2

I keep getting this window titles "Windows Features"
It then says that:

An app on your PC needs the following Windows feature:

.NET Framework 3.5 (Includes .NET 2.0 and 3.0)

and I can choose to install or skip (being warned that my apps might not work correctly).

There is also a "telll me more about this feature" link but it explains about the .NET framework.

I want to know if there is a way for me to know which application is it that asks for this feature as the window just keeps popping out of the context of activating a new app...

This all started just a few days ago after some unattended update on my windows 10.

epeleg
  • 559
  • 6
  • 12
  • 27
  • you try to run an .net executable which was compiled for .net 2.0/3.5 – magicandre1981 Nov 06 '16 at 17:23
  • nope, I am not trying to run anything... I came back to my conputer and this dialog is opened like 30 times or more... :( – epeleg Nov 07 '16 at 13:12
  • Run ProcessExplorer and look for the process **Fondue.exe**. Now loook which other process is higher in the process tree, this is the parent which launched the dialog. https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx – magicandre1981 Nov 07 '16 at 16:36
  • either I am not using the processexplorer correctly or the fondue.exe does not have a parent :( looking at its properties it says: the command line is: "C:\WINDOWS\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll but I don't see how this helps :( – epeleg Nov 07 '16 at 21:02
  • with ProcessExplorer look at the properties of Fondue.exe. there is shows the parent process in a textbox – magicandre1981 Nov 08 '16 at 05:20
  • it says "(9080)" :( is there a way to keep a log of every process that is created and removed? – epeleg Nov 09 '16 at 12:37
  • sysmon logs the process creation : https://technet.microsoft.com/en-us/sysinternals/sysmon here you should see which process had the ID – magicandre1981 Nov 09 '16 at 16:50
  • o.k. - is started sysmon and I will update. – epeleg Nov 10 '16 at 06:16
  • any updates? Have you now seen which other process launched the Fondue.exe? – magicandre1981 Nov 12 '16 at 07:25
  • yes thank you very much, it was a program I am familiar with that is installed on my machine - no security issue involved as far as I could tell. please post an answer regarding the usage of both above mentioned tools so that I will accept it. – epeleg Nov 14 '16 at 20:48
  • I've posted it as answer, so that you can accept it: http://meta.stackexchange.com/a/5235 – magicandre1981 Dec 03 '16 at 19:58

1 Answers1

3

You get this message because you try to run an application which is compiled for .net 2.0/3.5. Run ProcessExplorer and look for the process Fondue.exe and look at the properties of the process Fondue.exe. There you can find a textbox parent process, to see which other process triggered the start. If you see Non-existent process (PID), you need to do an other step.

Install sysmon and when you next time get the “Windows features” dialog, check again for the parent process id.

enter image description here

Now look in Eventlog for the data that sysmon added and look which process for your current session had the process ID from the parent textbox.

Now you know which process triggered the “Windows features” dialog.

magicandre1981
  • 97,301
  • 30
  • 179
  • 245