Task Scheduler error

Topic

New Reply

Friday morning I tried a system restore to fix a Word 2010 click-to-run issue. I quarintined c:\progra~2\common~1\micros~1\virtua~1\cvh.exe when it showed up in my Panda Dome process monitor because before then I had never realized it ran every time Word. After some quick googling and realizing that Word c2r wouldn’t open with the file blocked I unquarantined the file (it was in Panda Dome’s lost&found folder but I never could get it to restore to its original location), which is what lead to an attempted system restore. The restore failed but I fixed the Word issue by letting Windows scan for the file after trying to open ms word. That seemed to be the end of my issues until I opened the task scheduler that night to make sure the Adobe Reader update task was disabled. When I opened TS i got this error message: The selected task “{0}” no longer exists. To see current tasks click Refresh. I clicked ok and instantly got this: Task scheduler service is not available. Task scheduler will attempt to reconnect to it. (The task scheduler service was and is running)  Again I clicked ok only to get the original “{0}” error message again. After clicking ok the third time the error messages went away but the task status pane said reading data failed. I decided to check the tasks to see if I could find anything wrong. The appid task, autochk, certificateserviceclient (more on that one in a second) mui and the systemrestore task would all throw up the “{0}” error message when clicked and then every task clicked would show up as being empty after that until the task scheduler is closed and reopened. But the certificateserviceclient will show its tasks after clicking ok on the error if it is the first error giving task clicked. I know this won’t be a simple fix but any help or direction will be greatly appreciated

Reply | Quote

Replies

Have a look in Services tab (right click on the Task Bar, Task Manager) at the “Schedule” task. Is it running?

cheers, Paul

Reply | Quote

The schedule task is running, that’s what makes this even weirder because the way these errors make it seem is that the schedule task should be stopped and from what little I can tell I don’t think that ever happened.

Reply | Quote

Try doing the System Restore again, but from Safe Mode. A lot of times this will work, if doing so failed under Normal Mode.

If the above doesn’t work, then you and the experts here should look at this Technet article:

Task Scheduler Corrupt Tasks

All tasks are stored under System32\Tasks, and registry entries for them are stored under:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

 

Reply | Quote

@GoneToPlaid Thanks for the link, the only problem is that I don’t have any restore points now (I read something about stopping and restarting the restore service during my initial panic) and I also don’t have access to another computer running windows 7 home premium. Or to be perfectly honest, another computer at all.

Reply | Quote

All my computers are Win7. I have to head out for work. This evening I will post a possible solution since you no longer have any restore points.

Reply | Quote

Thank you in advance for even trying to help

Reply | Quote

Hi moonbear,

I have been really busy. Yet I have been thinking about your issue and how to fix it. It appears that there are two things which we will need to fix. One thing is the registry settings, and the other thing is the task files which are in a folder which you will need to give yourself permission to access on your computer. I will follow up once I have more time to evaluate your situation if the following doesn’t work…

You mentioned that you quarantined an Office 2010 file called c:\progra~2\common~1\micros~1\virtua~1\cvh.exe which would have originally been located in a Program Files (x86) sub-folder.

Please go to Control Panel >> Programs and Features. Under the list of installed programs, highlight your Office 2010 installation and see if you can then select Change at the top of the list. My hope is that if Change shows up, then you can then select to perform a repair your Office 2010 installation. This might fix cvh.exe and its associated task in Task Manager.

The reason I suggest the above is that Panda has a known issue in which Panda sometimes does not correctly restore the original file’s attributes when a file is restored from quarantine, let alone restore the file to its correct original location. Obviously Panda needs to somehow properly record the file attributes, date and time stamp, and the 8.3 location of any file which Panda is about to quarantine, so that a restore from quarantine will be successful.

Please let me know whether or not you were able to perform a repair of your Office 2010, and whether or not doing so fixed your task manager issues.

Best regards,

–GTP

 

Reply | Quote

Thank you for the detailed response, I’m a detail oriented person so that helps more than you could know. I tried that very thing after I couldn’t get the file or the system to restore, it seemed to have worked but then I clicked the click-to-run application manager and I got an error for that saying it was missing and couldn’t be opened. So even though I could open Word and Excel I don’t know if they would have ran with any stability for any length of time or not. Since the C2R application manager was also having issues I thought that maybe if I removed these programs it just might kick-start the Task Scheduler back into working, unfortunately this was not the case. As annoying as this has been, I’m trying to view it all as a learning experience. Before this happened I never even knew there was a way to break the Task Scheduler. So if I have to go into the registry to fix part of this I’m not that worried as long as I know exactly what I’m looking for. (which is why I panicked when this issue first started because it seemed like something that couldn’t be fixed at all.)

