Is it a Virus?
✔ NO - Safe
Must be located in C:\Windows\System32\pshed.dll
Usage Overview
Typically loaded by OS services and tooling; not a standalone app
Loaded by Windows performance and diagnostic components; look for legitimate signed binaries
Can I Disable?
✖ NO
Disabling can destabilize OS components relying on instrumentation
What is pshed.dll?
pshed.dll is a Windows system library that supports debugging and performance analysis features used by Windows Performance Toolkit and various system diagnostics tools. It helps provide data collection, instrumentation, and event processing for performance counters, crash analysis, and reliability features. It is loaded automatically by Windows and developer tools.
pshed.dll is a system DLL that provides instrumentation hooks and event handling support for Windows performance tools. It is loaded by services and debuggers to collect timing and diagnostics data, and is not intended for user interaction.
Quick Fact: pshed.dll participates in instrumentation hooks used by tracing tools for system diagnostics and performance analysis.
Contexts Where pshed.dll Is Used
- System Services: Loaded by core Windows services to enable instrumentation and telemetry
- Developer Tools: Used by IDEs and debuggers (e.g., Windows Performance Toolkit) for profiling
- Performance Monitoring: Engaged by PerfMon and related telemetry collectors to gather timing data
- Diagnostics Framework: Runs within diagnostics pipelines to assist crash analysis and reliability checks
- Sandboxed Modules: Loaded by sandboxed or isolated processes to enable event instrumentation
- Kernel/User-Mode Bridge: Facilitates instrumentation data flow between kernel and user-mode components
Is pshed.dll Safe?
Yes, pshed.dll is safe when it is the legitimate file from Microsoft located in C:\Windows\System32 and digitally signed by Microsoft Corporation.
Is pshed.dll a Virus or Malware?
The real pshed.dll is not a virus. Malware may masquerade with similar names; always verify the file location and signature.
How to Tell if pshed.dll is Legitimate or Malware
- File Location: Must be in
C:\Windows\System32\pshed.dll or C:\Windows\SysWOW64\pshed.dll. Any other path is suspicious.
- Digital Signature: Right-click the file in Explorer or Task Manager -> Properties -> Digital Signatures. Should show "Microsoft Corporation".
- Resource and Behavior: pshed.dll is a library; it should not spawn new processes or establish external connections. If you notice unusual activity, scan for malware.
- Antivirus Verification: Run a full system scan with Defender or another trusted AV to confirm legitimacy and ensure signature integrity.
Red Flags: If pshed.dll is located outside the System32/SysWOW64 folders, lacks a valid signature, or triggers unexpected network activity or process spawns, perform an immediate system scan and consider repair.
Why Is pshed.dll Running on My PC?
pshed.dll runs to support Windows performance instrumentation, debugging hooks, and diagnostics data collection. It can be loaded by OS services, performance tools, or developer software that monitors system health.
Reasons it's running:
- System Initialization: Loaded during startup by core Windows services to enable telemetry and performance hooks
- Performance Analysis Tools: Tools like Windows Performance Toolkit load it to collect event data and trace information
- Developer Debugging Sessions: If Visual Studio or other debuggers are installed, they may load pshed.dll for profiling
- Diagnostics and Telemetry: Diagnostics frameworks use the DLL to gather reliability and health data
- Kernel/User-Mode Instrumentation: Some tracing features require instrumentation across kernel and user mode components
Can I Disable or Remove pshed.dll?
No, you should not disable pshed.dll. It's part of Windows performance and diagnostics infrastructure; removing it can destabilize the OS.
How to Stop pshed.dll
- Identify Loaded Contexts: Open Task Manager (Ctrl+Shift+Esc), go to Details, and identify processes that load the module; end non-critical tasks if safe.
- Disable Unneeded Tools: If you have third-party profiling tools, disable or uninstall them to reduce instrumentation.
- Minimize Startup Load: Review startup items in Task Manager -> Startup and disable nonessential items that trigger performance monitoring.
- System File Integrity: Run sfc /scannow to repair corrupted system files that could involve pshed.dll.
- Keep Windows Updated: Install latest Windows updates to ensure PShed-related components are current and stable.
How to Uninstall pshed.dll
- ✔ Not applicable: pshed.dll is a component of Windows; it cannot be uninstalled separately.
- ✔ If you installed Windows Performance Toolkit, uninstall via Programs and Features or add/remove components.
- ✔ Consider a system repair or in-place upgrade if you suspect corruption and cannot resolve issues.
Common Problems: High CPU or Missing pshed.dll
If pshed.dll-related issues appear, follow these steps to identify legitimate usage and repair problems without destabilizing the system.
Common Causes & Solutions
- Unknown or suspicious processes loading pshed.dll: Use Task Manager Details or Sysinternals Process Explorer to identify the host process and verify it’s legitimate; end or quarantine if suspicious.
- Missing or corrupted pshed.dll: Run sfc /scannow and DISM to repair system files; replace from a known good Windows image if needed.
- Outdated Windows or toolkit components: Update Windows and any installed development or performance toolkit to the latest version.
- Malware masquerading as pshed.dll: Perform a full antivirus scan and verify the digital signature and file path (C:\Windows\System32\pshed.dll).
- Excessive instrumentation by debug tools: Disable or reconfigure profiling or tracing tools that over-collect data; adjust sampling settings.
- Incompatible software updates: Update dependent software to versions compatible with current Windows builds; roll back if needed.
Quick Fixes:
1. Open Task Manager -> Details and identify processes using pshed.dll; end non-critical ones if safe
2. Run Windows Security or Defender full scan for malware
3. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth
4. Update Windows to the latest build
5. Verify pshed.dll path is C:\Windows\System32\pshed.dll and has a Microsoft signature
Frequently Asked Questions
Is pshed.dll a virus?
No, the legitimate pshed.dll from Microsoft is not a virus. Verify the file path (C:\Windows\System32\pshed.dll) and the digital signature from Microsoft.
Where is pshed.dll located?
The legitimate file is typically located at C:\Windows\System32\pshed.dll (or C:\Windows\SysWOW64\pshed.dll on 32-bit contexts).
Can I delete pshed.dll?
No, pshed.dll is a Windows system component. Deleting it can cause instability or prevent certain debugging and performance features from working.
Why is pshed.dll running at startup?
It may be loaded by Windows performance tooling or diagnostics components that start with the OS or during certain profiling activities.
How can I verify pshed.dll’s signature?
Right-click pshed.dll in File Explorer -> Properties -> Digital Signatures. It should list Microsoft Corporation as the signer.
What to do if pshed.dll is missing or corrupted?
Run sfc /scannow to repair system files. If needed, perform a Windows repair upgrade or restore from a known good system restore point.