# Curious behavior by taskkill.exe/tasklist.exe



## Koenig30 (Sep 16, 2012)

Hi guys

I have run into a problem that i just cannot seeme to get to the root of, and im rarely resorting to posting on forums but i really need guidance from some people who might be able to help me bughunt where the problem could be.

here is a description of the problem :

I am running a .bat file that contains takkill /f /im command, and everything is fine and dandy, when running the .bat taskkill works like a charm , same when using a cmd for the command.

I do however use a system that allows me to launch the same .bat file through another executable. i use this system all the time for many batch launches in order to make many machines run the same batch file, and have had no problems with it whatsoever in the past, all it does is launch the same .bat file that have proven to work ok.

however when launching the .bat through the above system taskkill.exe gives the somewhat nonedesciptive error : "ERROR: The specified module could not be found".

I have tried tried many things in order to find out why the .bat command would give different results depending on how it is launched. If i try running tasklist.exe without arguments to just produce a list of processes, the result is the same and this makes me conclude that it is the actual executable (taskkill.exe/tasklist.exe) that refuses/fails to start when the .bat is launched through my system.

just for info i have tried to "cd C:\windows\system32\" before making that .bat launch, allso tried to specify the direct executable "C:\windows\system32\taskkill.exe" when invoking it all to no avail, i get the same error nomatter what i try when i launch it through my system.

I would really appreciate if anyone have input on how a .bat file can produce totally different results invoking tasklist.exe, depending on how it is launched, and what could be behind the "ERROR: The specified module could not be found".

Thanks


----------



## The_Janitor (Sep 10, 2012)

Do results change if you run the .bat file "as Administrator"?

Does Event Viewer log the error with any more detail?

Is this the only problem the machine has?


----------



## Koenig30 (Sep 16, 2012)

Hi, 

Thanks for your time 

.bat files does not have the option to run as admin, i did try to make a .lnk to the .bat and specify run as admin and this made no difference. 

No events i the log, checked them all to see if the tasklist reported a problem there.

I use same method to launch many other batfiles that bulkcopy files, edit registry settings, etc. and they all work flawlessly. The problem seems to only be with taskkill/tasklist but im suspecting that there might be other problems i just havent come across yet.

btw i have 90 machines all made from a masterghost, all with the same problem running this .bat file.


----------



## The_Janitor (Sep 10, 2012)

TSF Staff Member Jenae was "intriged" by this similar situation:

http://www.techsupportforum.com/for...tch-files-and-other-curiosities-651479-2.html

The OP there quit posting before a solution was found. Maybe she can take get involved in this thread? The situation reads to be near-identical.

Did this .bat file used to work, and then suddenly stop? Maybe a new Windows Update caused the problem?


----------



## The_Janitor (Sep 10, 2012)

This person attributes the cause of a similar problem to malware and a possible registry change.

Taskkill not working anymore - Tech Support Guy Forums

And in the earlier post I linked to, there was some conversation about PATH. I only have a fundamental understanding of .bat files, command line etc... but I wonder if you've lost a PATH statement pointing to maybe a .dll file taskkill needs?

Also, the suggestion to use SFC. Maybe you've had a system file replaced by a malware. Although I very much doubt you have the same problem on 90 different machines, which is why I thought Windows Update as it is a much more effective delivery system of malware than anything else in use.


----------



## Koenig30 (Sep 16, 2012)

Hi

Actually the first of the posts was the one that brought me to this forum  after countless hours trying to google the problem that was the closest i came to anyone having a similair issue and trying to solve it. i was first thinking about replying to that old thread but desided to try and make a new one instead as people might not be following it anymore.

The situations indeed seemes simulair and i suspect that it might be the same underlying problem as that original post.

Mine is somewhat different thou, i can actually start the .bat and use the cmd to kill a process with taskkill, and it works. The problem is only coming to surface when i try to start the .bat file from within another application.

I have never experienced anything as strange as this, have no idea where to look because i dont understand how this can even happen, and have no idea where to look for a solution. I just know i need to fix it because .bat files are essensial to run on my machines.

If Jenae would like to investigate the issue further with me, i would certainly welcome this as ive hit a brick wall , possibly for the first time ever - i usually find my answers pretty quickly but this one just have me baffled, lol.


----------



## Koenig30 (Sep 16, 2012)

To elaborate further, i have allso seen the other post you refer to during my googling, and i did experiment with "set path" without any luck. 

it _might_ be somewhere down this path that the solution lies, and i totally agree that i think maybe taskkill fails is because it fails to locate a dependancy .dll , and that might originate in some enviroment path string being wrong but this is so far deep into windows that i dont know the answer either. as i wrote i tried to cd into the taskkill directory before launching and that should eliminate the not finding dependency .dll but im not entirely shure of that.

what have me puzzled is that all enviroment setting should in theory be the same when i myself launch the .bat from desktop, or when an application that i have started launches it.

i know thousands of others uses this way of launching .bat files and none have ever experienced this problem, i have posted in their forum to but none have replyed to my question (a somewhat dead forum not very dedicated to the teknical stuff so doubt they can help anyway)


----------



## The_Janitor (Sep 10, 2012)

Koenig30 said:


> The problem is only coming to surface when i try to start the .bat file from within another application.


