Advice Request taskhostw.exe trying to connect through Windows Firewall - Is it Malware?

[DDE_Server]

hi guys when i installed WFC the early of this week
there were notification pop up for the process Taskhostw.exe trying to connect the internet
i found the process is digitally signed by Microsoft Coorporation however i read on the internet it may be a Trojan and legit process is without letter "W" so my be may malware injection occur and use svchost.exe to try to connect to the internet
as you could see from process explorer screenshot below"

i submitted the process executable to virustotal but no engine detected it so i wander if anyone has knowledge about this issue
here is the article i found

Remove the Taskhostw.exe and Windows Update Checker Miner

The Taskhostw.exe Miner is a Trojan infection that utilizes a victim's CPU processing power to mine digital CryptoCurrency called Monero. When installed, this Trojan will create an autorun called WindowsUpdateChecker that starts the...

www.bleepingcomputer.com

 

[Ink]

It's probably not malware in your case.

The processes in the link above show no information under the Description column, although this does not determine if a process is malware or not, it's something to observe.

Small differences make a big difference.

 

[ForgottenSeer 85179]

It's safe process.

The main function of taskhostw.exe is to start the Windows Services based on DLLs whenever the computer boots up. It is a host for processes that are responsible for executing a DLL rather than an Exe or Executable file

You shouldn't block Windows system processes.

 

[DDE_Server]

It's probably not malware in your case.

The processes in the link above show no information under the Description column, although this does not determine if a process is malware or not, it's something to observe.

Small differences make a big difference.

there was a talk on one of the microsoft threads that it may differe in the footprint of registry enteries created
here is the Quote:

Spoiler: Taskhostw.exe

I have now looked around more, and I do see many saying that malware does use the very same name, with the w. But it also gave sized of the correct file and the malware one, and the malware is much larger than the correct file.







It listed three varying sizes for the correct file:



•71,792 bytes

•71,280 bytes

•71,848 bytes.



And it said the malware by the same name in a subfolder in Program Files is 1,113,088 bytes. And the malware file by the same name in a subfolder in the user profile folder is 1,3792,328 bytes.



Mine doesn't match any of those numbers! Mine comes in at:



•Size: 87,904 bytes

•Size on disk: 90,112 bytes



So, since there are so many subfolders on my computer in the specified locations for the malware, I decided to just take the advice and run Malwarebytes -- I got the free, 14-day trial and ran it.



Malwarbytes did not produce any notice about taskhostw.exe. So, I guess mine cleared that hurdle and is probably the correct one.



So, I now have what I think is a better approach to stop this notice than fully turning off that function, which is supposed to be designed to avoid ransomware. You do not have to turn it off, you can selectively protect a folder or file, in this case a file. I have done that on my computer now. To do that:



•Open Windows Defender

•Go to the "Virus & threat protection" page

•At bottom of that page, click into "Ransomware protection"



•On the "Ransomware protection" page, toward the bottom, under "Controlled folder access," select the second option: "Allow an app through controlled folder access"

•Now navigate to and select the correct taskhostw.exe file at:



C:\Windows\System32\taskhostw.exe



Once selected, it will be added to a list of protected files and you should not get that message any more -- and I presume if you do start getting it again, that would be because you then have gotten the real malware file, so good thing you stopped this selectively instead of turning the entire function off!



(Malwarebytes did find a number of things it questioned and left it to me to decide -- I hate that, how am I supposed to know! Anyway, I did know one was fine, but the others I could not tell, but the names left me wondering if yes, they are a problem, even though Windows Defender has not identified them as a problem. So, I quarantined them. I restarted, tested a couple applications to see if they would still open after that, but I will just have to await the test of time, I suppose -- but better delete them or restore them before the 14-day trial end.)

The link: taskhostw.exe on windows 10
@security123 from where you inserted this quote

 

[DDE_Server]

It's safe process.



You shouldn't block Windows system processes.

see my below reply

 

[DDE_Server]

the "S' is missing in the last word

It's probably not malware in your case.

The processes in the link above show no information under the Description column, although this does not determine if a process is malware or not, it's something to observe.

Small differences make a big difference.

 

[DDE_Server]

I installed Auto run to see any created Auto lunch entries which named in the article name didn't find any

 

[SeriousHoax]

It's a safe file and in my case while using Proton VPN, this process often tried to connect to internet but never did while browsing normally without Proton VPN.

 

[Special]

It's safe, but there is no need to grant it anykind of connection, continue to block it with your firewall, it will still work as intended.

 

[DDE_Server]

It's safe, but there is no need to grant it anykind of connection, continue to block it with your firewall, it will still work as intended.

That is what i actually do

 

[DDE_Server]

It's a safe file and in my case while using Proton VPN, this process often tried to connect to internet but never did while browsing normally without Proton VPN.

That is strange i will try to search more about this process. it also verified by microsoft when i enabled verify image signature

 

[TairikuOkami]

taskhostw.exe runs tasks, any task, it could be a fileless malware for all I know.
When you point at it, it should show, what tasks it is running at the moment.

 

[DDE_Server]

taskhostw.exe runs tasks, any task, it could be a fileless malware for all I know.
When you point at it, it should show, what tasks it is running at the moment.

yes it has a task assigned for it:
i am notice now it became 2 process for TaskhostW:
one is Wini cash task object and the other one is Diagnostic infrastructure handler
maybe @Umbra or @Andy Ful has any idea ?

 

[Andy Ful]

The services started via scheduled tasks by EXE files can be seen in Task Manager under their own names. Some applications can use services loaded from DLLs and they are hosted by a special executable taskhostw.exe. For example, on my computer, there is one instance of taskhostw.exe that hosts two DLLs: Microsoft PlaySound and Wininet Cache. They were started by the command-line:
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

If the service loaded from DLL requires the Internet connection, then this will be seen as a taskhostw.exe entry. So, normally there will be nothing malicious.
Simply check on VirusTotal if the taskhostw.exe that tries to connect is safe (if not then it will usually have non-system path). Next, the DLLs related to services hidden under the taskhostw.exe should be examined.

 

[DDE_Server]

The services started via scheduled tasks by EXE files can be seen in Task Manager under their own names. Some applications can use services loaded from DLLs and they are hosted by a special executable taskhostw.exe. For example, on my computer, there is one instance of taskhostw.exe that hosts two DLLs: Microsoft PlaySound and Wininet Cache. They were started by the command-line:
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

If the service loaded from DLL requires Internet connection, then this will be seen as a taskhostw.exe entry. So, normally there will be nothing malicious.
Simply check on VirusTotal if the taskhostw.exe that tries to connect is safe. Next the DLLs related to services hidden under the taskhostw.exe should be examined.

i checked the process lie you said and it is safe also the tasks related to it is the same as yours but there is no any DLL related to it listed in process explorer so it is somehow hidden or protected may i try to elevate running Process Explorer as an administrator and see again
Thank Andy for your reply
Edit : i have an additional one related to task called : Diagnostic infrastructure handler

 

[Andy Ful]

...
Edit : i have an additional one related to task called : Diagnostic infrastructure handler

If I correctly recall there is a task WDI (Windows Diagnostic Infrastructure ).

 

[DDE_Server]

If I correctly recall there is a task WDI (Windows Diagnostic Infrastructure ).

I will search in its system path and see if it there