Is Interactive Services Detection a legitimate message from Windows?

Interactive Services Detection - Program is trying to display a message

I have Windows 7 running in a VM on my Ubuntu PC, for when I occasionally need to do something on Windows. Today this message appeared, but I'm a little skeptical that it is actually from Windows. Notice that instead of saying it might "need information from you" it says "need information form you".

14.8k 40 40 gold badges 108 108 silver badges 171 171 bronze badges asked Jun 11, 2017 at 3:30 The Unknown Dev The Unknown Dev 635 1 1 gold badge 6 6 silver badges 10 10 bronze badges

In short, there are programs running in the background ("services"). They normally cannot show anything on your screen. When you click "view the message", you switch to another desktop where you can temporarily interact with the program. Once you're done, you'll go back to your own desktop. It's perfectly fine, although unusual.

Commented Jun 11, 2017 at 9:32

The background program (service) you're running has a bug. It is doing something it was never supposed to be doing, and something that was officially broken by Microsoft over a decade ago. Look for an updated version of it, or file a bug report with the vendor of the software. And yeah, that spelling error is craziness. No idea how that ever got past Microsoft's QA.

Commented Jun 11, 2017 at 9:47

@CodyGray To be fair, if the service was written pre-Vista, it's not a bug, that's just what services did at the time.

Commented Jun 11, 2017 at 10:03

Spelling errors are common even in genuine Windows messages (in particular in translated versions - the German messages are often horrible)

Commented Jun 11, 2017 at 15:37

FYI Alt+PrintScreen captures the current active window so you don't have to crop with ugly artifacts around like that. Snipping tool also have an option to capture current window

Commented Jun 12, 2017 at 2:48

1 Answer 1

The Interactive Services Detection message is meant for errors that happen in service context of the desktop session when a service tries to interact with the legacy desktop (desktops with session 0). This is a mitigation feature of the Windows environment post-Vista. Currently Windows employs session 0 isolation (now the desktop of the first user to log in is run in session 1 instead).

Clicking on view message should bring you to session 0's desktop where you can deal with the (probably an error of some kind) message further.

For a more expansive explanation see MSDN blog posts by Pat Altimore on it:

What is Interactive Services Detection and Why is it Blinking at Me?
Troubleshooting Interactive Services Detection

If you are really paranoid like me ;P, disconnect the VM from the internet and then proceed. You can even go get a set of Sysinternals Suite from Microsoft here and use the modules:

procexp - more detailed version of task manager for seeing exactly whats going on where
tcpview - see what connections are being attempted, from where, and to whom

This should give you ample information to decide whether this is a malicious exploit gone wrong, or a harmless bug on the system. It's more than likely just a harmless error, but I'll never tell someone to be less cautious.

As for the spelling error, I took your image and did a reverse google image search. This spelling error appears in a lot of screenshots of this message. It makes my stomach turn as I'm sure it does you, but just be careful and diligent in debugging it and you should be ok. But to be fair, the spelling error also appears in the screenshot on Microsoft's blog I linked earlier too.