Cannot find Task Scheduler task

I have a task that runs every morning and, at its completion, sends me
an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began and I
could not find it!

I know that it has CAV and backup (or back-up) as part of its name but
it does not show up in the Task Scheduler hierarchy!

How do I find it?

Thanks.

Peter Holsberg wrote:

I have a task that runs every morning and, at its completion, sends me
an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began and I
could not find it!

I know that it has CAV and backup (or back-up) as part of its name but
it does not show up in the Task Scheduler hierarchy!

How do I find it?

Depends on the program as to where it defines its events. Some will
place their events in the general/catch-all category. Microsoft puts
their's under the "Microsoft" category. Some will define their own
category under which they place their events. You didn't say where you
looked and for which program (maker and product title).

When you expand the "Task Scheduler (local) - Task Scheduler Library
node in the tree, the general category is listed in the tasks pane. If
a program created its own category, you'll see the maker's name as a
subnode in the tree. If it is a Microsoft program, those go under the
"Microsoft" subnode.

Task Scheduler has a tree list of categories. Which tree nodes did you
search? There is no search function in Task Scheduler.

Was the scheduled event defined under your Windows account, or under a
different Windows account?

VanguardLH wrote on 8/29/2020 5:18 PM:
Peter Holsberg wrote:

I have a task that runs every morning and, at its completion, sends me
an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began and I
could not find it!

I know that it has CAV and backup (or back-up) as part of its name but
it does not show up in the Task Scheduler hierarchy!

How do I find it?

Depends on the program as to where it defines its events. Some will
place their events in the general/catch-all category. Microsoft puts
their's under the "Microsoft" category. Some will define their own
category under which they place their events. You didn't say where you
looked and for which program (maker and product title).

When you expand the "Task Scheduler (local) - Task Scheduler Library
node in the tree, the general category is listed in the tasks pane. If
a program created its own category, you'll see the maker's name as a
subnode in the tree. If it is a Microsoft program, those go under the
"Microsoft" subnode.

Task Scheduler has a tree list of categories. Which tree nodes did you
search? There is no search function in Task Scheduler.

I looked at all of them.

Was the scheduled event defined under your Windows account, or under a
different Windows account?

Mine but I will check.

Peter Holsberg wrote:

VanguardLH wrote:

Peter Holsberg wrote:

I have a task that runs every morning and, at its completion, sends
me an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began
and I could not find it!

I know that it has CAV and backup (or back-up) as part of its name
but it does not show up in the Task Scheduler hierarchy!

How do I find it?

Depends on the program as to where it defines its events. Some will
place their events in the general/catch-all category. Microsoft puts
their's under the "Microsoft" category. Some will define their own
category under which they place their events. You didn't say where you
looked and for which program (maker and product title).

When you expand the "Task Scheduler (local) - Task Scheduler Library
node in the tree, the general category is listed in the tasks pane. If
a program created its own category, you'll see the maker's name as a
subnode in the tree. If it is a Microsoft program, those go under the
"Microsoft" subnode.

Task Scheduler has a tree list of categories. Which tree nodes did you
search? There is no search function in Task Scheduler.

I looked at all of them.

Was the scheduled event defined under your Windows account, or under a
different Windows account?

Mine but I will check.

You might be able to tell which job (scheduled event) is the one by its
name. Look under:

C:\Windows\Tasks
and
C:\Windows\System32\Tasks

The latter one will have most event definitions, so you might want to
use a search tool (e.g., [Search] Everything) if you think you know part
of the event's name.

Not all programs use the Task Scheduler service to run scheduled jobs.
Some programs have their own scheduler service running in the
background. They choose to use their own task scheduler instead of the
one included in Windows. You still did not identify what program is
scheduled to run; else, could be others, or you, could research that
program to see if it uses its own scheduler process.

"CAV" sounds like you might be using Comodo's anti-virus program.
Comodo AntiVirus (CAV) is worthless alone, why they refused to allow AV
sites to test it to compare against others, and eventually rolled it
into Comodo's Firewall product to make use of the HIPS/Defense module in
there. Maybe they finally dumped their own CAV program, and contracted
to rebrand someone else's since I see it is now for separate sale, yet
no AV test or comparison site bothers to include it in testing or
benchmarking. You could try searching on "comodo" in the above folders
for scheduled jobs. However, I wouldn't be surprised to find Comodo
using their own scheduler process.