Reply | Quote

@GoneToPlaid

I’ve been digging to see if I can find any more information on how to fix my Task Scheduler. I haven’t found anything that gave any new info directly on my issue (I actually had to stop because everything I was reading had all began to blur together and after awhile I started to see the same results for all of my searches) but I did find a couple interesting things. The first thing I found is that this seems to be a more common issue than would be expected. One of the Microsoft answer threads I read through was started in 2010 and ran over 15+ pages (spanning until 2018 when the thread was locked with no real answer) of people with basically the same issue I’m experiencing. How is there not something that Windows runs in the background to make sure things like this don’t happen? I also read about how when things like this do happen the event viewer will show an error but the system won’t show this to the user. The last thing I found were a couple people saying that they had been trying to fix their Task Scheduler for an extended period of time (one of the posts said that the person had not noticed there was anything wrong for 6 months.) If this kind of issue can go unnoticed for such a long time, does this not effect things like installing windows updates?

Reply | Quote

Moonbear wrote:

The selected task “{0}” no longer exists

The implication is that you have a task with a corrupt UUID.

Do you have a weird entry under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks?
Normally you’d see a bunch of UUIDs.

cheers, Paul

Reply | Quote

I ran down the list of UUID for the tasks, one of them doesn’t have any information except for:
name default
type reg_sz
data (value not set)
I don’t know what that should be attached to so I can’t tell if this could be the problem or not.

Reply | Quote

Is this what you mean?

cheers, Paul

Reply | Quote

Yes, that’s what it looks like. But should an entry with a UUID show up that way?

Reply | Quote

You can use this tool to view all tasks (including hidden tasks) and change/edit/remove the broken task.

https://www.nirsoft.net/utils/task_scheduler_view.html

You will still need to try to figure out what task is causing the issue, but this at least will let you see them.

~ Group "Weekend" ~

1 user thanked author for this post.

Moonbear

Reply | Quote

I’ve found 3 tasks with a status of unknown, what does this mean?

Reply | Quote

@NetDef After I found the three tasks with unknown status, I tried to open TaskSchedulerView.chm to see if the help files could tell me what seeing unknown as a task status meant. As soon as I double clicked it my Panda Dome popped an alert saying it had neutralized a virus. I ran TaskSchedulerView.chm thru virustotal and it came back clean. The process monitor in Panda Dome also showed hh.exe as a high risk (and unblock-able) process. I’ve read about nirsoft applications making AV programs throw out false positives, so should I worry about this?

Reply | Quote

Nirsoft applications do sometimes trigger AV false positives, although in your case the culprit appears to be Panda complaining about the Microsoft help file handler.

Also possible that you have a trojan that has tried to replace HH.EXE . . . this is a thing (not common these days.)

RE: Unknown status tasks: Very likely that these are your corrupt tasks. Can you list their names here from the Nirsoft tool?

~ Group "Weekend" ~

Reply | Quote

Ok, I did run Panda Cloud Cleaner, it caught and removed 2 “hijackers”, after seeing that I ran Malwarebytes free, it came back clean. Should I try anything else? The unknown tasks are Proxy (Autochk) SR (SystemRestore) and VerifiedPublisherCertStoreCheck (AppID).

I went and searched for HH.exe, on my machine it shows up as hh.exe (no capitol H’s) does this matter?

Reply | Quote

Hi moonbear,

Sorry that I have been very busy with work. I still am knee deep in alligators, yet I have a few minutes.

I have two versions of hh.exe on my computers. One is in the Windows folder and the other is in the SysWOW64 subfolder. Plus there are other copies in some update installer folders.

I just downloaded and tested both the 32-bit and 64-bit versions of Nirsoft’s TaskSchedulerView utility. Panda’s Process Monitor listed hh.exe as secure when I opened the TaskSchedulerView.chm help file, and listed TaskSchedulerView.exe as secure when I ran it. It listed both as zero risk.

The upshot is that opening the .chm file called on hh.exe to open the file. The further upshot is that Nirsoft’s TaskSchedulerView utility shouldn’t have triggered anything in Panda. Yet note that when hh.exe was called, it did unexpectedly trigger a high risk alert in Panda. That definitely should not have occurred, no matter what legitimate versions of hh.exe are installed on your computer.

