Hidden Task Revealer

Try3 · 27 May 2020

Chris,

Yes, one of the things that concerns me is that I found out very early on [late 2018] was that not everybody has this affliction.
- So there must be one or more specific causes of it.
- But no specific cause has been identified other than, for at least one user, a messaging/chat utility called Trillian
- Nobody has ever identified any particular harm that these ghost tasks cause either.
- The ghost tasks only show up in the TS Task status pane [it does not allow any further info to be found]
- Event viewer logs what seems to be set of related events involving something called JD_TaskSchedulerSchedule
- Andy has identified that a particular Task scheduler dll file [controlled by the Sync host service] initially creates the ghost entries
- It is possible, but I can only speculate, that a legitimate application [such as Trillian] conducted a faulty interaction with the dll or the service and that created an imperfectly-registered TS task that is not listed by Task scheduler or reflected in its source folders of Tasks either [C:\Windows\Tasks, C:\Windows\System32\Tasks]

The action I've taken today, using Andy's excellent utility, suppresses the symptoms but does nothing about the cause.

Thanks for posting,
Denis

RaveBlack · 27 May 2020

Try3 said:

It is possible, but I can only speculate, that a legitimate application [such as Trillian] conducted a faulty interaction with the dll or the service and that created an imperfectly-registered TS task that is not listed by Task scheduler or reflected in its source folders of Tasks either [C:\Windows\Tasks, C:\Windows\System32\Tasks]

That's the conclusion I drew from my Trillian experience. What I read about the program mentioned it creating a scheduled task for itself, one that I was never able to find in the source folders of Tasks no matter how much I scoured them. I think that it's prob'ly an incompatibility between Win10 and the program, personally.

It was the timeframe that clued me in. A fresh Win10 install didn't have it. Once I started reinstalling what I used, that's when it started showing up. The first night of that reset, I installed a few things and nothing happened. The second night included Trillian, and that's when it started happening again. An uninstall didn't fix it, it still kept happening. Needed another reset to completely eradicate it. I omitted Trillian completely after that and it hasn't happened for me since then.

Try3 · 27 May 2020

RaveBlack,

Hello again. I remember your JD scheduler - Trillian thread and that you also joined in my own thread on the subject.

Andy Bruin has really moved things forward, hasn't he? I know it is only suppressing symptoms but nobody else even got me that far.

Thanks for pointing out about Trillian's attempt to create its own TS task at the time your symptoms started. It does make some sort of sense / it does seem that my speculation was not entirely idiotic.
- My earliest recorded symptom had been 30 days before I spotted anything and that was when I had installed a new version of Intel Driver & support assistant so I've always thought it was involved. I think that it also used to create a TS task of its own.
- By then I had a lot of changes [updated drivers, OS updates, OS settings changes, application configuration changes, ...] that I didn't fancy repeating so I took the risk of sticking with it and hoping for a solution. That was in late 2018.

All the best,
Denis

Andy Bruin · 28 May 2020

Try3 said:

Andy,

It's taken me an hour or more to finish writing this post. My 'it is not a hidden task' comment was a response to another user not to you.
- Task scheduler does not, by default, show hidden tasks [tasks that have a deliberate hidden property] but our problem items are not of that nature.
- If the problem items were merely records of a hidden task it would have taken approximately a miniute to resolve the issue.
- In other words, whilst we might think of the instigating thing being hidden, it is not a "hidden task" as such.
Denis

Thanks Denis for the clarification. Again yours and others comments prompt me to what I need to update re-guarding the README.TXT and my proposed help manual (with your screenshot :) to show how to enable the logs.

As to my definition of hidden it also includes that the displayed task name {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} reveals nothing about what the task is and does. Thankfully WpTasks now plugs that gap.

As to your fantastic startup script thanks for the great work on this. I'm damm impressed! I will post more on you script later today (have some other stuff to do).

Also I will respond to the redistributable question below.

Cheers
Andy Bruin

- - - Updated - - -

Try3 said:

Andy,

About the Microsoft Visual C++ 2015 Redistributable I need to add to my awkward computer

The guidance I have found states that I need to use the x64 version of the C++ Redistributable because my Windows is x64 on the problem computer.

I am not convinced that this is correct.

Is there anything in your development records about external references that would confirm this one way or the other?
In other words, I suspect that WpTasks.exe references the x86 version of the C++ Redistributable even when running on x64 Windows.

Knowing this will save me having to try both and make several system images as I go along [just in case].

Denis

Hi Denis,

I compiled the WpTasks.exe executable as an x86 executable using Visual Studio 2015. It seems it requires this.

The one I have installed is as follows:

Microsoft Visual C++ 2015 Redistributle (x86) - 14.0.24123

Can confirm VCRunTime140.dll is installed by this.

A microsoft link for this redistributle follows. It includes both x86 and x64 versions. Download both and execute both on an x64 machine to install.

https://www.microsoft.com/en-us/down....aspx?id=52685

I compiled it as x86 rather than x64 to ensure it runs on all processors.

[Edit]Saw your later post confirming installation of this redistributable works so I will add it to the zip with install instructions.

I will also add your screenshot for VCRunTime140.dll error to the manual if that is ok with you. This is very useful information for other users.

