helps with the identification step. It does not automatically disable startup items, scheduled tasks or other programs.
Does a flashing command window mean a virus?
The appearance of a window is not enough to decide. WindowWatch provides launch history, not a malware verdict. New, Regular and Changed describe what it has observed locally; they do not label a file safe or dangerous.
If the captured source is unfamiliar, investigate the file and use your security software to assess it.