pslist.exe

Sysinternals PsList Utility

Application ProcessSafeSystem Tool

CPU Usage

0-2%

Memory

2-12 MB

Location

C:\Sysinternals\PsTools

Publisher

Sysinternals / Microsoft

Quick Answer

pslist.exe is safe. It’s a lightweight Sysinternals command-line tool used to snapshot process lists for auditing, troubleshooting, and incident response.

Is it a Virus?

✓ NO - Safe

Location must be in C:\Sysinternals\PsTools\pslist.exe (or pslist64.exe)

Warning

Not a malware scanning tool

pslist.exe is a data collector; use it from official sources only to avoid spoofed binaries

Can I Disable?

✓ YES

If you don't need PsTools, simply remove the folder or exclude from scripts

What is pslist.exe?

pslist.exe is the Sysinternals PsList utility that prints detailed information about running processes on Windows systems. It reveals process IDs, session IDs, start times, CPU time, and memory usage for each process. Designed for quick handoffs in troubleshooting, forensics, and auditing, it runs without a GUI.

PsList enumerates processes via Windows APIs and prints fields like PID, PPID, session, user, start time, CPU time, memory usage, and image path. It is a lightweight CLI tool used for quick process inventory, incident response, and forensics without the overhead of a full task manager.

Quick Fact: PsList is part of Sysinternals PsTools and can be used in scripts to produce machine-readable process inventories.

Types of PsList Outputs

Process Snapshot: Single printout of all current processes (PID, PPID, CPU, memory, start time)
Filtered Listing: Optionally filter by username, session, or process name param

Is pslist.exe Safe?

Yes, pslist.exe is safe when downloaded from official Sysinternals sources and used as intended.

Is pslist.exe a Virus or Malware?

The real pslist.exe is NOT a virus. Malware may masquerade with similar names; always verify the signer and path.

How to Tell if pslist.exe is Legitimate or Malware

File Location: Must be located at C:\Sysinternals\PsTools\pslist.exe or C:\Sysinternals\PsTools\pslist64.exe. Other locations are suspicious.
Digital Signature: Right-click the executable > Properties > Digital Signatures. Should show signer such as "Mark Russinovich" / "Microsoft Corporation".
Resource Usage: Normal usage is low; pslist runs quickly. Unusually high resource usage indicates tampering or a different binary.
Behavior: Should only run when executed by a user or script. It does not install as a service.

Red Flags: If pslist.exe is located outside the Sysinternals folder, lacks a valid signature, or appears to run without being launched by a user, treat as suspicious and scan with antivirus.

Why Is pslist.exe Running on My PC?

pslist.exe runs when you explicitly execute the utility to pull a live inventory of processes or when a script or monitoring tool invokes PsTools for data collection.

Reasons it's running:

Manual Execution: An administrator or user ran pslist.exe to obtain a current process list for troubleshooting.
Automation and Scripting: Batch, PowerShell, or configuration management tools invoke pslist as part of a larger data-collection workflow.
Incident Response: Security teams use pslist to capture running processes during live incident analysis.
System Auditing: Regular system audits may include pslist as a lightweight inventory step.
Remote Diagnostics: PsTools can be deployed in remote sessions to gather process lists from other machines.

Can I Disable or Remove pslist.exe?

Yes, you can remove pslist.exe. It is a standalone tool; there is no service to stop. If you don't need PsTools, delete the PsTools folder or exclude it from automated scripts.

How to Stop pslist.exe

Close Active Session: Close any cmd/powerShell windows where pslist.exe is running.
Delete Executable: Delete pslist.exe (and pslist64.exe if present) from C:\Sysinternals\PsTools.
Remove from PATH: If PsTools is in your PATH, remove the folder from system or user PATH.
Uninstall PsTools: Delete the PsTools directory entirely or use a package manager if you installed via a package.

How to Uninstall PsTools

✔ Delete the PsTools folder: C:\Sysinternals\PsTools
✔ Optionally remove from system PATH
✔ Consider alternatives: use built-in Windows tools for similar tasks

Common Problems: PsList Usage

If pslist.exe isn't behaving as expected, here are common issues and straightforward fixes.

Common Causes & Solutions

Tool not found in expected path: Verify you are in C:\Sysinternals\PsTools and that pslist.exe (or pslist64.exe) exists.
Access denied or elevated permissions required: Run Command Prompt or PowerShell as Administrator and retry.
Wrong architecture or incompatible binary: Download the correct PsTools version (32-bit vs 64-bit) from the official Sysinternals page.
License prompt on first run: Launch pslist.exe once in a session and accept the license with -accepteula flag to suppress prompts.
No output or empty results: Ensure PsTools are not blocked by security software; try running with a broader scope or specify filters.
Tampered or unsigned binary: Re-download from the official source and verify the digital signature before running.

Quick Fixes:
1. Open an elevated shell and run: pslist.exe to view processes
2. If first-run prompts appear, run with -accepteula to accept
3. Delete PsTools if not needed, or move to a secured folder
4. Check Windows Defender or Antivirus exclusions for the folder
5. Update PsTools from the official Sysinternals site

Frequently Asked Questions

What is pslist.exe?

pslist.exe is the Sysinternals PsList utility that prints a live snapshot of running processes, including PID, session, CPU time, memory, and image path.

Is pslist.exe safe to download from Sysinternals?

Yes. Download only from the official Sysinternals/Microsoft site and verify the digital signature before usage.

How do I run pslist.exe?

Open a Command Prompt or PowerShell as Administrator and run: pslist.exe [options]. The tool outputs to the console in a plain text table.

Can pslist.exe show memory and CPU usage for each process?

Yes. PsList reports per-process memory usage and CPU time for each listed process, useful for auditing and troubleshooting.

Can I run pslist.exe against a remote machine?

PsTools can be used in remote contexts via PsExec or similar, enabling remote process inventories with appropriate permissions.

How do I remove PsTools from my system?

Delete the PsTools folder (e.g., C:\Sysinternals\PsTools) and remove it from PATH if present; no service uninstall is required.

Related Processes

psinfo.exe

Sysinternals PsInfo utility

procmon.exe

Sysinternals Process Monitor

tcpview.exe

Sysinternals TCPView network connections viewer