Windows 10: taskhostw.exe tries to delete MsoIrmProtector.doc

Discus and support taskhostw.exe tries to delete MsoIrmProtector.doc in Windows 10 Software and Apps to solve the problem; Hello, I'm a SOC Analyst We have recieved a block alert in our EDR about a windows11 pro got block on taskhostw.exe however I couldn't find any... Discussion in 'Windows 10 Software and Apps' started by Ceyhun Kıvanç Demir, Jul 25, 2023.

  1. CEYHUN KıVANç DEMIR
    Ceyhun Kıvanç Demir Win User

    taskhostw.exe tries to delete MsoIrmProtector.doc


    Hello, I'm a SOC Analyst We have recieved a block alert in our EDR about a windows11 pro got block on taskhostw.exe however I couldn't find any resource or document about that its a natural behavior of windows. We also accrossed this behavior in 2 devices between 1500 devices which made me more suspicious on this caseparentchild process is belowwininit.exe > services.exe > svchost.exe with arguements -k netsvcs -p -s Schedule > taskhostw.exe --- attempts to delete --> MsoIrmProtector.docI have checked the hashes of all process in tree in case of a malicious program copies name a

    :)
     
    Ceyhun Kıvanç Demir, Jul 25, 2023
    #1
Thema:

taskhostw.exe tries to delete MsoIrmProtector.doc

Loading...

  1. taskhostw.exe tries to delete MsoIrmProtector.doc - Similar Threads - taskhostw exe tries

  2. how to delete exe files?

    in Windows 10 Software and Apps
    how to delete exe files?: after deleting .exe files they back with access denied other files are able to delete https://answers.microsoft.com/en-us/windows/forum/all/how-to-delete-exe-files/f065a8a6-9b77-4cf7-96af-875e321ef822

  3. DELETED DOC

    in Windows 10 Network and Sharing
    DELETED DOC: Help, I accidentally deleted a 10 page Word document. Can I recover it, if so how do I go about recovering this VERY important document? https://answers.microsoft.com/en-us/windows/forum/all/deleted-doc/9b176d9f-2b38-4526-a43f-9acebd250f21

  4. .exe file deletion

    in Windows 10 Network and Sharing
    .exe file deletion: Hello I've been having troubles with .exe files I try to permantley delete the folder and it'll remove everything except the .exe file if I delete the .exe file with a shift+del it'll dissapear then repair once I refresh the folder it's in. If I use the normal delete method...

  5. the word doc is grayed out when trying to oepn a new doc

    in Windows 10 Installation and Upgrade
    the word doc is grayed out when trying to oepn a new doc: im trying to opena new blank word doc but the option is grayed out https://answers.microsoft.com/en-us/windows/forum/all/the-word-doc-is-grayed-out-when-trying-to-oepn-a/bb0d4da9-9be7-4ce5-bb69-349a2ccd489b

  6. Trying to save doc. files

    in Windows 10 Network and Sharing
    Trying to save doc. files: When I tried to save a World document the system asks me to log in and complete Hello registration. Before that moment I had completed Hello registration and set up PIN but I noticed that Hello is not available on my computer. How can I save docs?...

  7. word docs changing to exe application files on USB

    in Windows 10 Network and Sharing
    word docs changing to exe application files on USB: I copy my word doc onto my flash drive (which I have done many times before) but now when I go to open the flash drive the file are either .exe OR application OR they seem to "disappear" I know they are still there because when I "search" docs come up! I am in China and...

  8. I deleted world doc

    in Windows 10 Network and Sharing
    I deleted world doc: Please help me to recover the deleted file from Word 10. Thank you... https://answers.microsoft.com/en-us/windows/forum/all/i-deleted-world-doc/8f9845f9-441b-4c05-b904-44504d6875b3"

  9. taskhostw tying to access your WebCam?!

    in Windows 10 Support
    taskhostw tying to access your WebCam?!: I was like WTF? Why does a "System" process wants to access my WebCam? My antivirus shows this : [img] 115041

  10. taskhostw tying to access your WrbCam?!

    in Windows 10 Support
    taskhostw tying to access your WrbCam?!: I was like WTF? Why does a "System" process wants to access my WebCam? My antivirus shows this : [img] 115041