0

Running Windows Server 2008R2 as a Remote Desktop Session host. I noticed a while ago that there are tons of tasks being created in Task Scheduler. These are not created by the users themselves.

Today, I noticed a user who had 100s of rundll32.exe process with the command line of:

c:\windows\system32\rundll32.exe c:\windows\system32\pcwutl.dll,CreateAndRunTask -path "\\server\programs\program.exe"

What the heck? Anybody knows why Windows is doing that?

The program being run is an old VB 6 program, if that matters. It's run from a shortcut the users have on their desktop which points to the .exe on a network share. I haven't seen the code of that program in a long long time but I don't recall it doing anything special, out of the ordinary.

Also, there are actually in Task Scheduler, some tasks for program #1 and some for program #2 - both are old VB 6 programs. Some of the task start the program through the network share, some from the local drive (I have the program in two places and some users have shortcuts pointing to local drive, some to network share).

The tasks in Task Scheduler are named with a UUID of some sort. The task is marked with the following options:

  • Run only when user is logged on
  • Trigger: At task creation/modification
  • Action: start a program (the program described above)

New data

According to the file information, the DLL is the Program Compatibility Troubleshooter Helper. Still don't know why it does that...

0

A basic Windows2008+ installation has tens of pre-scheduled task for various activities, and yes, sometime they remain "stuck" for whatever reason.

rundll32.exe is a dll used as an "entry point" for launching many system-related tasks. For example, many control panel applets relay on it launch/work. As you found, it is heavily used for scheduled tasks also.

Back to your original question: yes, it is normal for Windows to have many scheduled task and to launch them with rundll32.exe. However, only you can tell if the scheduled VB6 programs are good/bad and if they should be launched with different options.

  • These tasks are created on their own. If I delete them, they get created again. All the task does is start the program. It's as if instead of starting the program, Windows creates a task to start it. – ETL Oct 29 '15 at 18:55
  • It is probable that the task entries are created programmatically from the very VB6 program (or its launcher wrapper, if any) – shodanshok Oct 29 '15 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.