Anti-Spy.Info > File library > services.exe

Information about services.exe file

File: services.exe
Name: Services and Controller app
Product: Windows
Manufacturer: Microsoft
Risk factor (Virus/Trojan/Spyware): Rating

This is the Services Control Manager, which is responsible for running, ending, and interacting with system services.

Note: The services.exe file file should appear only the C:\Windows\System32\ folder. If you happen to find this file in a different folder, it is possible that your services.exe is in reality a malicious file. Many trojans and viruses try to cloak their real identity by using the names of legitimate files. Any time that you encounter a suspicious process, you should verify the digital signature and the file path, for example using Anti-Spy.Info.

Virus with same name:
W32/Leave.B (service.exe) - Symantec Corporation
W32.Randex.R (service.exe) - Symantec Corporation
W32.HLLW.Kazping (service.exe) - Symantec Corporation
W32.XTC.Worm (service.exe) - Symantec Corporation

User feedback

There were 1629 user requests for that file. 23 users classify it as harmless. 3 users classify it as not so dangerous. 12 users classify it as neutral. 12 users considered the file to be suspicious. 48 users classify it as bad and recommend to delete services.exe. 17 users didn't classify it ("don't know").

RatingWindows Service Manager Alex
Ratingi deleted it repeatedly using Anti-Spy.Info but it keeps coming back. Tanveer
RatingWindows Service Manger Walle
Ratingif it is in the directory c:\windows\lsass directory it is dangerous hiarto miarto
RatingServices.exe is not dangerous...service.exe is(trojan)  link for more info Martin
RatingShould it be blocked by my firewall?  link for more info Brian
RatingShould be located in %windir%/system32 (ex. C:\Windows\System32) if not it could be a trojan. If its a trojan and you can't remove check text in file for other potential trojan files. Nautis
Ratingc:\windows\services.exe was found to be a trojan on my machine. Blocked with zone alarm, but still cant get rid of it. Some other process must be restoring the file at start up. Any ideas anyone? Myke
RatingIt is some kind trojan, it takes control of systems, rpc-overflow.  link for more info XGS
RatingC:\WINNT\services.exe at 8kB was the backdoor.Zincite.a virus for me. The Windows 2000 services.exe was 83 kB. Some other application (possibly C:\WINNT\jave.exe which was mydoom) kept recreating winnt\services.exe whenever I deleted it. John
RatingMy firewall asks if I want to allow it. If I do not, my AOL will not access the web except for e-mail. Herb30
Ratingshould be in windows/system32
RatingserviceS.exe is OK! service -- with no "s" beware!! ketamininja
Ratingthe system process services.exe is not dangerous but the services.exe launch with your username is dangerous. Try deleting it with Anti-Spy.Info then delete the directory and the entries in the registry : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run & HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 00s£b
RatingUltra dangerous, this file try to access some websites, and keep around 800 bytes everytime to Internet, I keep coming back, it's around 6KB, sites are: Gradius
Ratingservices.exe is Windows Service Controller it is an Application that is used only in Windows NT 4, 2000, and XP for starting, stopping, and interacting with system services. Jose
RatingThe services.exe was found in the system32\services-directory among a lot of xxx-related stuff - I renamed services.exe (could not erase directly as it was active), rebooted and removed the entire directory. Afterwards I cleaned the registry manually Henrik
RatingIt's the MyDoom virus if found in c:\Windows
Ratingwolud try to connect tcp ; send cached keys ? Roland
Ratingkeine verbindung mehr zu microsoft update / geänderte startseite Goldhammer, Norbert
RatingBackdoor.Zincite.A uses this file. The file is also referred to in registry to run at startup. "c:\windows\services.exe". Pieter Rabie
Ratingc:\windows\system32\services.exe is normal, but c:\windows\services.exe is not normal and is a trojan. jeff
RatingIf the services.exe is from C:Windows its a trojan. Follow the link for the registry fix and delete both C:Windows/services.exe and C:Windows/System32/mssyncr.exe, that's what I did and it's no longer on my computer and trying to dial out  link for more info Jake
RatingThe SecurityTaskMan says its a 100 rating for a risk. So why is it good? it is Services.exe
RatingServices.exe ist bei mir nicht nur in system 32 sondern auch in windows temper und lässt sich nicht löschen!
Ratingtrojan dropper (downloaded onto my computer from a porn site to path: C:\windows\system32\goulmn\services.exe) and registry changes. 123
