Taskhost.exe looking suspicious in Process Explorer
I'm thinking I have a virus on my Windows 8 (x64). I downloaded and opened Process Explorer (Sysinternals) and started analyzing the running processes.
I came across taskhost.exe and saw it did not have a Description nor a Company Name. When I opened the details, it show the dialog below. This looks very suspicious, I thought.
So I searched for it and came across other people exploring taskhost.exe with process explorer. On the link below is someone showing taskhost with the dlls it is using. Mine show no dlls at all.
http://www.pcworld.com/article/244864/why_is_taskhost_consuming_so_much_of_my_cpu_.html
While I was typing this, I noticed an other taskhost.exe spawned.
Is this a virus? I ran AVG multiple times but it did not find the thing. I can't run it specifically on this file because it can't be found.
Any help is welcome.
windows malware
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
add a comment |
I'm thinking I have a virus on my Windows 8 (x64). I downloaded and opened Process Explorer (Sysinternals) and started analyzing the running processes.
I came across taskhost.exe and saw it did not have a Description nor a Company Name. When I opened the details, it show the dialog below. This looks very suspicious, I thought.
So I searched for it and came across other people exploring taskhost.exe with process explorer. On the link below is someone showing taskhost with the dlls it is using. Mine show no dlls at all.
http://www.pcworld.com/article/244864/why_is_taskhost_consuming_so_much_of_my_cpu_.html
While I was typing this, I noticed an other taskhost.exe spawned.
Is this a virus? I ran AVG multiple times but it did not find the thing. I can't run it specifically on this file because it can't be found.
Any help is welcome.
windows malware
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30
add a comment |
I'm thinking I have a virus on my Windows 8 (x64). I downloaded and opened Process Explorer (Sysinternals) and started analyzing the running processes.
I came across taskhost.exe and saw it did not have a Description nor a Company Name. When I opened the details, it show the dialog below. This looks very suspicious, I thought.
So I searched for it and came across other people exploring taskhost.exe with process explorer. On the link below is someone showing taskhost with the dlls it is using. Mine show no dlls at all.
http://www.pcworld.com/article/244864/why_is_taskhost_consuming_so_much_of_my_cpu_.html
While I was typing this, I noticed an other taskhost.exe spawned.
Is this a virus? I ran AVG multiple times but it did not find the thing. I can't run it specifically on this file because it can't be found.
Any help is welcome.
windows malware
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
I'm thinking I have a virus on my Windows 8 (x64). I downloaded and opened Process Explorer (Sysinternals) and started analyzing the running processes.
I came across taskhost.exe and saw it did not have a Description nor a Company Name. When I opened the details, it show the dialog below. This looks very suspicious, I thought.
So I searched for it and came across other people exploring taskhost.exe with process explorer. On the link below is someone showing taskhost with the dlls it is using. Mine show no dlls at all.
http://www.pcworld.com/article/244864/why_is_taskhost_consuming_so_much_of_my_cpu_.html
While I was typing this, I noticed an other taskhost.exe spawned.
Is this a virus? I ran AVG multiple times but it did not find the thing. I can't run it specifically on this file because it can't be found.
Any help is welcome.
windows malware
windows malware
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
edited Jan 11 '13 at 13:12
Ramhound
20.2k156085
20.2k156085
asked Jan 11 '13 at 12:27
FonsFons
2837
asked Jan 11 '13 at 12:27
FonsFons
2837
asked Jan 11 '13 at 12:27
FonsFons
2837
2837
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30
add a comment |
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30
add a comment |
1 Answer
1
active
oldest
votes
Relevant answer: https://serverfault.com/questions/448440/how-do-i-determine-what-taskhost-exe-is-doing
Summary: It's the Reliability Analysis Collection task.
edited Apr 13 '17 at 12:14
Community♦
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f532560%2ftaskhost-exe-looking-suspicious-in-process-explorer%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Relevant answer: https://serverfault.com/questions/448440/how-do-i-determine-what-taskhost-exe-is-doing
Summary: It's the Reliability Analysis Collection task.
edited Apr 13 '17 at 12:14
Community♦
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
add a comment |
Relevant answer: https://serverfault.com/questions/448440/how-do-i-determine-what-taskhost-exe-is-doing
Summary: It's the Reliability Analysis Collection task.
edited Apr 13 '17 at 12:14
Community♦
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
add a comment |
Relevant answer: https://serverfault.com/questions/448440/how-do-i-determine-what-taskhost-exe-is-doing
Summary: It's the Reliability Analysis Collection task.
edited Apr 13 '17 at 12:14
Community♦
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
Relevant answer: https://serverfault.com/questions/448440/how-do-i-determine-what-taskhost-exe-is-doing
Summary: It's the Reliability Analysis Collection task.
edited Apr 13 '17 at 12:14
Community♦
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
edited Apr 13 '17 at 12:14
Community♦
1
edited Apr 13 '17 at 12:14
Community♦
1
edited Apr 13 '17 at 12:14
Community♦
1
1
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
answered Sep 7 '16 at 3:18
Syclone0044Syclone0044
1,152819
1,152819
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
add a comment |
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
1
1
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
For me, it was DiskFootprint->Diagnostics. Happy now that notebook fan is not blowing every few minutes..
– Andreas Reiff
Aug 5 '17 at 13:10
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f532560%2ftaskhost-exe-looking-suspicious-in-process-explorer%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Why don't you just search for all locations of taskhost.exe but I can tell you that what your presenting isn't strnage in the slightlest.
– Ramhound
Jan 11 '13 at 13:12
I search for taskhost.exe, and the only on I found was in System32. That one I scanned, but it did not bring back something. @Ramhound, you meant is strange, I presume?
– Fons
Jan 11 '13 at 13:58
Are you running Process Explorer as administrator? Have you checked the parent process to see if one of the services that it is running is the task scheduler service?
– dsolimano
Jan 11 '13 at 14:02
Mmmh, I guess I wasn't. Though I started it from WinRAR, which I do run as administrator. This solved the issue of not finding the path. Though it's still kind of strange that for the process taskhostex.exe (also System32), it display all the information correctly...
– Fons
Jan 11 '13 at 14:07
Just because the processes are similarly named, doesn't mean they will behave similarly. From the web: "There are two types of services in Windows, Registry based services and DLL based services. Whenever your computer boots up, windows registers all of the required DLL’s and runs the services associated with them. Taskhost.exe is the process which controls all DLL based services."
– Simkill
Jan 11 '13 at 16:30