dismhost.exe recreating itself every few minutes in C:\Windows\Temp

dismhost.exe recreating itself every few minutes in C:\Windows\Temp, each time contained in a different folder GUID name (e.g. AE7D13F2-AA05-4FEC-B7F2-C633CB049B52), so that my Temp folder is massively filled up with these folders with different GUIDs - each of which contain the very same DismHost.exe and 23 other files. The task manager currently shows three instances of dismhost.exe, each running from its folder it was created in.

If I look at the date created / date modified times of those folders I see them being recreated every 5 minutes. I realize this might have to do with scheduled tasks. Looking at the Event viewer's TaskSchedulerOperational log, I see that each time the folder is created, a few corresponding tasks are completed involving:

 

(6:17:36 PM) User "NT AUTHORITY\System"  deleted Task Scheduler task "\Microsoft\Windows\RemovalTools\MRT_HB"
(6:17:36 PM) Task Scheduler terminated "{cec331bf-600b-4dc1-a04a-0cdac76eb224}"  instance of the "\Microsoft\Windows\RemovalTools\MRT_HB"  task.
(6:17:36 PM) User "WORKGROUP\USER$"  updated Task Scheduler task "\Microsoft\Windows\RemovalTools\MRT_HB".
(6:17:36 PM) User "WORKGROUP\USER$"  registered Task Scheduler task "\Microsoft\Windows\RemovalTools\MRT_HB"
(6:17:42 PM) Task Scheduler stopped instance "{a8f205a7-2a2b-4279-be9c-f2a05bd3c788}"  of task "\Microsoft\Windows\TaskScheduler\Idle Maintenance"  because computer is no longer idle.
(6:17:42 PM) Task Scheduler stopped instance "{6ef6a8d8-78e5-49ed-ba4a-0fffd01134d0}"  of task "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic"  because computer is no longer idle.
(6:17:42 PM) Task Scheduler successfully finished "{ec0e75e5-9dc5-4d8e-a8ff-8514d97f13f5}" instance of the "\Microsoft\Windows\Windows Defender\Windows Defender Verification" task for user "NT AUTHORITY\SYSTEM".
(6:17:42 PM) Task Scheduler terminated "{ec0e75e5-9dc5-4d8e-a8ff-8514d97f13f5}"  instance of the "\Microsoft\Windows\Windows Defender\Windows Defender Verification"  task.
(6:17:42 PM) Task Scheduler stopped instance "{ec0e75e5-9dc5-4d8e-a8ff-8514d97f13f5}"  of task "\Microsoft\Windows\Windows Defender\Windows Defender Verification"  as request by user "NT AUTHORITY\SYSTEM" .
(6:17:42 PM) Task Scheduler successfully completed task "\Microsoft\Windows\Windows Defender\Windows Defender Verification" , instance "{ec0e75e5-9dc5-4d8e-a8ff-8514d97f13f5}" , action "%ProgramFiles%\Windows Defender\MpCmdRun.exe" with return code 2147942659.
(6:17:42 PM) Task Scheduler successfully finished "{d7087f2b-9d3e-4047-953b-b367258f6367}" instance of the "\Microsoft\Windows\Application Experience\ProgramDataUpdater" task for user "NT AUTHORITY\SYSTEM".
(6:17:42 PM) Task Scheduler terminated "{d7087f2b-9d3e-4047-953b-b367258f6367}"  instance of the "\Microsoft\Windows\Application Experience\ProgramDataUpdater"  task.
(6:17:42 PM) Task Scheduler stopped instance "{d7087f2b-9d3e-4047-953b-b367258f6367}"  of task "\Microsoft\Windows\Application Experience\ProgramDataUpdater"  as request by user "NT AUTHORITY\SYSTEM" .
(6:17:42 PM) Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\ProgramDataUpdater" , instance "{d7087f2b-9d3e-4047-953b-b367258f6367}" , action "%windir%\system32\rundll32.exe" with return code 2147942659.
(6:17:42 PM) Task Scheduler successfully finished "{2450f1e1-3106-459d-a074-84b0b7843c3a}" instance of the "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" task for user "NT AUTHORITY\SYSTEM".
(6:17:42 PM) Task Scheduler successfully completed task "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" , instance "{2450f1e1-3106-459d-a074-84b0b7843c3a}" , action "%ProgramFiles%\Windows Defender\MpCmdRun.exe" with return code 2147942659.
(6:17:42 PM) Task Scheduler stopped instance "{2450f1e1-3106-459d-a074-84b0b7843c3a}"  of task "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan"  as request by user "NT AUTHORITY\SYSTEM" .
(6:17:42 PM) Task Scheduler terminated "{688997da-a1f5-4fbf-8cd6-f950de2162c2}"  instance of the "\Microsoft\Windows\DiskFootprint\Diagnostics"  task.
(6:17:42 PM) Task Scheduler stopped instance "{688997da-a1f5-4fbf-8cd6-f950de2162c2}"  of task "\Microsoft\Windows\DiskFootprint\Diagnostics"  as request by user "NT AUTHORITY\SYSTEM" .
(6:17:42 PM) Task Scheduler terminated "{2450f1e1-3106-459d-a074-84b0b7843c3a}"  instance of the "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan"  task.
(6:17:42 PM) User "WORKGROUP\USER$"  updated Task Scheduler task "\Microsoft\Windows\TaskScheduler\Regular Maintenance"
(6:17:42 PM) Task Scheduler successfully finished "{a8f205a7-2a2b-4279-be9c-f2a05bd3c788}" instance of the "\Microsoft\Windows\TaskScheduler\Idle Maintenance" task for user "NT AUTHORITY\SYSTEM".
(6:17:42 PM) Task Scheduler successfully completed task "\Microsoft\Windows\TaskScheduler\Idle Maintenance" , instance "{a8f205a7-2a2b-4279-be9c-f2a05bd3c788}" , action "Maintenance Launcher Handler" with return code 2147947270.
(6:17:43 PM) Task Scheduler successfully finished "{cec331bf-600b-4dc1-a04a-0cdac76eb224}" instance of the "\Microsoft\Windows\RemovalTools\MRT_HB" task for user "NT AUTHORITY\SYSTEM".
(6:17:43 PM) Task Scheduler successfully completed task "\Microsoft\Windows\RemovalTools\MRT_HB" , instance "{cec331bf-600b-4dc1-a04a-0cdac76eb224}" , action "C:\WINDOWS\system32\MRT.exe" with return code 0.