My guess is that the malware infections on your computer go deeper than you realize. It is also disturbing that you no longer have any restore points?

Best regards,

–GTP

 

Reply | Quote

I did manage to remove 2 things from my system with Panda Cloud Cleaner (PCC called them hijackers) my follow up scan with Malwarebytes (free) came back clean so I don’t know where to go from here. As for the restore points I manually created one last Thursday as a test. Something I just now noticed when I opened Pandas process monitor is that the same instance of hh.exe that threw out the high risk alert now shows as secure. How or why would that change? Running the TaskSchedulerview.chm thru VirusTotal didn’t send back any hits either. Something else that may be important is that the virus that was detected was shown in the Panda event report as being W32/Exploit.gen. I’m hoping this turns out to be a false positive but I won’t be surprised if its not.

Reply | Quote

As of 10:40 p.m. I finished a default scan with HitmanPro that showed 0 threats and 0 traces. Since neither Malwarebytes or HmP found anything, I am out of ideas at this point.

1 user thanked author for this post.

GoneToPlaid

Reply | Quote

Okay, so Hitman Pro comes up clean. That there might allow us to try to fix your Task Scheduler issues. Yet first, you need to try to successfully create a System Restore point.

Reply | Quote

I successfully created a manual restore point at 6:22 a.m. this morning in the System Protection area

Reply | Quote

Have you considered summiting your HH’s to virustotal? Might tell you something. Also Malware can at times control results. If you could, use a live PE flash drive from an antivirus maker. You can find a list here:
https://www.lifewire.com/free-bootable-antivirus-tools-2625785

Reply | Quote

Moonbear wrote:

should an entry with a UUID show up that way?

No, it should have information. Back up the entry – right click, Export – and then delete the entry. Restart and let us know.

cheers, Paul

1 user thanked author for this post.

Moonbear

Reply | Quote

I followed your directions and I think it worked. My PC was rebooted a little over an hour ago, nothing shows up in the Event Viewer for the task scheduler and I can open the task scheduler with no error messages. So far everything seems back to normal. Is there anything else I should check?

Reply | Quote

Moonbear wrote:

Is there anything else I should check?

You need to make sure the money is in the post.

cheers, Paul

Reply | Quote

Ok, I’ll get right on that. you’ve been a massive help. But now I think have an even bigger problem. if I go to the properties of my system32 folder and click security every entry under Group or user names except for the Users entry which has Read & execute are all listed as having Special Permissions, is this normal? I did open system32 a couple weeks ago because I wanted to see if all the Task files were still in the Tasks folder. Update: The Tasks folder shows the same except the entry labeled PC (the computer was never renamed after updating to windows 7) which has full control. I never knowingly changed any of these permissions.

Reply | Quote

Are you seeing gray or black check marks for Special permissions for the System32 folder? On my Win7 computers, I see gray check marks for Special permissions for the following groups:

CREATOR OWNER
SYSTEM
Administrators
TrustedInstaller

No Special permissions at all for anything else.

Reply | Quote

This is what I see

Creator Owner special grayed out

System special grayed out

Administrators special grayed out

Users black checks no special

TrustedIstaller special grayed out

This is the first screen, do you want the advanced screen as well?

I just realized I left out an important detail, everything shows as having Special Permissions only in the Advanced menu.

Reply | Quote

Gray indicates the permission is inherited, black means “set here”.
Special permissions aren’t an issue unless you changed something and now things are not working.

cheers, Paul

Reply | Quote

Ok, that part I understand. But as stated in my post above (#1214649) I also opened the system32 and tasks folders a couple weeks ago. And I can’t tell if that changed anything.

I had opened those folders because I had found a post on a Microsoft answers forum that sounded like it could fix my problem. This is that post (I’m sorry its the whole post and not just a link.):

I’ve been struggling with the “The selected task “{0}” no longer exists. To see the current task, click refresh” error for a long time.

It first happened on a new Win 7 64-bit pc within a month or 2. I searched the internet and nothing truly fixed the problem. Yes, I could remove the xml files from “C:\Windows\System32\Tasks” but now I was left with missing tasks that were probably important. At that time I just formatted and reinstalled everything.

The problem happened again a few years later (in 2013) and once again I scoured the forums and tried every suggestion only to fail at every attempt at fixing this. I finally formatted and reinstalled everything again (after 130 Windows updates :-).  Somewhere in reinstalling my software on a brand new install, the task scheduler started with its dreaded errors AGAIN! And my scheduled backups wouldn’t run.