I would post in that other thread, on the chance that the OP there found a solution and simply didn't document it.

Can you try launching the .bat file from different applications? Maybe it's application-specific. Also, if the application is run with certain restrictions, such as non-Administrator, reduced permissions, restrictions on taking Window focus, etc...

Did it used to work, and then fail, or has it never worked?

It's best if you do the "quote, then answer" format.


----------



## joeten (Dec 4, 2008)

Hi I sent a pm to jenae to have a look in here if he is available so please be patient as he may be busy


----------



## Koenig30 (Sep 16, 2012)

The_Janitor said:


> Can you try launching the .bat file from different applications? Maybe it's application-specific. Also, if the application is run with certain restrictions, such as non-Administrator, reduced permissions, restrictions on taking Window focus, etc...


Beeing a programmer i can make a program myself that executes the .bat file and see if the same thing happens, im pretty sure that the application just issues a "CreateProcess()" to windows and points to the .bat . I will try that first thing tomorrow. I allso thought about restrictions might possibly be at the core of this, but in the process explorer, the application launching the .bat file is started by "Administrator" , should be no different than when i launch it manually.



The_Janitor said:


> Did it used to work, and then fail, or has it never worked?


I have allways launched .bat files this way and use it more or less every day allthough i think it is the first time i invoke taskkill.exe or tasklist.exe from within a .bat file.

I will try and make a post in the old thread allso to see if anyone responds to it.


----------



## joeten (Dec 4, 2008)

Please see my last post


----------



## Koenig30 (Sep 16, 2012)

joeten said:


> Hi I sent a pm to jenae to have a look in here if he is available so please be patient as he may be busy


Great, thank you  

i will still post in the old thread just to see if the original poster by miracle found an answer and reads the post.


----------



## joeten (Dec 4, 2008)

You might get lucky But don't hold your breath lol


----------



## The_Janitor (Sep 10, 2012)

Koenig30 said:


> I have allways launched .bat files this way and use it more or less every day allthough *i think it is the first time i invoke taskkill.exe or tasklist.exe from within a .bat file.*


So it is probable you've never seen the .bat file successfully launch either of these. This is nothing "new".

You have 90 machines running the exact same O/S. Can you try to run the .bat on a machine that wasn't installed with a (what did you call it?...) "ghost image".

Maybe it's the O/S's fault.


----------



## Koenig30 (Sep 16, 2012)

The_Janitor said:


> So it is probable you've never seen the .bat file successfully launch either of these. This is nothing "new".
> 
> You have 90 machines running the exact same O/S. Can you try to run the .bat on a machine that wasn't installed with a (what did you call it?...) "ghost image".
> 
> Maybe it's the O/S's fault.


I have no doubt that this is a problem caused by the OS. i have another location with 50 machines using the same system but with a different masterghost/OS installation. I will go there and try to run the .bat just to eliminate possibilities . 

i fully expect it to run with no problems thou.


----------



## The_Janitor (Sep 10, 2012)

Koenig30 said:


> i fully expect it to run with no problems thou.


I assume these "masterghosts" are the equivalent of an nLited disk, where you can preconfigure certain settings. Did you make them? Can you replicate the masterghost creation process and see if there are settings there that might cause this problem?

I'm fairly familiar with nLite, and there are a bunch of different settings you can mess with. Ah. An idea. There are certain Windows Services that you can turn on & off for default (Auto, Manual, Disabled).

What Services do TaskKill and TaskList require? Maybe your ghosted installs have Services Disabled/set to Manual that are normally Automatic by Windows Default.

http://www.techsupportforum.com/for...ess-rpc-service-unavailable-error-513947.html

The above may not be "on point", but it goes towards what I am trying to express. Perhaps in your case there is a necessary Service that is not running. Also note in the above thread they suggest creating a New User Account in order to test if the problem occurs. If the ghosted installs had pre-made user accounts, maybe the problem is User Account specific?


----------



## Koenig30 (Sep 16, 2012)

The machine installations are all made from one machine using symantec ghost, and i ghost the machines with a new ghost regulairly , so they have all received the same installation. This means that if there was a problem on the original installation, this problem will have been copied to all the machines. Allso i remember changing the administrator password on the masterghost and this may in some weird way have broken something ?

I have done some further digging that may shed some more light on things :

i have coded a small application to replicate the process of launching a .bat file through another application, just to eliminate the 3rd party launch tool beeing the problem and my little simple app reproduced the problem. 

let me just summerize things because we have discussed many things and this new information might get us closer.

1. the .bat file that i use for testing only contains 2 lines :

C:\Windows\System32\tasklist.exe
PAUSE

2. on my developer machine (and i suspect 99% of all machines) this .bat files works fine when run from the desktop. It allso works fine when run through my small custom made application that has the simple purpose of telling windows to run the .bat . 

3. on my target machines the .bat file can be run from the desktop and works fine, it gives me the process list in a cmd (this is why i dont think it lacks any services, it is able to run from the desktop).

4. only when launching this .bat file from another application, including my small custom made application the problems appears : 

C:\Users\Administrator\Desktop>C:\Windows\System32\tasklist.exe
ERROR: The specified module could not be found.

tasklist.exe somehow fails to start (i think you are right about it being a .dll dependancy error) when the .bat is not launched by windows explorer. so the problem must lie somewhere in the startup procedure for new processes. I assume that when i start my own little application, it has the excact same security rights as i do and should be allowed to run the tasklist.exe .


----------



## Koenig30 (Sep 16, 2012)

For test purposes i have attatched my small application so that you can test the functionality and confirm that it works as it should.

simply create a .bat file, open my small program, browse to and select your .bat and click execute and it spawns a cmd running the selected file.

(requires .net 4.0 as its coded in C#)


----------



## Koenig30 (Sep 16, 2012)

I tried to run sfc /scannow command and there was some repairs done to the system. The .bat still runs fine from desktop, but now i get a different error message when running it through my app : 

C:\Users\Administrator\Desktop>C:\Windows\System32\tasklist.exe
ERROR: Provider load failure

the plot thikens... googling


----------



## The_Janitor (Sep 10, 2012)

Koenig30 said:


> the plot thikens... googling


Me too. A lot of this is over my head, but lots of good information that might also be the problem.

Taskkill.exe question / error


----------



## Koenig30 (Sep 16, 2012)

i tried running the tasklist /S localhost, and when launched through my application it says :

C:\Users\Administrator\Desktop>C:\Windows\System32\tasklist.exe /S localhost
ERROR: The remote system must be running Windows 2000 or above.

pretty sure this is MS messing with my head here .. command works fine when launched from desktop


----------



## The_Janitor (Sep 10, 2012)

Koenig30 said:


> i tried running the tasklist /S localhost, and when launched through my application it says: C:\Users\Administrator\Desktop>C:\Windows\System32\tasklist.exe /S localhost ERROR: The remote system must be running Windows 2000 or above.


!!!

Read the link from my last post.

Taskkill.exe question / error



> For testing purposes you can try to set the CSDVersion value under [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows] to
> whatever is set on XP Pro (512).


They seem to be modifying the registry to indicate that XP is the O/S. Not sure if it actually is or not, but then later on in the thread:



> It appeared that the bug is already known:
> http://groups.google.com/group/micro...ab22066?hl=en&
> But obviously - not fixed in SP2.


What Service Pack (level) is installed on your 90 ghosted machines? Did you (Windows) Update after you ran "sfc /scannow" ?

I wonder if the error message changed because you "downgraded" your system files, and if you update will it fix the problem, or will you go back to the original error message?

Going to read the "known bug" link from groups.google now... (above)


----------



## Koenig30 (Sep 16, 2012)

I tried the command after reading your last post just to see what happened. i have disabled windows update on all machines because i have many many programs installed and to avoid update problems/conflicts, its disabled.

the CSDVersion is 0 on the bulk of machines , i do however have 1 of the machines fully updated and is reading service pack 1 installed. this machine is shoving CSDVersion 256.

i tried modifying it to 512 and 1024 , no changes.


----------



## Koenig30 (Sep 16, 2012)

Actually just realized that the updated machine gave the same error : Provider load failure. This is without me running the sfc / scannow command. So the updates have probably fixed the same things that the sfc command did. Not getting me any closer to a solution just a sidenote.

I somehow keep returning to this being the "WMI" that is faulty in the installation, but cant get a clear picture of what excactly WMI is or how to examine this, only sporadic references to it when googling and some clear warnings "do not mess with this" and "there is no repair button for WMI" .