From those events I conclude the recreation of dismhost.exe folders occurs during Windows maintenance tasks. Anyway to stop them from duplicating and taking up Gigs on my SSD?

Appreciate the help.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Hi,

I understand dismhost.exe recreating itself  and takes up more space on SSD.

Please refer to the article which will explain the significance of DISM.exe:

https://technet.microsoft.com/en-us/library/dd744566%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

When we look in to the logs it is mostly created due to Windows defender and task scheduler.

If this is taking up space, try to follow the below article and check if it helps:

http://windows.microsoft.com/en-us/windows/delete-files-using-disk-cleanup#delete-files-using-disk-cleanup=windows-8

Hope this information helps, for further assistance please reply.

1 person was helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I'm bothered by several issues. Let's name this PC COMPUTER1.

Number 1 issue: Disk cleanup doesn't scan and clean the Windows\Temp folder on COMPUTER1. I was bewildered over the months why my space was disappearing and used Disk Cleanup but it would only clean up less than 1 GB; finally I checked the Windows\Temp folder and who knew These folders have been created evey 5 minutes from 4-Jan-2015 everyday until 24-Mar-2015, growing to a total of 27GB. I've resorted to clearing out the Temp folder myself.

Number 2 issue: On COMPUTER1 The number of scheduled tasks in past 24hrs for Windows Defender Verification and Windows Defender Scan is scary , a list of about 100 past instances every 5 minutes in Task View of Task Scheduler's Overview. They seem to keep being interrupted, and COMPUTER1 is mostly left on and left idle, so I don't understand why; it could be a program keeping idle-triggered tasks from running. Compare that to that on another computer I use for work (lets name this COMPUTER2), where there are only 4 past instances.

So yeah while I might have solved the problem by manually cleaning out the Windows\Tempfolder, questions are 1)Why doesn't Disk cleanup doesn't clean the Windows\Temp folder, 2)Why doesn't COMPUTER1 clean out the Temp folder after successful scans like COMPUTER2 (COMPUTER1 is mostly idle almost 24/7 vs. COMPUTER2 I work but Windows Defender tasks are frequently stopped/interrupted, so I suspect a program could be blocking the scans from taking place, but I have no anti-virus programs installed at all on either computer; alternatively I suspect Windows Defender is not working properly because it's been two days since I've done a manual scan -- on the Windows Defender window, scan details show scans last took place on 29-Mar-15 8:42PM (Quick Scan) -- whereas on COMPUTER2 it has been scanned automatically yesterday 30-Mar-15 4:53PM (Quick Scan) when I actually turned on the COMPUTER2 for a short while.).

p.s.Sorry for the long response but I'm really bewildered by these issues on COMPUTER1, and hopefully I can fix the Defender problems so that the scans are successful (great from security perspective), and not have to clear out the Windows\Temp folder so frequently, and have space on my SSD not vanishing in weeks. Thanks and much appreciate your help.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

Thank you for the reply and the detailed information.

