Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Where Did This Message Come From?

Identifying the source.

Process Explorer includes a nifty feature to help you identify any program displaying a window or message box.
Sonar pattern on a computer monitor.
(Image: DALL-E 3)
Question: On my wife’s computer, when she signs on, she gets this message in a small rectangular box: “ERROR – Unexpected error; Quitting”, with an OK button. This message comes on when she signs on and stays on the screen for two minutes and then disappears. Or I can click it off any time. Is there any way we can get it to stop?

The real question here is where that message box comes from. What program has the “unexpected error”?

Once we have the answer to that question, we can decide what to do.

Become a Patron of Ask Leo! and go ad-free!


Where that message came from

Use SysInternals Tools’ Process Explorer. Click its “sonar” icon and drag it over the message of unknown origin. Process Explorer will highlight the culprit program. Depending on what you find, you can either fix the program, disable it from startup, or run an anti-malware scan.

Identifying the culprit

Finding out the source of the message should be relatively easy.

Install SysInternals Tools, if you haven’t already, and run Process Explorer. When you run it, you’ll see a small round icon on its toolbar that looks a little like a radar or sonar screen.

Sonar icon in Process Explorer.
Sonar icon in Process Explorer. (Screenshot:

When you click and hold on this icon, Process Explorer hides itself and highlights the window you move your mouse cursor over. So while that error message is still up, start Process Explorer, click and hold on the sonar icon, and drag it on top of the error message.

Process Explorer Sonar icon drug on top of a message box.
Process Explorer’s sonar icon pulled on top of a message box. (Screenshot:

Now release the mouse button. Process Explorer reappears and highlights the program that generated the error.

Process Explorer highlighting Notepad.exe.
Process Explorer highlighting Notepad.exe. Click for larger image. (Screenshot:

In my example, it’s highlighting notepad.exe because that’s the application I used to generate the error message above.

Then what?

What happens next depends on what you find out.

You might recognize the program and realize something about it needs to be corrected. Or you may need to research more about that program to understand the error and its remedies.

You might not recognize the program, at which point you should probably Google it or follow some of the other steps from my article What’s This Program Running on My Machine? to try and identify it. Again, knowing what it is should help determine your course of action.

It might show up as a system file — like say, svchost.exe. Things get tricky here because many system programs like svchost are multi-purpose workhorses, so just knowing their names tells you little. However, adding that to the Google search could turn up some interesting results.

Since it happens at login, you can then use the results of the investigation so far and start looking at What Are All These Programs Running After I Boot Windows?  You may decide it’s the result of a program that shouldn’t be running on startup anyway, and simply disabling the startup item will clear the error message and free up a little memory on your machine.

And, of course, it could be the result of malware of some sort. Be sure to run an up-to-date anti-malware scan.

Do this

Process Explorer is a handy tool for many things, but it’s something I reach for whenever I’m faced with a message box or window of unknown origin. It doesn’t have to be a startup error for the Process Explorer sonar feature to be useful.

Also useful? Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

Podcast audio


3 comments on “Where Did This Message Come From?”

  1. Hi Leo,

    Thanks for the advice. I downloaded and used process explorer to find what caused the pop-up that keeps on telling me restart my computer even after I have just re-booted.

    I found it was the Adobe updater application file causing it. After I deleted the file ….walah no more pop-up.

    Thanks for our help. You are a star.


    • Theo —

      You shouldn’t delete an Updater, because updaters are normally installed as a part of whatever software they update. Simply to delete it may “break” something.

      They’re often (if not usually) configurable, so you may be able to adjust its behavior, or even disable it completely.

      If you MUST remove it, you should (if possible) uninstall it rather than delete it. Unfortunately, this might only be possible by uninstalling the main program itself! :(

      • Additionally, I’d reinstall the application that brought up the error message.

        I’d avoid uninstalling an updater because unpatched software can be more vulnerable to exploits and malware. Adobe products are particularly vulnerable.


Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.