What is Services.exe

services.exe

File description

Services.exe with description services.exe is a process file from an unknown company belonging to an unknown product.
The file is digitally signed from Microsoft Windows Component Publisher - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Windows Component Publisher

What is services.exe?
Services.exe is the Windows Services Control Manager. This process is responsible for starting, stopping, and managing system services. Services.exe will start automatic services on boot and stop all services on shutdown.

This process is a critical system process and is essential to the operation of the system. Due to the critical nature of the process, it is not possible to terminate it via the task manager. Disabling this process otherwise will render your system unbootable. The screenshot below illustrates how this process should appear in the task manager:



As you can see in the above screenshot, services.exe always runs as SYSTEM. A process with this name running as a different user is a strong indicator of a malware infection.

Dangers of services
As this is a critical system process that runs on every Windows NT-based (2000, XP, Vista) machine, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as services.exe:
  • W32.Randex.R (%SystemRoot%\service.exe)
    • Randex is a worm that infects systems through network shares.
  • W32.HLLW.Kazping (%SystemRoot%)
    • This is a virus that spreads through KazAa shares that attempts to perform a distributed denial of service attack on a predefined website.
  • W32.XTC.Worm (%SystemRoot%)
    • This is an IRC backdoor Trojan which connects to an IRC server to receive commands from a remote attacker.
  • Backdoor.win32.Prorat.19g
  • W32.Mydoom
There will always be exactly one instance of this process running at any given time. The presence of multiple instances is a strong indicator of a malware infection.

Common problems
  • Services.exe causes a Blue Screen of Death
    • Viruses and spyware can cause this problem. Ensure that your system is not infected with malware
    • If your system is not infected, then something is wrong with the genuine services.exe. You should perform a repair installation of Windows.
  • This process uses 100% CPU time
    • If you are using Windows 2000, be sure you have Service Pack 4 or later.
    • If this happens when your firewall software is prompting to allow services.exe access to the internet, you probably have a malware infection.
    • If you have ZoneAlarm or Symantec Norton software, try uninstalling them (after updating and scanning your system for viruses first).

Automatic startup locations

001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
004 All users startup startmenu
005 Current user startup startmenu
007 Roaming Start Menu\Programs\Startup
008 Autorun registry entries Default user
009 Autorun registry entries SYSTEM user
010 Installed services
033 Winlogon Userinit
034 Winlogon Shell
035 Active Setup Installed Components
065 Image File Execution Options (debugger)
073 %windir%\Tasks
121 AppInit_DLLs
139 Windows\load
140 Windows\run
146 AlternateShell
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run
191 Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run

Digital signatures found for this file

    Certificate 
94 Microsoft Windows Component Publisher - Microsoft Timestamping Service
90 Microsoft Windows Component Publisher - Microsoft Time-Stamp Service
40 Microsoft Windows Publisher - VeriSign Time Stamping Services Signer
32 Microsoft Windows - Microsoft Time-Stamp Service
21 Microsoft Windows XP Publisher - VeriSign Time Stamping Service
19 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Services Signer
17 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Service
7 Microsoft Windows - Microsoft Timestamping Service
7 Microsoft Windows Publisher - VeriSign Time Stamping Service
5 Microsoft Windows XP Publisher (Europe) - VeriSign Time Stamping Service
3 Microsoft Windows Component Publisher - VeriSign Time Stamping Services Signer
3 Microsoft Windows - VeriSign Time Stamping Services Signer
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service CA SW1
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service
1 Ts Security System - Seguranc a em Sistemas Ltda - Symantec Time Stamping Services Signer - G3

MD5 security rating in our database

536 files (Not yet rated and not signed)
12 files (Not yet rated and digitally signed)
14 files (Safe and not signed)
378 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to services.exe. Always make sure that your file is from a verified publisher.

User ratings for this file

File rating: Average rating of services.exe: by 940 files and users.

Application errors

Fix services.exe application error:  Run a FREE registry scan

User comments

There are no user comments yet for this file.


Please add your comments if you have more information about this file or if you know how to solve services.exe application errors.


File safety :

File security rating :

Are you human? How much is 5+5:


Like this page?

Please support this free service by giving us a Google+1


Browse files by letter

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

More system processes

servicescache.exe servicesceleton.exe ServiceScheduler.exe
serviceservice.dll serviceses.exe servicesetup.exe
servicesg.exe serviceshellnt.exe serviceslib.dll
ServicesOptimizer.exe servicestub.exe servicesys.dll

Lansweeper computer inventory From the creator of Runscanner:

Lansweeper
is an automated IT asset management tool. It can quickly scan your computers and has over 250 default reports available.

There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality.