Task-host lookalikes showed up in process lists on 7 March 2021

On 7 March 2021 we sat with a set of process lists that all claimed to run task host. The real binary lives under System32. The lookalikes used a near-identical name and a user-writable folder, then borrowed an icon that looked like a service host. That audit is still the checklist we hand people who only notice a second task host in Task Manager.

The giveaway is the path, not the CPU graph. A lookalike that starts from AppData or a Temp extract is not the system host. Right-click the process, open the file location, and write that path down before you end the task. Ending it first can let a watchdog rewrite the file while you are still looking.

After you have the path, check the digital signature and the parent process. Several 7 March 2021 samples launched from a packed installer that already lived in the Run key. Removing only the lookalike left the installer in place. Pair this page with the Files section if the parent name is a random eight-letter exe.

We kept the original notes because the same naming trick still appears next to newer installer lures. If your list shows two task hosts, start with the path audit from 7 March 2021, then work forward to later droppers. Do not rename the real System32 file. That never helps and it breaks scheduled maintenance.