----------



## Koenig30 (Sep 16, 2012)

Another update on the progress : the wmi indeed have an error code called 

WBEM_E_PROVIDER_LOAD_FAILURE 0x80041013 

taken from this list :

XGEN: Windows Management Instrumentation Error Return Codes

and that looks very much like the error tasklist.exe is throwing. i have no more time today, going to have to continue tomorrow. I think ill have to try the path of using procmon.exe to track what is going on under the hood. 

certainly not looking forward to it , this problem is killing me


----------



## Koenig30 (Sep 16, 2012)

aaaaaah might have finally poked a hole in this ones armor !! .. not there yet but this looks promising.

i traced my application through procmon.exe to see what the hell is beeing called. i can see that it at some point invokes cmd.exe located in the C:\windows\SysWOW64\ folder.

now ... if i specify in the .bat that it should use C:\windows\SysWOW64\tasklist.exe even explorer fails to run it , and with the same error message : "ERROR: Provider load failure"

So everything point to the fact that when directly specify that i want to execute tasklist.exe located in the C:\windows\system32 folder , explorer just executes it BUT when i try to launch the .bat file from anywhere else i am somehow beeing overruled !? and the system decides to use the version in SysWOW64 folder witch in turn fails.

whats up with having 2 different versions of cmd.exe/tasklist.exe/taskkill.exe ? and why/where the hell are this overruling taking place ?

going to continue tomorrow ... lol


----------



## joeten (Dec 4, 2008)

Since you have such a large amount of pc's you should be talking to your IT dept or a specialist


----------



## The_Janitor (Sep 10, 2012)

joeten said:


> Since you have such a large amount of pc's you should be talking to your IT dept or a specialist


I'd be willing to bet he *IS* the IT Dept, and the "specialist".

So it's a 32-bit vs. 64-bit situation? Back to the idea of PATH. What if you include a PATH statement aiming at the 64-bit tasklist.exe?


----------



## Koenig30 (Sep 16, 2012)

The_Janitor said:


> I'd be willing to bet he *IS* the IT Dept, and the "specialist".
> 
> So it's a 32-bit vs. 64-bit situation? Back to the idea of PATH. What if you include a PATH statement aiming at the 64-bit tasklist.exe?



You are absolutely right  i am the guy whos is supposed to fix this. I did some late night investigation and finally found the culprit as to why this situation had me so confused.

The thing that confused me most was the fact that batfile launches was working when beeing launched through explorer, but not when launched in any other way. It had me thinking that there had to be some enviroment difference that influenced the startup proces, because they both used a simple cmd to execute the .bat and what could possibly go wrong there ? 

This is where i was wrong... turns out that vista/win7 is making a hidden redirection of the folder %windir%\System32 to %windir%\SysWOW64 and provides no information that this redirection have taken place . it does not matter that i explicitly specify i want to use %windir%\System32 - win7 will at anytime overrule this and use the SysWOW64 folder if the startup call is originating from a 32bit application. You can read about this redirection procedure here : How to Suppress and Bypass System32 File System Redirect to SysWOW64 Folder with Sysnative » Tip and Trick

Microsoft have been so kind as to provide a virtual directory called %WINDIR%\sysnative\ . Its a nonexisting directory but if this directory is specified from a cmd, the redirection to 32bit folders are disabled and the call will go to System32 folder. i have succesfully made my batchfiles work with taskkill using the following :

if exist %WINDIR%\sysnative\taskkill.exe (%windir%\Sysnative\taskkill.exe /f /IM notepad.exe) Else (taskkill.exe /f /IM notepad.exe).

the sysnative dir is only visible when the .bat executes in a SysWow64 context, and if its visible , its redirected back to the System32 folder.

ok, so far so good, i can now launch my .batfiles from whereever and i have identified why there was a difference between the launches, but this is really just a walk around the real problem that is now identified : My SysWow64 folder is somehow corrupt.

the cmd/tasklist/taskkill applications located in the SysWoW64 folder should ofcourse be able to run taskkill just fine, same as their 64bit counterparts, but they are not. If just typing taskkill in the 32 bit cmd i am back to the error "the specified module could not be found" and this is the real problem.

The good thing is that im a lot less confused now  the bad thing is that this could be a serious problem with the installation and i still have a lot of work infront of me  .


----------



## Koenig30 (Sep 16, 2012)

Hi guys,

i just want to say thanks for all your help, when banging the head into the wall :banghead: it really helped me beeing able to discuss possible origins of the weird behavior , and this was for sure one of the fun ones. Who the ... ever heard about some secret C:\windows\sysinternal folder reference  

Im not the one who originally installed the machines, and i might be looking at a complete reinstall on all machines depending on wether or not im able to repair the SySWoW64 folder, but this is not my decision, and a hole other problem in itself. 

Im closing off this as i feel we have identified the problem as a corrupt SysWoW64 installation.

Thumbs up to TSF for not shying away from what i consider a hairy support/help. I never knew you existed but i will for sure be back and i promise i will carry on the tourch and help some other poor ******* who is banging his head into the wall :banghead: at some point :grin:

Thanks :smile:


----------



## The_Janitor (Sep 10, 2012)

This is the best tech support site on the whole internet. Glad you got it fixed. Hope the extensive documentation helps someone else.


----------



## joeten (Dec 4, 2008)

Nicely done both of you


----------