RatingMicrosoft has issues and spying on Customers is one of them .... why would you need to have services @ controllers to access the net when you have Explorer?.. Services & Controller App
RatingReceived it from an msn-user, after giving him my IP-adress (stupid!!), as "server.exe". Became Services.exe after starting server.exe.
RatingI had an experience with a trojan that was c:\windows\system32\windows\services.exe! Clever bastards.
RatingIt suddenly appeared ,and makes my computer hang ,if I allow it M colston-weeks
RatingC:\WINDOWS\INETDIM\ Services.exe is a virus?? Thomas
Ratingread this! it was veery usefull to me. i remove it with this.  link for more info stavros_d
RatingI got 2 services.exe, and I had detected which 1 is the virus(download.trojan), but can't remove it as it is the same name as services.exe, how? brett
Ratingvery suspicious, what would it be doing in C:\Windows\System32\MSOffice\services.exe ? I haven't installed office at all, nor would it ever be there... all by it self! Nick
RatingIt came up as a trojan on AVG, I deleted the little sod.
RatingServices.exe is installed on my computer as a part of my XP package Cecil
Ratingtrys to connect in two tcp's. its placed in C/windows folder. stavros_d
RatingI have C:\WINDOWS\system32\MSOffice\services.exe Is this good or bad? Norton detects it on a virus scan, but I can't delete it. Should I be worried? The_Shaman
RatingI had it under C:\WINDOWS\ I deleted it and everything still works! Why keep it, you don't need it! Just delete it!
RatingI don't know much about this. I made sure the services.exe was where it was supposed to be before deleting it. Patrick
RatingThe others users who share the router can't use internet!!! Qinglin
RatingIs present in C:\WINDOWS\system32 (99kb) , C:\WINDOWS\$NtServicePackUninstall$ (106kb) and C:\WINDOWS\ServicePackFiles\i386 (106kb) Shane
RatingWell if you don't need to run your system go ahead and delete it. I would leave it be though. From what I understand services.exe basically assist is running your processes on your server. In the olden days when we would stop services remotely as a joke it would bluescreen the victims computer. I think ms fixed it so you can no longer stop it. John Kline
RatingIt's safe if it's in the System32 folder. However, I've come across it in this folder before, meaning it's not legit: C:\WINDOWS\SYSTEM\windows\services.exe Kevin Gallo
RatingConsumes ~80% of resources thereby slowing everything down
Ratingthis services.exe file mostly infects NT/win2000/XP,and it doesn't let u to delete dis file, i haven't experienced that file,but experienced a similar file to services.exe.My friend said that this file is both in windows\system32 and windows\temp folder,weird. But if u open that services.exe with a different way (such as notepad.exe or a database program like VB,C++) and remove the entire codes,lines,etc... I mean it shall be an empty file,erase everything within,and save changes,and also prevent this file to run itself during reboot as in registry.Thus u will get rid of that file dread knight
RatingMay be related to the Coolsearch adware, I've got a services.exe in C:\Windows\System32\MSOffice and another in C:\Windows\System32, the one on MSOffice is created on the same date I detect the adware. Kang
Ratingwindows\inetdim\services.exe (i changed the name and rebooted). Then I deleted the inetdim directory and no more issues cuerx
RatingINETDIM= dangerous!!!!! benny
RatingTrojan  link for more info Trojanhuter
RatingIch kann diese Datei nicht löschen (C:\windows\system32\goulmn\services.exe) Trojan Conycspa. Wer weiß wie man den los bekommt? Danke Gerárd
Ratingtry the patch... it seems go to work! this worm it's Bugging me!.. zpy
Rating I deleted services.exe then realised that was a mistake and reinstated a copy of it. Cannot execute any setup.exe files. Any help? Cheers Andy
RatingRunning as an unprivileged user I have no problems with this process, but when I log on as Administrator the services.exe process hogs the CPU (according to MS's Task Manager). The only file Find turns up with this name is in the right directory, so presumably legitimate. I have no idea what is going on; can anyone advise? Just Infected
RatingVirus has 2 files: c:\windows\services.exe & c:\windows\system32\fservices.exe (that rebuilt the first one if it's deleted). Virus is a keylogger that sends an e-mail with your keystroken everytime you connect Internet; blocks Windows XP SP2 protect shield and the Windows Xp "system restore service". You must erase the 2 files and then clean the register. Binefa Palou
RatingIts a file that is part of Windows, any file that you see, with weird names, check in System 32, if you see if there, thats where its supposed to be, if it is not there, and you find it elsewhere, then you have something to worry about. Reguardless, I suggest having NORTON 2002-2005, also norton internet security and you'll be fine. Scan your computer every three days, and dont be surfing those porn sites as much and you wont have as many Viruses! Ryan Critchett
RatingTrojan Stephen
Ratingafter a combined trojan attack, i had a file in system32 that in HJT and Find It! logs lists as "??rvices.exe", and in windows explorer shows as a hidden file named services.exe (same name as the legal, visible file in the same folder). Since in Properties dialog it didn't have any mention of Microsoft, i deleted it in safe mode, with no bad effects. Karo
Ratingservice.exe (not services.exe) is a trojan which in my case runs as a process and resides in memory. Once it has loaded as a process it is deleted from the windows system folder. I have yet to locate it because of this. admin
RatingThis is an important and valid file. How ever some viruses call it to perform malicious acts. Search your registry in the (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) you probably have a problem if there is any reference to it there, ie. "Services.EXE"="%windir%\services.exe" Tony C
Ratingdon't know but it was previously NOT being flagged by my firewall (zonealarm) and I had no problems. Once it was recognized by ZA if I deny it access I have NO internet access whatsoever. Path is C:\WINNT\System32. I see alot of conflicting info here but I want it off, any suggestions? I'm a novice... Bob
RatingWhen I do a search, it comes up in the System32 folder and the C\:windows\System32\dllcache folder as well. Is the file in the dllcache ok or is it a virus? Bob H
RatingMy system was sending and receiving without my request. I read these notes, deleted c:\windows\system\services.exe and c:\windows\system32\mssyncr.exe and the connection usage has stopped. Jon
RatingThe real deal (for win 2k): C:\WINNT\system32 - AND- C:\WINNT\ServicePackFiles\i386 are essentially the same Windows Operating System services and manages the operation of starting and stopping services like net connection. DO NOT REMOVE THESE FILES. All other "services.exe" are HIGHLY suspect. To COMPLETELY remove them you'll need to find what other files are reinstating them. The free downloadable HiJackThis "sniffer" can usually find the related files. Delete "bad" service.exe. Next powerdown and at startup press F8 (safemode) to remove the associated files.
Ratingservices.exe got 100% pc usage when i start up and i can not acces anymore takes a lot of tries to be able to do anything internet does not work anymore using WLAN USB to connect makes me mad phanz
Ratingwhen i run ad-aware and the file is detected it reboots my computer after 45 seconds or so... Jesper
RatingNormally an system process (in windows-folder) Zutty
RatingIt has a keylogger and sends an e-mail with your keystroken everytime you connect Internet. It is associed with the file "fservices.exe" in the system32 directory that remakes "service.exe" (in windows" directory) if is deleted" Josep Binefa
RatingServices.exe is a virus that will destroy your hard drive and if not removed in time will infect you mobile phone via bluetooth if you have a bluetooth dongle.. Billy
Ratingmy cpu is 100% from this process so what can i do? nick
Ratingbackdoor.win32.Prorat.19g (as told by Kaspersky) fdalplr
RatingI have it located in C:\windows\services.exe. It runs alongside the microsoft services.exe (C:\windows\system32\servcies.exe) and cannot be closed. Nothing detects it as a virus/adware/trojan etc and when i delete it it apears again after reboot. no refrences to it in the registry. Have found refrences within the file to http// and http// along with http// Only 11Kb in size. I have no fix yet... BrowneR
RatingIf located in c:\windows and is about 10-12kb then delete it and also mssyncr.exe (located in C:\windows\system32) to remove virus. (do it in safe mode) If located in C:\windows\system32 and signed by microsoft leave alone! BrowneR
Rating65 kb cant shut it down , located in windows/inet10055
Ratingwell all i can say is i am running win200 pro and when i start up, zonealarm popups and says 'services and controller app is connecting to the internet' then my cpu goes right up to 100% and stays there, making my computer unusable rubixcube
Ratingrestarts system - delete it..... Win-User
RatingI understand in itself, it's not a bad file BUT it CAN be dangerous. I notice that when I stop all the rundll32.exe processes (because I always have like 10 running) I STOP getting pop-ups. The minute a pop-up window comes to annoy me, I check the programs running in task manager and what do you know! Rundll32.exe is BACK! I did the experiment a few times so there IS a link between that process and stupid pop-ups, the question is, HOW do I go the root of that process and delete what needs to be deleted? Melissa
