BleepingComputer.com: tasklist.exe critical error

Hi,

I recently learned of the existence of tasklist.exe (as in the tutorial about SVCHOST, http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchost.exe-process/ ), and decided to give it a try... In WinXP Pro SP2, running C:\WINDOWS\System32\tasklist.exe, I get the following error:

Loading the tasks information ... --ERROR: Critical error.

Searching online, I can't seem to find any information about this error or how to fix it... I've restarted my computer, no difference. I can see processes listed in CTRL-ALT-DELETE Task Manager just fine, so nothing is completely preventing me from viewing running processes. Doing a search for the file, I found that it shows up in two different places, the second being:

C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tasklist.exe

I've run both files through Norton Antivirus, Spybot Search & Destroy, and Lavasoft Adaware and none of those found any problems. I don't have any particular reason to believe that my computer has any sort of virus/malware, but this error sounds fishy to me... Is there any way to fix this and/or should I be concerned by this? Any suggestions would be appreciated, thanks!

~HLJ

You may try to replace the first one with the second one, but we need to know, if those files match...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
  
• Copy the content of the following box into the main textfield:
  

  :filefind
  tasklist.exe

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

It should show up in more places than that - of course in c:\windows\system32.

If all your Windows File Protection stuff is working, it should also be at least in c:\windows\system32\dllcache and usually in c:\windows\servicepackfiles\i386. If you don't see it there, you have another problem too.

There is no reason I can think of for it to be in your second list location - that looks like some temporary installation folder. That is how Windows names temporary folders - something like b5193501484cf5e6884fa1d22f9e

It really doesn't matter about the other location though - it should only be running from only one place and that is:

c:\windows\system32.

To see your error message, are you running tasklist.exe from a command prompt while in the c:\windows\system32 folder with no arguments, or just how are you running it?

Search for just a file called tasklist (with no .exe extension) and see if there is some bogus copy someplace - like perhaps tasklist.cmd or tasklist.bat

Does tasklist.exe /? give you the usage information?

Here is what all 3 of my XP Pro SP3 c:\windows\system32\tasklist.exe files looks like from a dir command and they all work the same:

04/14/2008 04:42 AM 77,824 tasklist.exe

This post has been edited by joseibarra: 19 January 2010 - 07:02 AM

Alright, so here's what I've got...

From SystemLook.exe:

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 00:21 on 20/01/2010 by HLJ (Administrator - Elevation successful)

========== filefind ==========

Searching for "tasklist.exe"
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tasklist.exe	--a--- 77824 bytes	[20:43 16/08/2009]	[00:12 14/04/2008] E8B108654C5789AD3F75E08B0A89C609
C:\WINDOWS\system32\tasklist.exe	--a--- 72192 bytes	[08:00 04/08/2004]	[08:00 04/08/2004] 70363A3228DF8FC8CFF4E78F36B31C45

-=End Of File=-

Strange that the two files have different sizes?

This is what I can do in the command line:

C:\>C:\WINDOWS\system32\tasklist.exe
Loading the tasks information ... |ERROR: Critical error.

C:\>tasklist
ERROR: Critical error.

C:\>C:\WINDOWS\system32\tasklist.exe
ERROR: Critical error.

The output message seems to vary sometimes?

Usage message seems to be ok, from what I can tell:

C:\>C:\WINDOWS\system32\tasklist.exe /?

TASKLIST [/S system [/U username [/P [password]]]]
		 [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
	This command line tool displays a list of application(s) and
	associated task(s)/process(es) currently running on either a local or
	remote system.

Parameter List:
   /S	 system		   Specifies the remote system to connect to.

   /U	 [domain\]user	Specifies the user context under which
						   the command should execute.

   /P	 [password]	   Specifies the password for the given
						   user context. Prompts for input if omitted.

   /M	 [module]		 Lists all tasks that have DLL modules loaded
						   in them that match the given pattern name.
						   If the module name is not specified,
						   displays all modules loaded by each task.

   /SVC					Displays services in each process.

   /V					  Specifies that the verbose information
						   is to be displayed.

   /FI	filter		   Displays a set of tasks that match a
						   given criteria specified by the filter.

   /FO	format		   Specifies the output format.
						   Valid values: "TABLE", "LIST", "CSV".

   /NH					 Specifies that the "Column Header" should
						   not be displayed in the output.
						   Valid only for "TABLE" and "CSV" formats.

   /?					  Displays this help/usage.

