Something is running a job at 4AM but there are no tasks in task scheduler. Windows 2000 server.

[Tonagon]

This is interesting.
Windows 2000 Server. Sp4
They had a scheduled task to run a batch file at 4AM. It was changed
to 2:30AM, at which point it seemed to run at 2:30AM as well as 4AM
(which was a big problem).

We have since removed all tasks from the task scheduler, and the job
that the batch file would kick off still runs at 4AM. The actual batch
file is not what is being run, as it logs as well as checks for a flag
so that it will not run the job twice in the same day.
But yet the job in question gets run at 4AM somehow (this is the
mystery).
We are not on a domain and are logged in as administrator.
System has been rebooted.
I ran that "at" command and it shows there are no entries in the list
(not sure how to use the at command really).

We have taken out any means that we could think of for the user to run
said job themselves (although they swear they are not doing it anyway).

Unable to determine what is running this job at 4AM each day.
Any suggestions?

 

[Dave Patrick]

Some of these may help. It may be scheduled remotely.

http://www.sysinternals.com/Utilities/Handle.html
http://www.sysinternals.com/Utilities/Filemon.html
http://www.sysinternals.com/Utilities/Autoruns.html
http://www.sysinternals.com/Utilities/PMon.html
http://www.sysinternals.com/Utilities/PsExec.html

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| This is interesting.
| Windows 2000 Server. Sp4
| They had a scheduled task to run a batch file at 4AM. It was changed
| to 2:30AM, at which point it seemed to run at 2:30AM as well as 4AM
| (which was a big problem).
|
| We have since removed all tasks from the task scheduler, and the job
| that the batch file would kick off still runs at 4AM. The actual batch
| file is not what is being run, as it logs as well as checks for a flag
| so that it will not run the job twice in the same day.
| But yet the job in question gets run at 4AM somehow (this is the
| mystery).
| We are not on a domain and are logged in as administrator.
| System has been rebooted.
| I ran that "at" command and it shows there are no entries in the list
| (not sure how to use the at command really).
|
| We have taken out any means that we could think of for the user to run
| said job themselves (although they swear they are not doing it anyway).
|
| Unable to determine what is running this job at 4AM each day.
| Any suggestions?
|

 

[David H. Lipman]

From: "Tonagon" <[email protected]>

| This is interesting.
| Windows 2000 Server. Sp4
| They had a scheduled task to run a batch file at 4AM. It was changed
| to 2:30AM, at which point it seemed to run at 2:30AM as well as 4AM
| (which was a big problem).
|
| We have since removed all tasks from the task scheduler, and the job
| that the batch file would kick off still runs at 4AM. The actual batch
| file is not what is being run, as it logs as well as checks for a flag
| so that it will not run the job twice in the same day.
| But yet the job in question gets run at 4AM somehow (this is the
| mystery).
| We are not on a domain and are logged in as administrator.
| System has been rebooted.
| I ran that "at" command and it shows there are no entries in the list
| (not sure how to use the at command really).
|
| We have taken out any means that we could think of for the user to run
| said job themselves (although they swear they are not doing it anyway).
|
| Unable to determine what is running this job at 4AM each day.
| Any suggestions?

Please search the PC for the presence of these files...

mscornet.exe
mssearchnet.exe
nvctrl.exe
svchosts.dll

Please check; C:\Program Files\. for any of these folders...

SpyAxe
PSGuard
P.S.Guard
Search Maid
Virtual Maid
AntivirusGold
AdwareDelete
SpySheriff
Daily Weather Forecast
Security IGuard
AutoUpdate
CxtPls


Please report back your findings.

 

[Tonagon]

AHA! We got it solved. The job WAS being run remotely. He had an old
server still on the network that was running the same scheduled task
and kicking off the job on the new server.
Thanks for the help!

 

[Dave Patrick]

You're welcome. Thanks for letting us know.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| AHA! We got it solved. The job WAS being run remotely. He had an old
| server still on the network that was running the same scheduled task
| and kicking off the job on the new server.
| Thanks for the help!
|