Ratingis also in a service pack, swallows much CPU during boot Flyervv
RatingCPU Utilization in Services.exe Increases to 100 Percent for 3 minutes every time i connect to the web. Ronen
RatingI suspect this file is using my computer to mail unwanted eml to some targeted port. I had over 120 messages scanned by avg that weren't even in my mailbox. I went to task to see what was using so much rescources and found this services.exe file right up there. I next did a file search and found it in system 32 and in system 32/dllcache. I wasn't sure about which one was legitimate, so I came to this page. there sure are alot of different opinions here. mf
RatingI accidently arrowed on it, while trying to arrow on. film
RatingWindows services manager. Don't start deleting things until you are certain that the file is malicious. Jerry
RatingThe application or DLL C:\WINDOWS\system32\umdmx.frm.dll is not a valid windows image. Please check this against your installation diskette. Losing my mind~
RatingI found a duplicate of services.exe in the sys32 folder. It said that it had been created earlier in the week. I just renamed the little bugger to an inert file type. It's a good tactic for those annoying ones that won't go away. Good hunting! navizero
RatingThe normal services.exe should be in path windows/system32/services.exe , if it is somewhere else its a troijan horse. to remove it go to path documents and settings\all users\application data\SecTaskMan and delete all files which contain "services". then use for example giants ad-aware to get rid of the file. m0nni
Ratingservices.exe is safe if u want to check it simly search the file right click it show the version if not then scan this file
RatingFile c:\windows\services.exe, size 6013 bytes. Is restores itself somehow during system start-up. Sends keystrokes to Interferes with internet operations heavily. Absent in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" path of the registry. Avast antivirus does no see it. All my hopes are for Dr.Web antivirus now. Oleg
RatingFor those who have reported it coming back, have you turned off System Restore before removing? As it's in the Windows folder, System Restore will reinstate the file if it is removed or corrupted. Once cleaned, you can turn System Restore back on. This is the same for any virus/trojan that places itself in a system folder. Danneey
Ratingcan be dangerous. the original services.exe is not, but mine was substituted with another one, that took my processor 100%. renaming it was possible but a new services.exe appeared. Restoring my w2k image was best. paul
RatingThis is the Services Control Manager, which is responsible for running, ending, and interacting with system services. pieter
RatingCan be dangerous. If found outside the C:\windows\system32 directory, it's a virus. Otherwise, leave it alone. It's an integral process.
Ratingc:\windows\system32\msmon.exe pop up wilfred
RatingThis is an important and valid file. How ever some viruses call it to perform malicious acts. Search your registry in the (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) you probably have a problem if there is any reference to it there, ie. "Services.EXE"="%windir%\services.exe" senthil
RatingIts a normal windows file and it's location is C:\windows\system32. But on my system the process always takes 20% of my cpu usage. taichi
RatingI have two "services.exe" application. One application is in the "C:\windows\system32" folder, and the other application is in the "C:\windows\ServicePackFiles\i386" folder. Geneva
RatingIt is part of Windows therefore...(swear words) I find it necessary to do some intermet access via task manager. I let it access the internet but I don't let it act as a server with out any problems from chat etc. Alan M
RatingI repetedly have to block/allow connections while logged as normal user but never when logged as administrator in Windows XP MFais
RatingWindows Service Manager, gefährlich wenn ausserhalb von Windows\System32! und genau dort kein Unterverzeichniss! matze
Ratingharmless as far as I know Lore
RatingNot Dangerous... but quite a pain in the rear. Easy steps to stop 'services.exe' maxing Out cpu 100% Pip
Ratingthe windows file is located at C:\Windows\system32, if that file is somehere else its a trojan or worm ..... V8
If you know more about services.exe, so post it here.
Your opinion:
Your info
about that file:
Website with further details:
Your Name:

Search Results for services.exe in

Other files

csrss.exe dllhost.exe kernel32.dll lsass.exe mdm.exe msmsgs.exe regsvc.exe rundll32.exe services.exe spoolsv.exe system winlogon.exe wisptis.exe wmiexe.exe wuauclt.exe [all]
(c) 2014 Anti-Spy.Info