"CAV" was also used by Computer Associates Antivirus. Look in whatever
Comodo or CA programs you have to see which let you schedule their
actions. If they use their own scheduler, you'll have to look in their
configs, not in Task Scheduler.

Peter Holsberg wrote:
I have a task that runs every morning and, at its completion, sends me
an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began and I
could not find it!

I know that it has CAV and backup (or back-up) as part of its name but
it does not show up in the Task Scheduler hierarchy!

How do I find it?

Thanks.

The launching of processes is done by a number of
different means. And Windows 10 is the poster boy for
novelty launch mechanisms.

Take for example, you see some "rundll" entries in Task Manager.

You need to see the "full command" for those, to see what is really
being run.

Using Process Explorer, you can hold your mouse over an entry in
the process table and see the invocation used.

https://docs.microsoft.com/en-us/sys...ocess-explorer

Experiment with it a bit and look for some of the novelty cloaking
mechanisms. Microsoft does some of this, just for cloaking. And
they keep making new launchers, to annoy us.

This discussion mentions mechanisms to find a thing by its invocation.

https://superuser.com/questions/6830...-with-tasklist

wmic process where caption="test.exe" get commandline,processid

# or play with the command, with the conditional removed = 200 entries

wmic process get commandline,processid

# or test with the "get" removed, so you can discover all field names
# (start a notepad first...)

wmic process where caption="notepad.exe"

If you start this running 30 seconds before the launch time of
the task, it will log all sorts of activity on the system. And you
can watch your item launch. With enough persistence, you might
even see the environment variable with the process command details
in it. In the file menu, remove the "tick mark" to stop the collection
of the trace. You can do that 30 seconds after you know the stimulus is
no longer present (and worth tracing at that time).

https://docs.microsoft.com/en-us/sys...nloads/procmon

The filters are "post-trace filters" and do not disturb the
completeness of the trace. However, if you purposely create
post-trace output in a certain format, then information could
be lost, but presumably at that point, you wanted that to happen.
The original trace file can be kept for later analysis if you want.

Paul

On 8/29/2020 6:55 PM, VanguardLH wrote:
Peter Holsberg wrote:

VanguardLH wrote:

Peter Holsberg wrote:

I have a task that runs every morning and, at its completion, sends
me an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began
and I could not find it!

I know that it has CAV and backup (or back-up) as part of its name
but it does not show up in the Task Scheduler hierarchy!

How do I find it?

Depends on the program as to where it defines its events. Some will
place their events in the general/catch-all category. Microsoft puts
their's under the "Microsoft" category. Some will define their own
category under which they place their events. You didn't say where you
looked and for which program (maker and product title).

When you expand the "Task Scheduler (local) - Task Scheduler Library
node in the tree, the general category is listed in the tasks pane. If
a program created its own category, you'll see the maker's name as a
subnode in the tree. If it is a Microsoft program, those go under the
"Microsoft" subnode.

Task Scheduler has a tree list of categories. Which tree nodes did you
search? There is no search function in Task Scheduler.

I looked at all of them.

Was the scheduled event defined under your Windows account, or under a
different Windows account?

Mine but I will check.

You might be able to tell which job (scheduled event) is the one by its
name. Look under:

C:\Windows\Tasks
and
C:\Windows\System32\Tasks

The latter one will have most event definitions, so you might want to
use a search tool (e.g., [Search] Everything) if you think you know part
of the event's name.

Not all programs use the Task Scheduler service to run scheduled jobs.
Some programs have their own scheduler service running in the
background. They choose to use their own task scheduler instead of the
one included in Windows. You still did not identify what program is
scheduled to run; else, could be others, or you, could research that
program to see if it uses its own scheduler process.

"CAV" sounds like you might be using Comodo's anti-virus program.
Comodo AntiVirus (CAV) is worthless alone, why they refused to allow AV
sites to test it to compare against others, and eventually rolled it
into Comodo's Firewall product to make use of the HIPS/Defense module in
there. Maybe they finally dumped their own CAV program, and contracted
to rebrand someone else's since I see it is now for separate sale, yet
no AV test or comparison site bothers to include it in testing or
benchmarking. You could try searching on "comodo" in the above folders
for scheduled jobs. However, I wouldn't be surprised to find Comodo
using their own scheduler process.