This might be caused due to  following reasons:

  •  Defender corrupt.
  •  Windows core components corrupt.

 Please follow the below suggestion and check if this helps:

SFC Scan:

Please refer to the below article, which will guide you how to initiate SFC scan and what it does. Basically this scan will check for Windows files and validate it:

https://support.microsoft.com/en-us/kb/929833?wa=wsignin1.0

Hope this information helps, for further assistance please reply. 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I have attempted the sfc scan which shows no errors. 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Do these options throw any light on the cause of your problem?

How to start Windows 8 in Safe Mode
http://www.bleepingcomputer.com/tutorials/start-windows-8-in-safe-mode/

How to perform a clean boot in Windows
http://support.microsoft.com/kb/929135/en-au

How to perform a clean boot to troubleshoot a problem in Windows Vista, Windows 7, or Windows 8
http://support.microsoft.com/default.aspx/kb/929135

DismHost.exe
http://www.shouldiblockit.com/dismhost.exe-9a821d8d62f4c60232b856e98cba7e4f.aspx

Do you have DismHost.exe in either of these locations?   107.808 bytes is the size of my files in Windows 10

DismHost.exe C:\Windows\System32\Dism 107,808
DismHost.exe C:\Windows\SysWOW64\Dism 107,808

It may be necessary to show both Hidden, and System Files, and also to uncheck "Hide known file types" in Control Panel/ Folder Options/ View, to navigate to the mentioned  location and to see file extensions.

2 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I seemed to have stumbled on a solution myself.

I left my two Windows 8.1 computers (the one with the problem and another without) idle with the Windows Defender window open, and i noticed that whenever Idle maintenance was triggered (about 5 to 10 minutes of idling), Windows Defender window (if open) would show a quick scan taking place on the working PC, but not on the problematic PC.

I suspected the problem seemed to have to do with the 'Windows Defender Scheduled Scan' task not being able to start by 'Idle Maintenance' task. To test this what I did was to open Task Scheduler (Local) and navigate to: Microsoft > Windows > TaskScheduler, and going to properties of 'Idle Maintenance' task under Settings tab I set it to 'Allow task to run on demand', then ran the task. Immediately, if you have Windows Defender window open, a quick scan should have started; this was happening on another working PC, but not on the problematic PC, so next I navigated to Microsoft > Windows > Windows Defender and ran 'Windows Defender Scheduled Scan' on demand; again Windows Defender window should show a quick scan taking place immediately, and this was happening on both PCs.

Somehow one on-demand run of the 'Windows Defender Scheduled Scan' task fixed the "bug" where Idle Maintenance wouldn't run it. To test if it was working i restarted my PCs and left them idle with the Windows Defender window open so I could watch. Successful Windows Defender quick scans are now taking place on my problematic PC. The C:\Windows\Temp folder isn't showing any subsequent creation of DISM GUID folders anymore, since Windows Defender task isn't being "interrupted" or prevented any longer.

As to why such an on-demand running of a Scheduled task could fix a task, I suppose sometimes Scheduled Tasks may fail to work and just needs some kind of re-apply of settings to work again.

69 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Thank you for posting your solution.  I have never seen such a problem with Windows Defender but your solution may help other who come this way.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hey, there.

My Windows Defender was disabled here on my Windows 7 x64 Ultimate and that process Dismhost.exe on a TEMP folder appeared on my Task Manager. Isn't weird? It happened two times.

AMD FX 8320 8 CORE 3.50, 8gb of ram DDR5, NVidia GeForce GTX 970 TI 4gb, 1tb HDD.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I'm seeing something similar on my Windows 10 PC. The folders are different, and the workaround isn't exact, since there's no Idle Maintenance task. It also isn't 100% consistent, but it does involve dismhost.exe in my users\temp directory.

But it's very aggressive, and can be 12GB / day when it's active.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Brian,

Run the System Maintenance troubleshooter and check the status.

a) Press the ‘Windows + C’ to activate the charms menu or move the mouse pointer to bottom right corner of the screen and you will get the charms menu.

b) Click on ‘search’ and select ‘settings’ and type ‘Troubleshooting’ and select ‘Troubleshooting’.

c) On the left pane click "View all" and then click "System Maintenance" and run the troubleshooter.

Once the troubleshooter complete, restart the computer and check the status. Do keep us updated.

Regards,

Ramesh Kumar.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info


Last updated October 11, 2020 Views 61,908 Applies to: