C windows system32 vssvc exe

vssvc.exe: The Volume Shadow Copy Service

Overview

vssvc.exe is the executable file for the Volume Shadow Copy Service (VSS) in Microsoft Windows operating systems. VSS is a crucial infrastructure that allows taking snapshots (shadow copies) of computer files or volumes, even when they are in use. It’s a core component for backup and recovery operations, system restore points, and other features that rely on point-in-time data consistency.

Origin and Purpose

VSS was introduced with Windows XP and Windows Server 2003. It was designed to address the challenge of backing up open files and ensuring data consistency during the backup process. Before VSS, backing up a file that was actively being modified by an application could result in an inconsistent or corrupted backup. VSS solves this problem by coordinating with applications and the file system to create a «shadow copy» – a consistent, point-in-time snapshot of the data.

The primary purposes of VSS include:

• Backup and Restore: Enabling backup applications to create consistent backups of entire volumes or individual files, even if they are open and in use.
• System Restore: Powering the System Restore feature, which allows users to revert their system to a previous state. System Restore uses VSS to create restore points (shadow copies) before significant system changes (like installing drivers or software).
• Previous Versions (Shadow Copies): Allowing users to access previous versions of files. This feature, accessible through the «Previous Versions» tab in a file’s properties, relies on VSS to maintain a history of file changes.
• Data Mining and Analysis: Providing a consistent point-in-time view of data for analysis without interfering with live operations.
• Database Backups: Many database systems (like SQL Server and Exchange Server) utilize VSS to ensure consistent database backups.

How VSS Works (Simplified)

VSS coordinates three main components:

1. VSS Requestor: The application initiating the shadow copy operation (e.g., a backup program).
2. VSS Writer: An application-specific component that ensures the application’s data is in a consistent state for the shadow copy. For example, a database VSS writer will flush data to disk and temporarily pause write operations. Microsoft provides writers for many of its applications, and third-party software vendors often include VSS writers for their applications.
3. VSS Provider: The component responsible for actually creating and managing the shadow copies. Windows includes a default system provider that uses a copy-on-write mechanism. Hardware vendors can also create their own VSS providers, often optimized for their specific storage hardware.

The process (simplified) looks like this:

1. The Requestor (e.g., backup software) asks VSS to create a shadow copy.
2. VSS notifies registered Writers.
3. Writers prepare their applications for the snapshot (e.g., flushing buffers, completing transactions).
4. VSS freezes I/O operations briefly.
5. The Provider creates the shadow copy (usually a copy-on-write snapshot).
6. VSS thaws I/O operations.
7. The Requestor can now access the consistent shadow copy for backup or other purposes.

Is vssvc.exe a Virus?

No, vssvc.exe itself is not a virus. It’s a legitimate and essential Windows system file. However, like any executable file, it’s theoretically possible (though highly unlikely) for malware to attempt to:

• Impersonate: A virus might name itself vssvc.exe and place itself in a different directory to disguise itself.
• Exploit: Vulnerabilities in VSS (though rare and usually patched quickly) could potentially be exploited by malware.
• Disable: Malware could try to stop or disable the Volume Shadow Copy Service to prevent backups or system restores.

To determine if a vssvc.exe file is legitimate:

1. Location: The genuine vssvc.exe should reside in the %SystemRoot%\System32 directory (typically C:\Windows\System32). If you find a file with the same name in a different location, it’s highly suspect.
2. Digital Signature: Check the file’s digital signature. Right-click on vssvc.exe, select «Properties,» and go to the «Digital Signatures» tab. It should be signed by Microsoft Windows.
3. File Size and Version: While not definitive, comparing the file size and version with a known good copy from another system can help.
4. Resource Monitor/Task Manager: Observe the process’s behavior. vssvc.exe should only be active during backup/restore operations or when shadow copies are being created/managed. Sustained high CPU or disk usage outside of these times is suspicious.
5. Virus Scan: Run a full system scan with a reputable antivirus program.

Can vssvc.exe Become a Virus?

vssvc.exe itself cannot «become» a virus. It’s a static executable file. However, as mentioned above, malware can replace or exploit it. Keeping your system updated with the latest security patches is crucial to mitigate potential vulnerabilities.

