indicating an open application in the taskbar with no identity. The background
of the rectangular part is like any normal one. There is a white folder icon
with a blue top border within the rectangle. Right and left clicking only cause
the color of the rectangle to go from lighter to darker and back again. The
“phantom” has no association and when I open Task Manager it shows no
applications running. I have been told that I might have to stop processes one
at a time and reboot each time as well as use msconfig to do the same with
services and startup. I assume this process could be risky as well as extremely
time consuming and I hope it can be avoided.
Time consuming? Certainly. Risky? You bet. Done improperly, I believe you
can render Windows unbootable. The result would replace a small problem with a
The good news is that I don’t think we need to resort to anything like that
at all. In fact, we’ll use one of my favorite free tools … the Swiss Army
Knife of diagnostic tools, and see if we can’t at least begin to narrow down
But it will take a little investigation by process of elimination.
Become a Patron of Ask Leo! and go ad-free!
Go grab a copy of SysInternals Process
Explorer. Think of it as Task Manager on steroids. Lots of steroids. If I
could have only one diagnostic tool, this would be it.
Swiss Army Knife of diagnostic tools …”
When you run Process explorer, you’ll see that you have a lot of
programs running. Probably more than you realized. That’s fine, and for the
most part normal. In fact, as I type, the list of processes running on my
machine is longer than the screen.
What we’ll do is examine the processes that are running, rule out the ones
we know are not an issue, and see if what remains have windows we can close.
For those, we’ll close the window, and see if that makes your phantom process
Process Explorer defaults to a “tree” view of processes (click on the
Process column header until it shows an indented list. It most
likely will show two processes that are on the far left, “System Idle Process”,
and “explorer”. Everything indented underneath the “System Idle Process” is
Windows, and is running whether you’re logged in or not. Everything underneath
“explorer” represents the programs that are running as a result of you’re
having logged in, including the things that show up in your taskbar (“explorer”
is the program that actually displays the task bar.) Here’s part of the list
from my machine – you can see that there’s a lot running:
Now, it’s fairly easy to identify what most of those are. Either the icon,
the name or the description, if present, will make it fairly clear. But
sometimes that’s not enough. Take the “rundll32.exe” in the list above – what’s
that? If I right click on it, select Properties, I get
That holds a clue. Rundll32 is a helper application that runs other
programs. In this case we can see that the command line says it is to run
something called “NvMcTray” – a quick Google of that shows that it’s the little
control icon for my NVidia graphics card. Mystery solved.
After you’ve identified most of what’s running you’ll probably have an item
or two left, one of which may be your “phantom”.
Right click on one of the remaining unknown items in process explorer, and
click Window. If the resulting sub-menu is not gray, the click
on “Restore”, or “Bring to Front” and see what happens. If nothing happens,
then click on “Close” in that sub menu, and see if your phantom disappears.
If the Window sub-menu is grey, then we’ve only one course left … right
click on the unknown process in process explorer and click on Kill
Process, and see if your phantom goes away. If not, you may want to
reboot at this point to restore whatever it was we just killed.
The process I’ve just outlined helps me identify 99% of the processes,
windows, taskbar items, or what-have-you that are running on my machine.
Hopefully it’ll help you identify yours.