Mysterious notepad.exe spawned every morning

Question

Since a couple of weeks, when I sit down in the morning and unlock my PC at work, I see a notepad window, complaining that it "Cannot find c:\oracle.message.txt". This is quite unnerving - I thought I had some malware infection, but neither Microsoft Security Essentials nor AVG found anything. Process Explorer shows that notepad is spawned from within svchost.exe - look at the top of the window, you'll see that notepad is spawned from svchost, which is "Verified" (that is, Process Explorer checked its digital signature and found it to be legitimate). The particular instance of svchost hosts a number of services which are visible in the screenshot, but none of them seems to be "suspect" - and none of them has anything to do with Oracle. To top it all of, my machine has NEVER had an Oracle installation - the only relevant thing I can find is the Oracle ODBC driver...

What can I do to debug/trace this?

I am a professional developer for two decades now, so feel free to suggest complex solutions, including SoftICE hardware breakpoints if necessary :-)

Answer 1

The Task Scheduler service lives inside svchost.exe - are you sure you haven't got a strange scheduled task set up?

Answer 2

Solved - it was done via a c:\Windows\Tasks entry. The "Task Scheduler" lived in the particular svchost instance that spawned notepad, and after Tim Robinson's suggestion, I checked the list under c:\Windows\Tasks - and there it was, in an action called "Oracle", with a cmd "c:\windows\notepad.exe c:\oracle.message.txt".

Who placed it there, and why, is a mystery beyond my abilities... as is why it decided to manifest itself only in the last two weeks.