Troubleshooting VSS Issues

VSS errors can manifest in various ways, including:

• Backup failures.
• System Restore failures.
• «Previous Versions» not working.
• Event Viewer errors related to VSS (check the Application and System logs).

Here are some troubleshooting steps:

1. Restart the Service: Open the Services console (services.msc) and restart the «Volume Shadow Copy» service. Also, check the status of related services like «Microsoft Software Shadow Copy Provider» and any application-specific VSS writers (e.g., «SQL Server VSS Writer»).

2. Check Disk Space: Shadow copies require sufficient free disk space on the volume being snapshotted and the volume where shadow copies are stored (usually the same volume). If the volume is nearly full, VSS may fail.

3. Check Event Viewer: Examine the Application and System logs in Event Viewer (eventvwr.msc) for VSS-related errors. These errors often provide specific error codes and clues about the cause of the problem. Look for Event IDs related to VSS, such as 8193, 8194, 12289, 12293, and others.

4. vssadmin Command-Line Tool: Use the vssadmin command-line tool to diagnose and manage VSS. Here are some useful commands:

   • vssadmin list writers: Lists all registered VSS writers and their status. Check for any writers in a «Failed» or «Error» state.
   • vssadmin list providers: Lists all installed VSS providers.
   • vssadmin list shadows: Lists all existing shadow copies.
   • vssadmin list shadowstorage: Shows the allocated and used space for shadow copies.
   • vssadmin delete shadows: Deletes shadow copies (use with caution!). You can delete shadow copies by ID, by volume, or all shadows. This can free up space and sometimes resolve issues.
   • vssadmin resize shadowstorage: Changes the maximum amount of space allocated for shadow copies.

   Example usage:

   vssadmin list writers
vssadmin list shadowstorage /For=C:

5. Disk Check (chkdsk): Run chkdsk /f /r on the affected volume(s) to check for and repair file system errors. File system corruption can interfere with VSS.

6. System File Checker (sfc): Run sfc /scannow to check for and repair corrupted system files, including potentially damaged VSS components.

7. Third-Party Software Conflicts: Some third-party applications, especially backup software, disk utilities, and security software, can sometimes interfere with VSS. Try temporarily disabling these applications to see if it resolves the problem.

8. Driver Issues: Outdated or corrupted storage drivers can sometimes cause VSS problems. Ensure your storage drivers are up-to-date.

9. Re-register VSS DLLs: In some cases, re-registering the VSS DLL files can fix issues. Open an elevated command prompt (Run as administrator) and execute the following commands:

   cd /d %windir%\system32
net stop vss
net stop swprv
regsvr32 /s ole32.dll
regsvr32 /s oleaut32.dll
regsvr32 /s vss_ps.dll
vssvc /register
regsvr32 /s /i swprv.dll
regsvr32 /s /i eventcls.dll
regsvr32 /s es.dll
regsvr32 /s stdprov.dll
regsvr32 /s vssui.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml4.dll
net start swprv
net start vss
   10. Check COM+ Security settings: Ensure that the COM+ security settings are not overly restrictive, as it can interfere with the VSS service.

10. Disable and Re-enable System Restore: Turn off System Restore, reboot, and then turn it back on. This can sometimes clear up issues with shadow copy creation.

If none of these steps resolve the issue, you may need to consult Microsoft support or seek help from a qualified IT professional. VSS issues can sometimes be complex and require advanced troubleshooting.

Vssvc.exe is a segment of the Windows 10 Operating System and is a collection of API COM interfaces that undergo backups while an implementation is still being used. It is a legitimate file that allows altered files to be backed up by the operating system and is essentially a service that manages Volume Shadow Copies. This program should definitely not be terminated as it provides backups of modified files so that they can be restored even if they are deleted.

The full form of VSSVC is Volume Shadow Copies and is an essential part of the Windows Operating System.

File Size and Location

By default, Vssvc.exe is installed under C:/Windows/System32 directory and the average file size is approx 1.37 MB.  There might be multiple copies (max 4) that can be found in Windows 10 and if they are located under System 32 directory then Vssvc.exe is not a virus and safe for the system.

