Windows 7 – How to Detect Background Program Stealing Focus

As and31415 advised me, I took a careful look at what is in my Startup tab of msconfig program, but found nothing unusual.

It is now clear that this is 99% caused by some external program (though not noticed before and though I haven't installed anything new recently), not by Windows. This is the most important point for me here.

I googled a little bit more and got some ideas / advice, namely that I should try to press Alt+F4 immediately after I notice a steal of a focus. This should exit process that could cause this focus stealth. Then, I may try to use Process Monitor from Sysinternals package to trace the process that has just exited.

This may give me some idea of what is causing this problem.

Here's a script that will tell you which app is activating without telling you. I adapted it from an answer to @KevinReid's question over on Apple SE.

Leave it running in a terminal, wait for the rogue app to steal focus, and see which app is listed last. (For me: Google Drive. Others have reported Symantec AV stuff.)

#!/usr/bin/python                                                                                                       

try:
    from AppKit import NSWorkspace
except ImportError:
    print "Can't import AppKit -- maybe you're running python from brew?"
    print "Try running with Apple's /usr/bin/python instead."
    exit(1)

from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print '%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
            active_app['NSApplicationName'],
            active_app['NSApplicationPath']
        )
    sleep(1)