Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
securityservice.exe is not a unique Windows system file. The name has been used by legitimate third-party security products such as ScanGuard and PCProtect, but threat researchers have also documented malware using the same filename for startup persistence and keylogging. The similarly named Microsoft component is securityhealthservice.exe, the Windows Security Health Service; it is a different file.
Do not delete or allow securityservice.exe based on its name alone. Verify its complete path, publisher and digital signature, SHA-256 hash, parent process, persistence entries and the software that installed it. Then scan the computer and repair, uninstall or quarantine the file according to what those checks show.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What can the filename securityservice.exe represent?
The filename is shared by unrelated programs, so Windows cannot identify the file’s owner from the name alone. Public records show at least three relevant possibilities:
- A third-party security product. FreeFixer lists a copy at
C:Program Files (x86)ScanGuardSecurityService.exe. Malwarebytes and an ANY.RUN sandbox record PCProtect usingC:Program Files (x86)PCProtectSecurityService.exe. - Malware impersonation. LevelBlue’s KarstoRAT report describes a copy placed in
%APPDATA%MicrosoftWindowsStart MenuProgramsStartupSecurityService.exe. That location causes the executable to launch at every user logon, and the report associates the sample with keylogging. - A spelling look-alike. Microsoft’s Windows Security Health Service is
securityhealthservice.exe, notsecurityservice.exe. Evidence that the former is part of a clean Windows installation does not prove anything about the latter.
Because the same name can be legitimate or malicious, an error message, high CPU use or a process in Task Manager must be investigated in context. There is no authoritative error catalog showing that one command fixes every securityservice.exe failure.
Popular on Amazon
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Is securityservice.exe safe?
It may be safe when it belongs to a security product you intentionally installed and its path, signer and behavior match that product. It is suspicious when it runs from a user profile, Startup, Temp or another unexpected directory, creates unexplained services or scheduled tasks, or has a signer that does not match the installed software. A valid signature is useful evidence, but it is not a guarantee: ThreatInfo leaves one signed ScanGuard-associated sample under review.
| Check | More consistent with an installed product | More concerning |
|---|---|---|
| Location | A known vendor directory such as the documented ScanGuard or PCProtect folders under Program Files (x86) |
%APPDATA%, a Startup folder, Temp, Downloads or an unfamiliar Windows subfolder |
| Publisher | The signer matches the security product you chose to install | Unsigned, invalid, or signed by an unrelated publisher |
| Hash and version | Matches a value published by the vendor or a reputable malware-analysis record | Unknown hash, changing copies, or a version with no credible provenance |
| Persistence | Expected service or startup entry created by the installed product | New Run-key value, scheduled task or service pointing to AppData or Temp |
| Provenance | You can identify the installer and still want the product | No one remembers installing it, or the associated product is unwanted |
| Behavior | Activity is explainable by the product’s security functions | Keylogging, unexplained network activity, repeated recreation after deletion or other behavior unrelated to the product |
Use several checks together. A file in a vendor directory can still be compromised, and a file with no signature can be an old or badly packaged program rather than malware. The combination of path, signer, hash, persistence and provenance is much stronger than any single clue.
How do I identify the exact file running on my PC?
Start with the process that is actually running, not a similarly named file found by a web search. Keep the file in place until you have recorded enough information to identify it.
- Open the location from Task Manager. Press
Ctrl+Shift+Esc, select the Details tab, findsecurityservice.exe, right-click it and choose Open file location. Copy the complete path, including the drive letter and filename. If the process is not running, search the locations shown by the error message and your installed-program list. - Record the file properties. Right-click the file, choose Properties, and note the General tab’s size and dates, the Details tab’s product and version fields, and the Digital Signatures tab. Select each signature, choose Details, and record whether Windows reports that the signature is valid and who signed it.
- Compare the signer with the product. A signer such as Protected Antivirus Limited or Protected.net Group Limited has been reported for one ScanGuard sample, but that fact alone does not authenticate every file bearing the name. The signer should make sense for software installed on your computer.
- Calculate a SHA-256 hash. Open PowerShell and run the following command, replacing the path with the one you recorded:
Get-FileHash -Algorithm SHA256 "C:fullpathsecurityservice.exe"
Save the resulting hash and compare it with a value published by the relevant vendor or a reputable malware-analysis database. File size is not an identity test. - Inspect the parent process. In Task Manager’s Details view, add or review the Parent process ID column, then use a trusted process-inspection utility or Event Viewer to determine what launched the executable. A security product launching its own service is expected; a script host, document reader or random user application warrants closer examination.
If the location, signer or hash cannot be reconciled with software you knowingly installed, treat the file as untrusted until a scan and further investigation say otherwise.
How can I check whether securityservice.exe starts automatically?
Malware often survives a reboot by registering persistence. Review each Windows startup mechanism before attempting removal, and write down entries so you can restore a legitimate configuration if necessary.
Services
Press Win+R, enter services.msc, and look for a service whose executable path points to securityservice.exe. Open its properties and record the service name, display name, startup type and Path to executable. Do not stop or disable a service merely because its display name contains “Security”; first compare its path and signer with the installed product.
Also popular on Amazon
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Task Scheduler
Open Task Scheduler, expand Task Scheduler Library and inspect tasks created around the time the file appeared. In each task’s Actions tab, check whether it launches the executable from AppData, Temp or another unexpected location. The presence of a task is evidence to investigate, not proof by itself; some legitimate products schedule updates.
Startup apps and folders
In Windows 11 or 10, open Settings > Apps > Startup and review entries associated with the file or its parent product. Also press Win+R, enter shell:startup, and inspect the current user’s Startup folder. The KarstoRAT report specifically documents SecurityService.exe copied into the user Startup folder to run at logon.
Run keys
Use Registry Editor only after creating a backup. Check HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun and HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun for values that launch the file. A value pointing to an AppData or Temp copy, especially one you do not recognize, is a strong warning sign. Export a key before changing it, and do not remove entries belonging to software you still need without confirming the effect.
What should I do if a scan finds a suspicious securityservice.exe?
Scan before manual deletion. Removing only the visible executable can leave a service, task or Run entry that restores it, while deleting a legitimate product file can break that product.
- Update protection first. Open Windows Security, go to Virus & threat protection, select Protection updates and choose Check for updates.
- Run a full scan. In Virus & threat protection > Scan options, choose Full scan. Allow the scan to finish and note the detection name, affected path and action taken.
- Run Microsoft Defender Offline. From the same Scan options page, select Microsoft Defender Offline scan. Save open work before confirming; Windows restarts and scans before the normal desktop loads, which can prevent an active process from interfering.
- Uninstall unwanted software. Open Settings > Apps > Installed apps (or Apps > Apps & features on some Windows 10 builds), sort by installation date and remove the security product or other program you did not intend to keep. Use the vendor’s official uninstaller when one is provided.
- Quarantine before deleting manually. Let Defender quarantine the detected file where possible. If the associated program is confirmed unwanted and the scan is clean, disable its persistence entry, reboot, and verify that the file does not return. Do not bypass a protection warning to make an unknown executable run.
- Submit a suspicious sample when appropriate. Microsoft recommends submitting suspicious files for analysis. Preserve the hash and path, and follow Microsoft’s current submission instructions rather than uploading confidential files to an untrusted service.
After cleanup, run another full scan and recheck Services, Task Scheduler, Startup and the Run keys. A file that reappears indicates that a surviving installer, task, service or another component is still restoring it.
How do I repair a legitimate securityservice.exe installation?
If the file belongs to a security program you want to keep, repair that program instead of replacing the executable with a download from a random website. The exact menu names vary by product, but the safe sequence is consistent.
Also popular on Amazon
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Open Settings > Apps > Installed apps and identify the product associated with the file.
- Use the product’s Modify, Repair or equivalent option if it is available. Allow the repair to restore files from the product’s own installer.
- If repair is unavailable, uninstall the product, restart Windows, download the current installer from the product’s official source and reinstall it. Keep Windows Security enabled during the process.
- Check the newly installed file’s path, publisher, signature and hash again. Confirm that its service or scheduled task points to the new installation directory.
Do not copy a replacement securityservice.exe from another PC. Even if the filenames match, the version, dependencies and digital signature may not, and a replacement can introduce malware.
How should I troubleshoot a securityservice.exe error message?
The wording and timing of the error matter. Capture the exact text, the application or service that reports it, and the Event Viewer details before changing files.
Recommended Free Tools
Find the event that generated the error
Press Win+R, enter eventvwr.msc, and inspect Windows Logs > Application and Windows Logs > System around the failure time. Record the event ID, faulting application, module name, exception code and file path. Also check the product’s own crash or update log if it provides one.
Separate a missing-file error from a blocked or crashing process
A message such as “file not found” after an uninstall usually means a stale startup, service or Run entry remains. Remove the leftover entry through the product’s uninstaller or the corresponding management console after confirming it is not needed. A crash with a valid installation can instead indicate a damaged dependency, incompatible update or interference from another security program; repair or reinstall the owning product and review recent changes.
Use Windows security troubleshooting
Microsoft’s general security troubleshooter can re-enable protections including User Account Control, Data Execution Prevention, Windows Firewall and antivirus settings. Use it when a security setting was changed or disabled, not as a way to whitelist an unknown executable. Never turn off security controls merely to suppress an error.
When system recovery is appropriate
If detections continue after Offline scanning and removal of the associated software, use Windows recovery options such as System Restore to a point before the file appeared, or Reset this PC after backing up personal files. Persistent compromise can expose saved credentials, so change important passwords from a known-clean device and enable multifactor authentication where available.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Could a pop-up about securityservice.exe be a technical-support scam?
Yes. A browser page or phone call that displays a frightening “securityservice.exe” warning and demands payment is not proof of a Windows infection. Microsoft’s published guidance says, “Microsoft error and warning messages never include phone numbers.”
- Do not call a number shown in a pop-up.
- Do not install remote-control software at a caller’s request.
- Do not provide passwords, recovery codes or payment details.
- Close the browser tab or window, then run Windows Security yourself from the Start menu.
- If you already granted remote access, disconnect the PC from the network, uninstall the remote-access program, scan from a clean environment and change credentials from another device.
What information should I keep before asking for help?
Support staff can diagnose this filename far more reliably when you provide evidence rather than only the error text. Keep a plain-text record containing:
- the complete path and drive letter;
- publisher, signature validity, product name and version;
- the SHA-256 hash;
- the parent process and any service name;
- scheduled-task, Startup and Run-key entries;
- the exact error text, Event Viewer event ID and time;
- the product installer or update that introduced the file; and
- Defender’s detection name and scan action.
Redact usernames, license keys and other personal data before sharing screenshots or logs publicly. Do not upload the executable itself unless a trusted security provider specifically requests it through an official channel.
If you prefer an optional shortcut after completing the checks above, Outbyte PC Repair can address more than 100 common Windows issues where possible, adjust settings that affect CPU, RAM and disk load, clean temporary and cache files, and provide privacy and vulnerability checks. It runs on Windows 11, 10, 8 and 7; a category-based free trial lasts at least two days before a paid subscription, and it complements antivirus software rather than replacing it. Results vary, and no tool repairs every crash.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Frequently asked questions
Why does securityservice.exe come back after I delete it?
A surviving service, scheduled task, Startup item or Run-key value may be restoring the executable, or an installer may be recreating it at logon. Identify and remove the restoring component only after a Defender scan confirms whether the file is malicious or belongs to software you still need.
Can System File Checker restore securityservice.exe?
System File Checker is intended for protected Windows system files and will not normally replace a third-party security product’s executable. If the file is part of ScanGuard, PCProtect or another installed program, use that program’s repair or reinstall process instead.
Is renaming the file a safe way to stop the error?
Renaming can break a legitimate security product and may leave its service or task generating new errors. It also does not remove malware persistence, so identification, scanning and removal of the responsible program are safer first steps.
Also popular on Amazon
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
What if the Digital Signatures tab says the signature is valid?
A valid Authenticode signature confirms that Windows can verify the signer for that file; it does not establish that the software is wanted or behaves safely. Continue with path, hash, provenance and persistence checks, especially when the signer is unfamiliar or the file runs from a user-writable directory.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Why does securityservice.exe come back after I delete it?
A surviving service, scheduled task, Startup item or Run-key value may be restoring the executable, or an installer may be recreating it at logon. Identify and remove the restoring component only after a Defender scan confirms whether the file is malicious or belongs to software you still need.
Can System File Checker restore securityservice.exe?
System File Checker is intended for protected Windows system files and will not normally replace a third-party security product’s executable. If the file belongs to an installed program, use that program’s repair or reinstall process instead.
Is renaming the file a safe way to stop the error?
Renaming can break a legitimate security product and may leave its service or task generating new errors. It also does not remove malware persistence, so identification, scanning and removal of the responsible program are safer first steps.
What if the Digital Signatures tab says the signature is valid?
A valid Authenticode signature confirms that Windows can verify the signer for that file; it does not establish that the software is wanted or behaves safely. Continue with path, hash, provenance and persistence checks, especially when the signer is unfamiliar or the file runs from a user-writable directory.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