Картинка с сайта: winosbite.com

Quick Overview

The Volume Shadow Copy service is configured to take snapshots or copies of the data, which are to be backed up at an affixed volume at a specific point in time. Think of it as an automatic save-point in a video game. It takes an accurate image of the data even while the application is still running, ensuring that nothing is omitted. VSS works in the way that every time you write new data, it is first copied to the snapshot, then the hard drive.

The components of VSS are:

1. Service: Allows other mechanisms to communicate and work synergistically.
2. Requester: This is a backup application which as the name implies, requests permission from other programs to create actual shadow copies. The requesters on the Windows Operating System are Windows Server Backup Utility and System Center Data Protection Manager.
3. Writer: This element ensures that the data backed up is consistent and not inaccurate. Writers also provide information on data restoration and without a writer, the imaged data will cease to be crash consistent.

(a). Provider: This is the section that maintains the creation of these shadow copies. Providers create shadow copies on demand, making sure to remain compatible with running volumes. Providers create shadow copies using any of the following methods;

(b). Complete copy method: This is a read-only copy and is created on the principle of using a split mirror.

(c). Copy on write method: At a certain point in time, this copies all the changes made to the volume, rather make an entire copy of it.

(d). Redirect on write method: Rather than make an entire clone copy or copy the differential changes, this method diverts all the changes to a different volume.

This service works incrementally and it functions on the block level. VSS tracks all the modifications on blocks in a volume and when a certain block has new data, VSS takes a snapshot and saves this data to a hidden block. While it may seem abstruse, just remember that VSS helps a great deal in resetting the system and retrieving lost data.

Why VSS is Important

VSS is a source of tremendous amenity regarding historical data and is apart of the toolkit of forensic analysts. Aside from forensics, shadow copies restore LUNs, and transferable shadow copies aids for convenient data mining. It makes the /recovery of a crashed operating system more efficient. If files written by malicious authors caused your PC to crash, then VSS will bring the system back to the state prior to the crash.

In the event of a crashed system, using a disk backup means that you’ll still have to install all the programs, re-enter all the license keys and user configurations; a cumbersome process that can take up to weeks. However, with disk imaging, all you’ll have to do is reboot and restore the system back to the time it was last imaged, indicating that all the system files would’ve already been backed up, allowing for more time saved.

High Disk Usage

If you noticed that VSSVC.exe is running in task manager and using high disk usage then it might be malware or a virus. If your system begins to lag, that could probably be attributed to some malware. Malware often takes the names of other legitimate files, mainly executable files containing .exe. Generally speaking, the Volume Shadow Copy Service is not supposed to use up a lot of CPU space. Yet if your system is still crawling, you can try one of the following techniques for reconfiguration;

1. Disable and then re-enable System Restore.
2. Locate services by typing services in the Run Command window. On hitting enter, locate Volume Shadow Copy services and force the service to restart, as shown below:
   

   Картинка с сайта: winosbite.com

3. Press the Ctrl+Shift+Esc button to open the Task Manager, locate VSS, and select “end task”.

You may also restore Windows using the run command.

How to Disable Volume Shadow Copy Service

Please note that permanently disabling VSS is not advised as it can shut down many programs that are dependent on the service. However, if you are sure that the VSSVC.exe is consuming high CPU or disk space or memory then you may consider the below steps to disable it:

1) Press the Windows logo

2) Type Services and click on it

3) Locate Volume Shadow Copy, right-click and choose Properties

4) Choose Disabled from the drop-down menu located under Startup type

Картинка с сайта: winosbite.com

5) Click on OK and exit.

Next time, when you restart your Windows PC, then VSSVC.exe won’t be running in the system background anymore.

Readers help support Windows Report. We may get a commission if you buy through our links.

Read our disclosure page to find out how can you help Windows Report sustain the editorial team. Read more

The Vssvc.exe program is a process that runs in the background on your computer and uses resources. It is an essential service in Windows as it helps restore data in case it becomes corrupted. However, you may experience some issues with the file or process.

Whereas VSS errors may be common, this is not enough to disable the service permanently. You have to find the problem’s root cause before disabling it. However, if you want to, we show you how in this article.

Vssvc.exe is essential for running the Windows operating system, so you can’t uninstall it without affecting your PC’s performance. However, you can disable it temporarily if you don’t need its functions.

How can I disable the Vssvc service?