"CAV" was also used by Computer Associates Antivirus. Look in whatever
Comodo or CA programs you have to see which let you schedule their
actions. If they use their own scheduler, you'll have to look in their
configs, not in Task Scheduler.

Look at Next or Last Run Time in Task Scheduler.

If nothing at the time it runs then look in Event Viewer

Paul wrote:

The launching of processes is done by a number of
different means. And Windows 10 is the poster boy for
novelty launch mechanisms.

It sure does have a varied number of startup locations. There are many
different utilities and locations to find processes that are started on
boot.

VanguardLH wrote on 8/29/2020 6:55 PM:
Peter Holsberg wrote:

VanguardLH wrote:

Peter Holsberg wrote:

I have a task that runs every morning and, at its completion, sends
me an email.

It has been doing this for months.

Today, I opened Task Scheduler to see exactly when the task began
and I could not find it!

I know that it has CAV and backup (or back-up) as part of its name
but it does not show up in the Task Scheduler hierarchy!

How do I find it?

Depends on the program as to where it defines its events. Some will
place their events in the general/catch-all category. Microsoft puts
their's under the "Microsoft" category. Some will define their own
category under which they place their events. You didn't say where you
looked and for which program (maker and product title).

When you expand the "Task Scheduler (local) - Task Scheduler Library
node in the tree, the general category is listed in the tasks pane. If
a program created its own category, you'll see the maker's name as a
subnode in the tree. If it is a Microsoft program, those go under the
"Microsoft" subnode.

Task Scheduler has a tree list of categories. Which tree nodes did you
search? There is no search function in Task Scheduler.

I looked at all of them.

Was the scheduled event defined under your Windows account, or under a
different Windows account?

Mine but I will check.

You might be able to tell which job (scheduled event) is the one by its
name. Look under:

C:\Windows\Tasks
and
C:\Windows\System32\Tasks

The latter one will have most event definitions, so you might want to
use a search tool (e.g., [Search] Everything) if you think you know part
of the event's name.

No joy.

Not all programs use the Task Scheduler service to run scheduled jobs.
Some programs have their own scheduler service running in the
background. They choose to use their own task scheduler instead of the
one included in Windows. You still did not identify what program is
scheduled to run; else, could be others, or you, could research that
program to see if it uses its own scheduler process.

"CAV" sounds like you might be using Comodo's anti-virus program.
Comodo AntiVirus (CAV) is worthless alone, why they refused to allow AV
sites to test it to compare against others, and eventually rolled it
into Comodo's Firewall product to make use of the HIPS/Defense module in
there. Maybe they finally dumped their own CAV program, and contracted
to rebrand someone else's since I see it is now for separate sale, yet
no AV test or comparison site bothers to include it in testing or
benchmarking. You could try searching on "comodo" in the above folders
for scheduled jobs. However, I wouldn't be surprised to find Comodo
using their own scheduler process.

"CAV" was also used by Computer Associates Antivirus. Look in whatever
Comodo or CA programs you have to see which let you schedule their
actions. If they use their own scheduler, you'll have to look in their
configs, not in Task Scheduler.


The program I'm using is actually a CMD file consisting of several lines
of xxcopy commands.

Peter Holsberg wrote:

The program I'm using is actually a CMD file consisting of several lines
of xxcopy commands.

Since you know when the scheduled event runs, and if you used Task
Scheduler to run the event, you could sort the scheduled jobs in Task
Scheduler by the "Last Run Time" column. Look for events scheduled to
run (Next Run Time) or when they ran before (Last Run Time) that are at
the time you know the scheduled task will run next or when it ran prior.

After logging into your Windows, stop and disable the Task scheduler
service. See if it still runs at its next scheduled run time.

John Doe wrote on 8/29/2020 9:03 PM:
Paul wrote:

The launching of processes is done by a number of
different means. And Windows 10 is the poster boy for
novelty launch mechanisms.

It sure does have a varied number of startup locations. There are many
different utilities and locations to find processes that are started on
boot.


groan