Task

[sggaunt]

I noticed the other day that one of my programs installed on a test machine seems to have an associated scheduled task that I did not set up.
The exe was simply copied onto the machine, no installer involved
Compiled with Delphi XE (version 1)

This is the code that seems to be accosted with it found in System32/Tasks. File name is just numbers similar to a CLSID
There is no reason why a start-up task should happen, any idea's?

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="[URL unfurl="true"]http://schemas.microsoft.com/windows/2004/02/mit/task">[/URL]
  <RegistrationInfo />
  <Triggers>
    <RegistrationTrigger>
      <Enabled>true</Enabled>
    </RegistrationTrigger>
  </Triggers>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>false</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Users\Steve\Batt Tester\BatteryTestProject_DirectComms.exe</Command>
    </Exec>
  </Actions>
  <Principals>
    <Principal id="Author">
      <UserId>STEVE-PC-4\Steve</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
</Task>

Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain
That's just perfectly normal Paranoia everyone in the universe has that: Slartibartfast

 

[DjangMan]

Are you sure that the program hasn't been infected with something? C:\Users\Steve\Batt Tester\BatteryTestProject_DirectComms.exe

 

[sggaunt]

Running some scans....
Avast Says No
Malware Bytes says No
SuperAntiSpyware says No
HiJackThis Log appears to be OK
McAfee Stinger say No
56 Scanners on Virus Total all said No,
so I guess that it isn't infected?


Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain
That's just perfectly normal Paranoia everyone in the universe has that: Slartibartfast