Suspicious activity from inetsrv\w3wp.exe

Hi,

There is a suspicious activity from inetsrv\w3wp.exe which executes the following command.


" -ap ".NET v4.5" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipm131fdfb23-5dae-5fbe-41ae-3fdbae432 -h "C:\inetpub\temp\apppools\.NET v4.5\.NET v4.5.config" -w "" -m 0 -t 20 "

Could someone please help me to figure out this command?

Thank you.

Hi : I Google up the command " inetsrv\w3wp.exe " << only : No the

complete command path, that you wrote in the 3rd and 4th lines

Here is the Google search result of inetsrv\w3wp.exe

used the copy+Paste to show the result to you

People also ask

What is Inetsrv w3wp exe?

Image result for inetsrv\w3wp.exe

The genuine w3wp.exe file is a software component of Internet Information Services by Microsoft Corporation. If "w3wp.exe" is present on a system and is located in "C:\Windows\System32\inetsrv", then it is the "worker process" within Microsoft's Internet Information Services (IIS) web server.

--------------------------------------------------------------------------------------------------------------------

How do I stop inetsrv\w3wp exe?

  1. You need to run taskkill in an elevated command prompt. ...

  2. same thing (cmd run as admininstrator): taskkill /pid 4648 /f ERROR: The process with PID 4648 could not be terminated. ...

  3. If you hit "There is no running instance of the task", then there is a bigger problem. ...

  4. @LexLi I tried with powershell still process is there.

When the commands shows up >> Run the "Taskkill" Press [Windows key + X] use the left

side of keyboard > click "Command Prompt as (Admin) You'll see a small black window

Type the command after the _ blinking dash taskkill /pid 4648 /f ERROR

now press [Enter] The taskkill, does its job : will display a message

if the process, was successful or Not : if Fail you may try the taskkill in the

PowerShell Command : you can find this tool by opening the

Start Programs and look in the "P" if is sorted in alphabetic order

But let me tell you, this is difficult task. if nothing works, wait for

a better answer or upgrade to Windows 10 or 11 'cause

windows 8 and 8.1 aren't worth it to have them

if my answer is helpful : Mark it with,. Yes on this reply page. TIA 👍

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi aReply4u,

Thank you for your answer and I will do a deep investigation on this again.

Thanks.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

ok win's user. Try to kill the process by applying the Taskkill

in the "CMD Prompt as (Amin)" if comes up with an error

try up next the Power Shell tool : using the same

command Taskkill /pid 4648 /f ERROR

I'm not a windows software tech : But if we look at the structure of the written command..

" -ap ".NET v4.5" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipm131fdfb23-5dae-5fbe-41ae

-3fdbae432 -h "C:\inetpub\temp\apppools\.NET v4.5\.NET v4.5.config" -w "" -m 0 -t 20 "

I bolded part of the command or file path : That refers first to

.NET Frame works versions and a .dll file extension

" -ap ".NET v4.5" -v "v4.0" -l "webengine4.dll"

on 2nd bolded part "C:\inetpub\temp\apppools\.NET v4.5\.NET v4.5.config"

it refers to "C: Driver \internet public \temp=temporary \app pools and .Net Framework again

Review if you have mess up, with the >NET Framework versions

Anyway man. if the Taskkill succeeds and the script. stop to

show up : You don't have to worry any further

if my answer is helpful : Mark it with,. Yes on this reply page. TIA 👍

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated April 21, 2025 Views 22,119 Applies to: