NetworkDiagnosticService is a scheduled-task name, not proof that an entry belongs to Windows. A public Dr.Web malware description lists a task with this name, alongside SystemCacheMaintenance and IEPackages. That makes an unexplained entry worth checking, but it does not identify the file on your PC. Open the task’s Actions and compare the executable, arguments and file location with software you knowingly installed. Do not click Run to find out what it does.
If you already have a security alert or an unwanted script that returns, use the cleanup route below. You do not need to complete a manual investigation before running a full scan.
Inspect what NetworkDiagnosticService actually launches
- Open Task Scheduler from Windows Search and select Task Scheduler Library. Find the entry and note its folder as well as its name. Tasks in different folders can share a name.
- Open its Properties, then Actions. Record the program or script, its arguments, and the Start in directory if one is set. Copy these as text for your own notes; do not paste the command into a terminal or a browser.
- Check Triggers to see when it is configured to start. Note the account on the General tab and whether the entry is enabled. An author label or a system account is not a certificate of legitimacy.
- Compare the referenced program with the application that should own it: its installation location, publisher, version and installer source. A familiar executable name is insufficient when its arguments launch an unfamiliar script.
For example, powershell.exe or wscript.exe can be a legitimate Windows component while the script supplied to it is unwanted. Read the complete Action, including the argument after the launcher. Conversely, an unsigned script is not automatically malicious. Consider its origin and purpose together with any detection and the symptoms you observed.
For a root-level task, this optional, read-only Command Prompt query displays its definition without starting it:
schtasks /query /tn "\NetworkDiagnosticService" /xml
If the entry is in a subfolder, use its actual full task path. An error saying it cannot be found may mean the path differs or the task has already been removed. It does not prove that the PC is clean. Keep the XML private: it can contain account names, local paths and sensitive command arguments.
Keep it, investigate it, or follow the cleanup route?
| What you find | What it tells you | Next step |
|---|---|---|
| A known installed application’s expected updater, with a matching location and publisher | A plausible owner, which still needs to match the complete Action | Check that application’s documentation or support before disabling a task it needs. |
| A script in an unexpected user-writable folder, obscure arguments, or an unknown download location | A reason to investigate; none of these alone identifies a malware family | Keep the Action as evidence, avoid running it, and scan if the origin remains unexplained. |
| A security detection names the same script or file | More specific evidence than the task’s display name | Review the detection and use the cleanup route. Do not restore or exclude the file just to stop the warning. |
| The target file is missing after quarantine or uninstalling an application | Possibly a leftover launcher rather than a file that is still present | Check the quarantine/uninstall history. Do not download a replacement script or DLL. |
Microsoft’s Autoruns is an optional way to inspect related startup entries. Its Properties and Jump to Entry commands help locate the configured target. Leave checkboxes and deletion controls alone during identification. Seeing an entry describes a configured launch; it does not establish that the command executed successfully.
Why SystemCacheMaintenance and IEPackages matter
Dr.Web’s description of Trojan.Siggen32.10040, added on November 28, 2025, lists task-file changes involving NetworkDiagnosticService, SystemCacheMaintenance and IEPackages. This is evidence about the analyzed sample, not a rule that every similarly named task on every computer is malicious.
When several unexplained tasks point to related scripts or the same unfamiliar folder, investigate them together instead of removing one name and assuming the cause is gone. For the broader script, missing-DLL and recurring-task scenario, use the SystemCacheMaintenance and PowerShell task cleanup guide. Do not confuse a similarly worded entry with Windows Defender Cache Maintenance, or delete all maintenance tasks as a precaution.
A hopmn.dll missing-file message, for example, calls for finding the launcher that references it; it is not an instruction to fetch that DLL from a download site. If your only symptom is a blocked PowerShell connection, the PowerShell outbound-connection guide explains how to separate the Windows interpreter from the command using it.
If the task is unexplained or keeps returning
For a detected unwanted script, repeated security alerts, or unexplained persistence after installing software, download and install Gridinsoft Anti-Malware, update it and run a Full Scan. Review the detections, apply cleanup to the unwanted items you select, and restart if prompted. This route does not require a second mandatory hunt through tasks, files or registry keys.
Use Gridinsoft Anti-Malware to scan for unwanted files and related persistence. Review the results before applying cleanup.
Download Gridinsoft Anti-Malware for WindowsAfterwards, check whether the original alert, missing-file error or unwanted task returns. If it does, save the scan report and the task’s current Action for support. Redact usernames, private URLs and tokens before sharing. A clean scan alone cannot prove that no earlier compromise occurred; use the post-malware Windows security audit when you also need to review security settings or accounts.
On a work-managed computer, send the finding to your IT team before changing a task or installing another security tool. If the entry belongs to expected software, indiscriminately disabling it can interrupt that application’s updates.
References
- Doctor Web. Trojan.Siggen32.10040. Dr.Web Malware Description Library. November 28, 2025. Accessed October 25, 2026.
- Russinovich, M. Autoruns for Windows. Microsoft Sysinternals. June 17, 2026. Accessed October 25, 2026.
- Microsoft. schtasks query. Microsoft Learn. Accessed October 25, 2026.
