Program file
utcsvc.exe: the Diagnostic Tracking Service name, and why it needs a check
utcsvc.exe is a name linked to the Diagnostic Tracking Service (DiagTrack) and to the TouchUtility Manual Right Click package. The old report called the genuine file harmless but often flagged. A copy over 53 KB, running several times or using over 30 percent of the CPU is suspect.
Prefer to check it yourself? The manual checks follow.
The old report said the original utcsvc.exe is not malicious and seldom has problems, and that it is part of Windows under the name Diagnostic Tracking Service. Check the folder, the size and the signature before you decide.
Despite that, the old report said many antivirus vendors flag it as a potentially unwanted program (PUP), and that it is often misused. A file over 53 KB, several copies, or CPU use above 30 percent is a sign of misuse.
- Also known as
- Diagnostic Tracking Service, DiagTrack, TouchUtility Manual Right Click
- Process name
- Shown as Service Host in Task Manager, according to the old page
- Developer
- The old page said it was created by TouchUtility, not by Microsoft, although it called the file part of Windows
- Size of the original
- Not more than 53 KB, according to the old page
- Detections reported
- In 2018 the old page cited 12 of 55 antivirus programs on VirusTotal and higher rates on Hybrid Analysis
- Suspect signs
- Several instances, CPU use above 30 percent, a file larger than 53 KB
What utcsvc.exe is
The old page said utcsvc.exe is an integral part of Microsoft Windows. It said the process can be translated as Service Host, is known as DiagTrack and has the full name Diagnostic Tracking Service, and that it can be found in Task Manager on any version of Windows. It said the file is considered part of the TouchUtility Manual Right Click package.
The same old page said that despite being part of Windows it is not developed by Microsoft but by TouchUtility. Those two claims do not fit together, so do not treat the name alone as proof. Microsoft documents the Windows service named DiagTrack as Connected User Experiences and Telemetry, and its diagnostic data is described on Microsoft Learn.
In 2018 the old report cited VirusTotal, where 12 of the major 55 antivirus programs flagged the file as malicious. It said Hybrid Analysis gave an even higher detection rate, and that Emsisoft detected more than 100 files associated with utcsvc.exe and marked them untrusted.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check utcsvc.exe
Look at how many copies run, how much CPU they use, the file size and the folder.
- Open Task Manager. Press Ctrl+Shift+Esc and look for utcsvc.exe on the Processes or Details tab. If it appears several times, or uses more than 30 percent of the CPU, treat it as suspect.
- Check the file size. Right-click the process, choose Open file location, then Properties. The old page said the original file does not exceed 53 KB; a bigger file is a sign of misuse.
- Check the signature. Right-click the file, Properties, Digital Signatures. If the signer is missing or is not a company you recognise, do not trust it. In PowerShell:
Get-AuthenticodeSignature (Get-Process utcsvc).Path | Format-List Status, SignerCertificate - Look at your programs. Open Settings > Apps > Installed apps and check whether the TouchUtility package is installed. If it is not, nothing you installed explains the file.
- Scan before you remove it. Run a full scan and an offline scan with Microsoft Defender (Windows Security > Virus & threat protection > Scan options). The old page said to scan the file before removal, because deleting a harmless file can damage the system or some programs.
Without a build list for this name there is no hash check here. Size, folder, signature and a scan together are the evidence.
Do you need utcsvc.exe?
Do not delete it before you know what it is. The old page said that removing a harmless utcsvc.exe could damage the computer, the operating system or some programs.
- Scan the file first. Run a full and an offline Microsoft Defender scan. The old page advised against stopping or deleting the file until you know it is malicious.
- If the TouchUtility package is the source. Open Settings > Apps > Installed apps, select the TouchUtility package and choose Uninstall, if you do not need it.
- If the file is malicious. The old page said to avoid removing it by hand, because malware may have other components that must be removed together. Let Microsoft Defender remove what it detects, then check Startup apps and Task Scheduler for leftovers.
- Check how it arrived. If you opened an attachment in spam email or downloaded illegal content before the problems began, assume other malware came with it and scan again.
Warning signs
| What you see | What it means |
|---|---|
| Several utcsvc.exe processes at the same time | The old page said multiple instances are a sign of a possible infection. |
| CPU use above 30 percent | The old page gave this as a threshold for a likely virus. |
| File larger than 53 KB | The old page said the original should not exceed this size. |
| System alerts or aggressive ads flooding the browser | The old page linked these to the file being used by unwanted software. |
| You cannot open some of your files | The old page said the file might be able to run ransomware. |
| Credentials or banking details at risk | The old page listed theft of banking data, card details and logins as a possible task of malicious copies. |
Other names and related questions
What is svchost.exe -k utcsvc -p?
It is a Service Host (svchost.exe) process that runs the utcsvc service group. Resource Monitor shows it as svchost.exe (utcsvc), and the service inside is Connected User Experiences and Telemetry, which Microsoft renamed from the Diagnostics Tracking Service (DiagTrack).
Microsoft says this component manages the diagnostic data events and diagnostic logs that Windows can send. It is a normal Windows service and not a separate file called utcsvc.exe. As for any svchost.exe, check that the file behind it is the signed Microsoft copy in System32.
Questions people ask
Is utcsvc.exe a virus?
The old report said the original file is not malicious and seldom has problems, but that many antivirus vendors flag it as a potentially unwanted program because it is often misused. It cited 12 of 55 detections on VirusTotal in 2018. Judge by size, folder, number of copies, CPU use and a scan, not by the name.
Is utcsvc.exe part of Windows or of TouchUtility?
The old page said both: that it is an integral part of Windows known as Diagnostic Tracking Service or DiagTrack, and that it was created by TouchUtility and sometimes counted as part of the TouchUtility Manual Right Click package. These claims conflict, so the safest approach is to check the file's folder and signature on your own PC.
How big is the original utcsvc.exe?
The old page said the original utcsvc.exe should not exceed 53 KB. A larger file that uses a lot of CPU and runs several processes at once was described as very likely to be used by a virus. Check the size in the file's Properties after you open its location from Task Manager.
What could a malicious utcsvc.exe do?
The old report said it was unknown which threats the file might spread, but that it might be able to run ransomware and steal personal information such as banking data, card details and logins. The signs it listed were system alerts, aggressive ads in the browser and files that will not open. These are possible, not confirmed, behaviours.
How can a malicious utcsvc.exe get onto my PC?
The old page said it can spread as an obfuscated file, program or update, so users are tricked into installing it themselves, for example as an illegal program, a bogus antivirus or a spam attachment. If you opened an attachment from spam email or downloaded illegal content before the problems began, scan the PC. Avoid high-risk activities online.
Should I remove utcsvc.exe by hand?
No, not before you have checked it. If the file is harmless, deleting it might damage the computer, the system or some programs. If it is malicious, it may have other components that must be removed together. Run a full and an offline Microsoft Defender scan and let it remove what it finds.
Sources
- Microsoft Learn: Windows diagnostic data
- MITRE ATT&CK: Masquerading, T1036
- Microsoft Learn: Get-AuthenticodeSignature
- ghacks: Microsoft renames Diagnostic Tracking Service to Connected User Experiences and Telemetry
Version data read on Oct 6, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…