Cheers
Andy Bruin

- - - Updated - - -

Bree said:

It is not correct. You need the appropriate version to suit the app that is calling for it, x86 apps require the x86 redistributable, x64 apps need the x64 version. It is perfectly acceptable and does no harm to have both installed.

Hi Bree (and Try3),

You are both correct as it only requires the vc_redist.x86.exe part of "Microsoft Visual C++ 2015 Redistributable Update 3 RC" to be installed. However on a x64 machine it's best to install vc_redist.x64.exe as well as some other program sooner or later will require it.

PS You only need to install these if you get the VCRunTime140 error

Cheers
Andy Bruin

- - - Updated - - -

Callender said:

Nothing found for me:

Attachment 280469

Big thanks Callender for your feedback. This is really interesting as I didn't expect this and may be relevant to following posts following your initial post. Can you give us details about what Windows operation system and version is installed. I can help you find this info if necessary.

Cheers
Andy Bruin

- - - Updated - - -

RaveBlack said:

That's the conclusion I drew from my Trillian experience. What I read about the program mentioned it creating a scheduled task for itself, one that I was never able to find in the source folders of Tasks no matter how much I scoured them. I think that it's prob'ly an incompatibility between Win10 and the program, personally.

It was the timeframe that clued me in. A fresh Win10 install didn't have it. Once I started reinstalling what I used, that's when it started showing up. The first night of that reset, I installed a few things and nothing happened. The second night included Trillian, and that's when it started happening again. An uninstall didn't fix it, it still kept happening. Needed another reset to completely eradicate it. I omitted Trillian completely after that and it hasn't happened for me since then.

Thanks RaveBlack for this additional info.

I'm waiting on getting some more system details regarding Callenders previous post as he doesn't show any tasks using WpTasks.exe.and I think this could be very relevant to your observances here.

I'm definitely sure this task and the associated OneSyncSvc service starts automatically on the version of Windows I am testing on (Windows 10 home version 1803) and the later vanilla laptop. However this may of not been the case for earlier Windows 10 versions.

If the OneSyncSvc service is set to start manually this task will not appear unless something triggers the service to start or sets it to start automatically. This may be the case with Trillian.

Cheers
Andy Bruin

Callender · 28 May 2020

Andy Bruin said:

Big thanks Callender for your feedback. This is really interesting as I didn't expect this and may be relevant to following posts following your initial post. Can you give us details about what Windows operation system and version is installed. I can help you find this info if necessary. Andy Bruin

I'm on Windows 10 Home 1903 64-bit and will post better details later when I return home.

Callender · 28 May 2020

In addition it should be noted that I've applied most tweaks shown here (and more):

Windows 10 Privacy Guide - May 2019 Update - Federico Dossena

Andy Bruin · 28 May 2020

Callender said:

In addition it should be noted that I've applied most tweaks shown here (and more):

Windows 10 Privacy Guide - May 2019 Update - Federico Dossena

Thanks Callender,

This is useful info in more ways than one. I have only a 32GB SSD on this laptop and since I don't use most of the Windows Stores Apps, and they take a fare chunk of the SSD, they are next on the chopping block. The article you referenced gives good info on how to do this.

Windows 10 Privacy Guide - May 2019 Update - Federico Dossena

It also gives good info on controlling some aspects of Windows Updates which is incidently what led me to this hidden task in the first place as I was examining the Task Scheduler logs to see how Windows Update and associated programs were managing to unset my update service settings. Think small SSD with only 5GB left, large 8GB Window updates, and an operating system that insists on trying to fit the 8GB update into free 5GB space without even asking you if its a good idea. NOT!!! :)

The above web link is also very well presented and gives me ideas for the help manual for this project.

Finally also it tells me why WpTasks.exe doesn't show a scheduled task on your computer.

The following is a partial screen shot from that page.

Hidden Task Revealer-removing_telemetry.jpg

The command "sc delete OneSyncSvc" actually deletes the service that creates the task schedule in question.

Just in case check the Services app (Services.exe) to confirm it no longer exists.

Thanks
Andy Bruin

Try3 · 28 May 2020

Andy,

So it looks like deleting /disabling the service OneSync is ~~the final~~ a solution. I suppose stopping that one will, after a reboot, stop its spawn OneSyncNNNN that you pointed out earlier on.

BUT

I think we need to hear again from @RaveBlack about whether or not that was necessary for avoiding further outbreaks. If not, it indicates that OneSync is not the cause but part of the transmission mechanism.

By the way, the only trace of App updates that I know of is their download record in Event viewer
Log - System
Source - WindowsUpdateClient
EventID - 19
This records the download of App updates and the installation of WU updates.

Denis

Callender · 28 May 2020

FYI:

Hidden Task Revealer-operating-system-details.jpg

Services and Scheduled Tasks. See attached.

Services Tasks.zip

Windows Updates: See here for my method:

Giving up on WIN10 Home

If space is an issue see:

Enable or Disable Reserved Storage in Windows 10

Enable or Disable Reserved Storage in Windows 10

Delete contents of C:\Windows\servicing\LCU - not the folder, just the contents.

How to clean files in C:\Windows\servicing\LCU

RaveBlack · 28 May 2020

I don't have OneDrive installed, so OneDriveSync was not a factor for me. I wouldn't rule it out for anyone else, though.