Malicious file
winsrv.exe: what it is and how to remove it
winsrv.exe is not a Windows program. The old report ties the name to the SdBot family of IRC backdoor worms, which use a system-like name to hide. Windows has a similar file, winsrv.dll, but it is a library, not an .exe. A winsrv.exe on your PC, also searched as winserv.exe or wimserv.exe, needs a scan.
Prefer to do it yourself? The manual steps follow.
The old report classed winsrv.exe as a malicious file of the SdBot worm and IRC backdoor family. Windows itself has no program with this name, so a winsrv.exe in the Windows folder or running in Task Manager should be scanned and removed.
The name alone is a clue, not proof. We could not find a published analysis of one specific winsrv.exe sample, so the family and the folder come from the old report. A file is malicious because of where it sits, who signed it and what a scan finds.
- Type
- Worm and IRC backdoor Trojan, SdBot family (the old page names the variant as SdBot.bhk)
- Also searched as
- winserv.exe, wimserv.exe, winsrv, win srv; these are the spellings that reached the old page
- Part of Windows
- No. Windows has winsrv.dll, a library used by the console subsystem, but no winsrv.exe
- Reported folder
- %WinDir%, the Windows folder (usually C:\Windows)
- Start-up
- Creates a start-up entry and runs at every boot, per the old page
- Task Manager
- Appears as a process named winsrv.exe
- Disguise
- Uses the name of a Windows service; may also use names of genuine files or inject code into genuine processes
- Detection names
- None confirmed for this exact file; the old page gives only the family name SdBot.bhk
What winsrv.exe is
The old report says winsrv.exe is a malicious file of the SdBot.bhk computer worm family and the IRC backdoor Trojans. SdBot is an old and widely copied backdoor family. Microsoft describes another member, Backdoor:Win32/Sdbot.TB, as a Trojan that connects to an IRC server to receive commands from attackers, which can include spreading to network shares, denial of service attacks, setting up a proxy and downloading files. That description belongs to a different sample, so it shows what the family can do, not what this file does.
The old report says the executable is used to run malware on the computer or to launch some of its components, and that it takes the name of a Windows service to get past the PC's protection. A name that looks like a system file is a common disguise.
Do not confuse it with winsrv.dll. That is a genuine Windows library loaded by the Client Server Runtime process (csrss.exe), where it handles console windows and user services. A .dll is not a program that runs on its own and does not appear as a separate process. If a file named winsrv.exe exists, it is not that component.
The old report says winsrv.exe malware can use the names of legitimate Windows files or inject malicious code into legitimate processes. The file you see may therefore be only one part of the infection.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How it arrives
The old report says the executable can enter the PC as a Trojan horse: it looks like a useful program or an update for one. Malware like this normally needs the user to take part.
The old report lists two typical ways: downloading illegal or corrupted software, and clicking a malware-laden ad.
Because of these routes, be careful when you click and download on the web. Keep Windows and your programs updated too. The old report says some threats use exploit kits that take over devices through security holes in outdated software.
The SdBot family has a documented way of spreading through network shares that have weak administrator passwords (Microsoft, Sdbot.TB). Whether this file does it was not confirmed.
How to find it
Do these in order. A winsrv.exe that is explained by none of them is a reason to scan.
- Look in Task Manager Press Ctrl+Shift+Esc, open the Details tab and sort by name. The old report says the file creates an entry there under winsrv.exe. Right-click it and choose Open file location.
- Search for the file Look for every copy. The old report names %WinDir% as the folder. Windows has no winsrv.exe, so any result is unexplained.
dir /s /b C:\winsrv.exe - Check the digital signature Right-click the file, choose Properties > Digital Signatures. A file with no signature, or one not signed by Microsoft, is not a Windows file.
Get-AuthenticodeSignature "C:\Windows\winsrv.exe" | Format-List Status, SignerCertificate - Check start-up entries The old report says the file adds a start-up entry that runs at every boot. Open Task Manager > Startup apps, then check the Run keys in the registry.
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - Look for scheduled tasks Open Task Scheduler and look for tasks you did not create that run a program from the Windows folder.
schtasks /query /fo LIST /v - Scan with Microsoft Defender Open Windows Security > Virus & threat protection > Scan options. Run a full scan, and then the Microsoft Defender Offline scan, which runs before Windows starts.
A clean scan does not prove that the file is harmless, and a file in the Windows folder with a system-like name can still be a copy of malware. When the file is unsigned and Windows has no such program, treat it as malicious.
How to remove winsrv.exe
Remove it together with the malware it belongs to. The old report advises against ending its task and deleting one file: related files are hard to find, and malware can use genuine names, so you could delete the wrong entries and cause more damage.
- Disconnect from the network Unplug the cable or switch off Wi-Fi so a backdoor cannot receive commands or spread to other PCs while you clean up.
- Start Windows in Safe Mode with Networking Some malicious programs are designed to block security tools. In Safe Mode with Networking, the old report says they can be disabled so a scan can run. Hold Shift while you choose Restart, then Troubleshoot > Advanced options > Startup Settings > Restart, and press 5 or F5.
- Run the Microsoft Defender scans Update the definitions, then run a full scan, then the offline scan (Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan). Let Defender remove what it finds.
Update-MpSignature Start-MpScan -ScanType FullScan - Check the start-up entries and tasks again After the scan, open Task Manager > Startup apps, the Run registry keys and Task Scheduler. Remove nothing you cannot name; if an entry still points to winsrv.exe, search again for the file.
- Repair system files Malware can leave genuine files damaged. Repair them from an administrator prompt.
sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth - Change your passwords A backdoor can give an attacker control of the PC. From a clean device, change the passwords of your email, bank and other accounts, and the Windows account password.
- If it keeps returning A file that comes back after a restart means a part of the infection is still running. Back up your documents and reset or reinstall Windows (Settings > System > Recovery).
Warning signs
| What you see | What it means |
|---|---|
| winsrv.exe in Task Manager or in the Windows folder | Windows has no program with this name. The old report places the file in %WinDir% and says it launches its tasks at once. |
| A start-up entry for winsrv.exe | The old report says the file adds one, so it starts every time you turn the PC on. |
| Browsers flooded with ads or redirected to suspicious websites | Effects the old report listed after an attack. |
| Unknown programs or browser extensions installed | Another effect the old report listed. Something is installing software without you. |
| Files you cannot open because of an unknown extension | Another effect the old report listed after an attack. |
| A name that is one letter off a Windows file (winserv, wimserv) | Names made to look like system files. Check the folder and signature of every one. |
Questions people ask
What is winsrv.exe?
The old report calls winsrv.exe a malicious file of the SdBot.bhk worm and IRC backdoor family. Windows has no winsrv.exe. It has winsrv.dll, a library inside the console subsystem, which is a different file. We could not find a published analysis of a specific winsrv.exe sample, so treat the file as suspicious and scan it.
Is winsrv.exe a virus?
Yes, according to the old report, which says the file belongs to a worm and backdoor family and is used to run malware or start its components. Windows does not ship a program with this name, so a file you cannot tie to software you installed should be scanned and removed. The name alone is not proof, so check the folder and signature.
Is winsrv.dll the same as winsrv.exe?
No. winsrv.dll is a genuine Windows library that the Client Server Runtime process (csrss.exe) loads for console windows and user services. It is not a program and does not run as its own process. winsrv.exe is a different name and, if it exists on your PC, is not part of Windows. A winsrv.dll outside the System32 folder is also worth checking.
What are winserv.exe and wimserv.exe?
They are probably misspellings of winsrv.exe, since people searched all three and landed on this page. We found no source that describes a Windows program called winserv.exe or wimserv.exe. Check any file with these names the same way: its folder, its digital signature and a Microsoft Defender scan.
Can I just delete winsrv.exe?
Not safely on its own. The old report warns that malware often has related files and registry entries that are hard to locate, and that it can use genuine file names, so deleting by hand can remove the wrong items. Run a full and an offline Microsoft Defender scan, preferably in Safe Mode with Networking, and let it remove the whole threat.
How did winsrv.exe get on my PC?
The old report says it can arrive as a Trojan horse that looks like a useful program or an update, typically through illegal or corrupted software or a malicious ad. It also says outdated software can be hijacked by exploit kits. SdBot variants have also spread through network shares with weak administrator passwords, a route described by Microsoft for one of them.
Why does winsrv.exe start every time I turn on the PC?
The old report says the file creates a start-up entry, so it runs at every boot. Look in Task Manager > Startup apps, the Run registry keys and Task Scheduler. Do not only disable the entry: removing the start-up item does not remove the malware, so run the Microsoft Defender full and offline scans.
Sources
- Microsoft Security Intelligence: Backdoor:Win32/Sdbot.TB (a member of the SdBot family)
- Windows CSRSS write-up: winsrv.dll handles console management and user services
Version data read on Oct 8, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…