Not wanting to format/reinstall one more time, I ran across this thread. DennisAd’s idea inspired me, but I didn’t really want to go through all the pain of carte blanche uninstalling and reinstalling every task. So I tried, and succeeded, at doing almost the same thing manually. In the end the “pain” level is probably just as high, but I didn’t have to mess with the registry. I hope this helps someone out there since Microsoft clearly is incapable/doesn’t care.

1. This assumes that your system, like mine, has all the XML files under c:\windows\system32\tasks intact. The real problem is in the registry.
2. Determine which tasks are causing the problem by opening task scheduler and going through every task subfolder. This has been detailed by several others in other forums.
a. As you hit each subfolder you will sometimes get more error messages. Stop and go to the windows tasks folder as mentioned above. Add an underscore, or something you’ll recognize to each offending task. Don’t delete the task file!
b. Close task scheduler and reopen it after you rename each offending task. Each time you should be able to get farther down the subfolder tree. The renamed tasks have now disappeared and won’t cause errors.
c. When you open task scheduler, and have no errors, continue to the next step.
3. Now you have a bunch of task files under c:\windows\system32\tasks that have an underscore at the end, and you have an error free task scheduler with missing tasks.
4. Add the missing tasks back to task scheduler.
a. Find each task that was renamed on your c: drive and go to that same location in task scheduler.
b. Select “Import Task…”
c. In the window that pops up, change the drop-down menu from “XML” to “All Files”
d. Find the appropriate task file that has the underscore and select it.
e. In the new task window that opens, remove the underscore from the “name”.
f. Click OK.  The task has now been restored.
g. On the C: drive, remove the file with the underscore.

I followed every step but I think all it did was make the error messages go away because once the computer was rebooted the errors returned. Did I misread something here? Did I not need to actually open the folders at all? I’m only mentioning this now for 2 reasons: A. At the time I tried it I was extremely frustrated and felt very very stupid for thinking it could/would be that easy. And B. I didn’t think anything more of it until yesterday when I realized I could still open the system32 and tasks folders, which is what lead to my post yesterday.

Sorry for the extremely long post.

Reply | Quote

You have changed the permissions of the Tasks folder, these changes are permanent.
Opening the Tasks folder is fine IME, I’ve not seen issues relating to this change – or other “hidden” folders.

As always, YMMV and backup.

cheers, Paul

Reply | Quote

Ok, that makes me feel a little better. I have noticed something else strange now that I’m able to open and use the task scheduler again. When the SystemRestore (SR) task runs, it only runs for 1 second and never creates a restore point. Is there any reason for this to happen?

Reply | Quote

No idea. Can you create a manual restore point?

cheers, Paul

Reply | Quote

Yes, I created one just before typing this. The fact that the manual creation still works honestly makes this weirder to me.

Reply | Quote

The task should produce an entry in the Event Log. Check for errors there.

cheers, Paul

Reply | Quote

I am tackling a similar set of problems, and wasn’t able to verify entries in the Event Viewer because it also had a problem and couldn’t be run! Windows Event Log service gave me a 4201 error.
Task Scheduler, among other things, are greatly dependent on it.

From what I’ve seen most of the problems arise from mismatched entries in the registry compared to the Tasks directory in the System32 folder.

If the Windows Event Log isn’t starting properly, you may have a corrupt Repository or bad permissions set in the Log directories.

Reply | Quote

Are you asking for help or giving us a solution? It’s not obvious to me from your post.

cheers, Paul

Reply | Quote

Both!
In case his issue is related to the Event Viewer, he should investigate it first.
But if finds his Event Viewer in good health, then it’s on to the next issue I believe we both share.
Which as far as I can tell is infact related to a mismatch between Task registries and Task files, which can often be seen through Autoruns, and potentially CCleaner.

Reply | Quote

Try the Nirsoft FullEventLogView to confirm the issue is with the Event Logs and not the viewer.

cheers, Paul

Reply | Quote

I did mention that I was entirely unable to start the Windows Event Log service, so yes the problem was with the Event Log and not simply the Viewer, but the same symptoms existed at the viewer because of its dependency on the log service.

I don’t think a utility is required to see if the Event Log is at least running….

Can also see Task Registry/File mismatches in autoruns for the Task Scheduler missing tasks.

Reply | Quote