Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Since a couple of weeks, when I sit down in the morning and unlock my PC at work, I see a notepad window, complaining that it "Cannot find c:\oracle.message.txt". This is quite unnerving - I thought I had some malware infection, but neither Microsoft Security Essentials nor AVG found anything. Process Explorer shows that notepad is spawned from within svchost.exe - look at the top of the window, you'll see that notepad is spawned from svchost, which is "Verified" (that is, Process Explorer checked its digital signature and found it to be legitimate). The particular instance of svchost hosts a number of services which are visible in the screenshot, but none of them seems to be "suspect" - and none of them has anything to do with Oracle. To top it all of, my machine has NEVER had an Oracle installation - the only relevant thing I can find is the Oracle ODBC driver...

What can I do to debug/trace this?

I am a professional developer for two decades now, so feel free to suggest complex solutions, including SoftICE hardware breakpoints if necessary :-)

share|improve this question

migrated from stackoverflow.com Jul 2 '10 at 12:59

This question came from our site for professional and enthusiast programmers.

    
Check the command line used to launch the file - this should be accessible in Process Explorer, in process details. –  Piskvor Jul 2 '10 at 13:02
    
Solved - it was done via a c:\Windows\Tasks entry. The command line was exactly as specified there, in an action called "Oracle", and the cmd was "c:\windows\notepad.exe c:\oracle.message.txt". Who placed it there, and why, is a mystery beyond my abilities... –  ttsiodras Jul 2 '10 at 14:16
    
The image you link to is broken. –  8088 Sep 8 '11 at 4:05

2 Answers 2

up vote 7 down vote accepted

The Task Scheduler service lives inside svchost.exe - are you sure you haven't got a strange scheduled task set up?

share|improve this answer
    
That was it! Thank you Tim, I opened c:\Windows\Tasks, and sure enough, there the bloody thing was... –  ttsiodras Jul 2 '10 at 14:13

Solved - it was done via a c:\Windows\Tasks entry. The "Task Scheduler" lived in the particular svchost instance that spawned notepad, and after Tim Robinson's suggestion, I checked the list under c:\Windows\Tasks - and there it was, in an action called "Oracle", with a cmd "c:\windows\notepad.exe c:\oracle.message.txt".

Who placed it there, and why, is a mystery beyond my abilities... as is why it decided to manifest itself only in the last two weeks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.