Filters:
	Filter Name	 Valid Operators		   Valid Value(s)
	-----------	 ---------------		   --------------
	STATUS		  eq, ne					RUNNING | NOT RESPONDING
	IMAGENAME	   eq, ne					Image name
	PID			 eq, ne, gt, lt, ge, le	PID value
	SESSION		 eq, ne, gt, lt, ge, le	Session number
	SESSIONNAME	 eq, ne					Session name
	CPUTIME		 eq, ne, gt, lt, ge, le	CPU time in the format
											  of hh:mm:ss.
											  hh - hours,
											  mm - minutes, ss - seconds
	MEMUSAGE		eq, ne, gt, lt, ge, le	Memory usage in KB
	USERNAME		eq, ne					User name in [domain\]user
											  format
	SERVICES		eq, ne					Service name
	WINDOWTITLE	 eq, ne					Window title
	MODULES		 eq, ne					DLL name

Examples:
	TASKLIST
	TASKLIST /M
	TASKLIST /V
	TASKLIST /SVC
	TASKLIST /M wbem*
	TASKLIST /S system /FO LIST
	TASKLIST /S system /U domain\username /FO CSV /NH
	TASKLIST /S system /U username /P password /FO TABLE /NH
	TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

I haven't tried running tasklist.exe from the downloads folder since I'm not sure how safe that would be... I looked at my environment PATH variable, didn't see anything suspicious there. I did do a search for "tasklist" already (that was how I found the one in the downloads folder). The other two files I saw are:

C:\WINDOWS\Prefetch\TASKLIST.EXE-10D94B23.pf
C:\I382\TASKLIST.EX_

In response to Jose, I have no c:\windows\servicepackfiles\i386 folder. The dllcache folder in c:\windows\system32\dllcache seems unusually hidden, though... I have options set to show hidden files, but that one doesn't appear either in the GUI folder browser or when I execute the command "dir C:\WINDOWS\system32", although I know it exists because I can type in that folder to find files in there and running the ls command (through Cygwin) does list the dllcache folder. Is this something else I should be concerned about?

I'm still pretty clueless about what might be causing this problem, so any thoughts are appreciated. :-)

~HLJ

Quote

The original file is 5 years older, than the other one. It looks like the newer one came with some Windows updates.

Let's try to replace the older one with the new one.

1. Please download The Avenger to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
  
• Follow the prompts and extract the Avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to move:
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tasklist.exe | C:\WINDOWS\system32\tasklist.exe

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
  
• On reboot, it will briefly open a black command windowon your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also back up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply

Are you running XP under Cygwin, some kind of virtual machine environment (VMware, etc.) or some Linux environment?

You mentioned Cygwin - help us understand how Cygwin comes into play with your XP environment. Some of the other things you mention are not adding up here.

Somehow I think think tasklist.exe will not run on an XP VMware virtual machine. Maybe somebody else can try it.

Please provide additional information about your system.

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select All, Copy and then paste
the information back here.

There will be some personal information (like System Name and User Name), and whatever appears to
be private information to you, just delete it from the pasted information.

This post has been edited by joseibarra: 20 January 2010 - 10:10 AM

I haven't had a chance to run The Avenger yet (I'll let you know as soon as I get the chance for that), but I can at least respond to Jose's comments...

First off, sorry for the confusion caused by mentioning Cygwin... My computer is Windows XP as I've already described (it's exactly what came already installed on my laptop when I bought it new from HP, I haven't installed any other operating systems). Cygwin, the way I understand it, just adds some programs that act like their Unix equivalents (ex. ls.exe produces the same output that the Unix ls command would produce, it just happens to be able to run on a Windows machine). cygwin.com provides a more technical description. I'm pretty sure Cygwin should have no relation to this problem because Cygwin shouldn't have installed anything by the name of tasklist (otherwise I would have seen it when I searched).

I'm a little scared by msinfo32 though... Here's what I get:

Can't Collect Information
Cannot access the Windows Management Instrumentation software. Windows 
Management files may be moved or missing.

Uhh... So what does that mean? :-\

Also, in response to Broni, would it be reasonable for me to try running the tasklist.exe executable from the downloads folder first? I'm not completely comfortable with running some random software [Avenger] that's going to mess with my system files until I have the time to make backups first (just to be safe, can't always trust the internet ;-)...

Quote

Sure thing

I don't know if Cygwin has anything to do with your tasklist issue or not and am not even sure if you are saying you have it on your system, but a quick Google search of cygwin xp tasklist reveals nuggets like this:

Quote

Useful description!

If you have XP Pro installed and you only found tasklist.exe in those two places you listed, that is most curious.

The msinfo32 problem I have seen before and this generally works on systems that are less curious:

To resolve this behavior, delete and then recreate the files in the %SystemRoot%System32\Wbem\Repository folder.

On the Desktop, right-click My Computer, and then click Manage.

Under Services and Applications, click Services, and then stop the Windows Management Instrumentation service.

If asked about stopping other services (Windows Firewall/Internet Connection Sharing (ICS)), respond in the affirmative. You can consider disconnecting from the Internet since the Windows firewall will be disabled temporarily.

Delete all of the files and folders that are in:

c:\Windows\System32\Wbem\Repository

They will be recreated when you reboot.

Immediately restart the computer so the Windows firewall will be restarted.

The Repository folder information is recreated when the computer restarts.

Try msinfo32 now.