1. Restart the Volume Shadow Copy service 

1. Hit the Windows + R keys to open the Run command.
2. Type services.msc in the dialog box and hit Enter.
   

   Картинка с сайта: windowsreport.com

3. Locate Volume Shadow Copy service, right-click on it, and select Properties.
   

   Картинка с сайта: windowsreport.com

4. Next to Startup type, click on the drop-down menu, select Automatic, then click on Start.
   

   Картинка с сайта: windowsreport.com

5. Click Apply and OK to save changes.
   

   Картинка с сайта: windowsreport.com

If restarting the service does not improve your PC’s performance, then consider disabling the service. Follow the same steps above. Only this time, set the startup type to disabled.

2. Increase VSS space

1. Hit the Windows key, type cmd in the search bar, and click Run as administrator.
   

   Картинка с сайта: windowsreport.com

2. Type the following command and hit Enter: vssadmin resize shadowstorage /on=c: /for=c: /maxsize=20%

If your main issue was high CPU disk usage, increasing more storage space for VSS can help offload the undue pressure. This, in turn, will have a ripple effect by fixing any performance issues.

3. Scan for viruses

1. Press the Windows key, search Windows Security, and click Open.
   

   Картинка с сайта: windowsreport.com

2. Select Virus & threat protection.
   

   Картинка с сайта: windowsreport.com

3. Next, press Quick scan under Current threats.
   

   Картинка с сайта: windowsreport.com

4. If you don’t find any threats, proceed to perform a full scan by clicking on Scan options just below Quick scan.
   

   Картинка с сайта: windowsreport.com

5. Click on Full scan, then Scan now to perform a deep scan of your PC.
   

   Картинка с сайта: windowsreport.com

6. Wait for the process to finish and restart your system.

Perform this step if you suspect the vssvc.exe process is a virus or is consuming an abnormal amount of CPU.

As a practical note, we suggest you use a more reliable antivirus tool for scanning your PC and stopping any dangerous threats from infecting your Windows OS.

⇒ Get ESET HOME Security Essential

Is Vssvc exe safe?

Vssvc.exe is associated with Microsoft’s Volume Shadow Copy service for its backup and restore features. As long as this file is located in its default location, there’s no reason to worry about it being dangerous: C:\Windows\System32 directory

However, if you see this file somewhere strange, it might be malicious software trying to steal your information or installing other malware on your system.

Note that vssvc.exe stands for Volume Shadow Copy Service. This Windows feature allows you to create point-in-time snapshots of your physical volumes. As such, you can revert to any previous snapshot.

Vssvc is used to coordinate with other services, such as System Restore, to create point-in-time copies of data stored on local and networked disks. It runs as a background process whenever Windows starts up. Some of its common roles include:

• Saves snapshots of your files – When you make changes to a file, VSS creates a snapshot of the original file before it makes any changes. This way, if something goes wrong and you need to restore from a previous point in time, you can go back to when you made those changes and overwrite the changed version with the old one.
• Creates backups on multiple drives – If there’s not enough space available on one drive, VSS will use another drive as well. This means that if one drive fails, you won’t lose all of your data since it was backed up across multiple drives.
• Recovery from hardware failure – Shadow copies also help you recover from hardware failures, such as hard disk crashes or failed startup attempts.
• Integrates with other backup solutions – You can also use VSS with other backup applications to create consistent backups by generating a snapshot of the data in your applications and then creating a shadow copy of the data on disk.

While there are no known problems with the Vssvc.exe file, it is important to note that any time you download a new program from the Internet or install software from an unknown source, your computer could risk becoming infected with malware and other viruses.

It is safe to have this process running on your computer unless it is causing problems, such as slowing down your system or interfering with other programs. 

And that’s a wrap from us, but be sure to check out our other articles related to the topic, such as the VSS error 0x80042302, for a quick fix. You can also learn about VSServer.exe and how to remove it in one of our other guides.

To learn more about similar processes, our Understanding Vsmain.exe: Should you delete it guide is a great place to start.

Any other comments are welcome, so leave them down below.

Claire has a knack for solving problems and improving the quality of life for those around her. She’s driven by rationality, curiosity, and simplicity, and always eager to learn more about Microsoft’s products.
With a background in teaching and reviewing, she breaks down complex topics into easily understandable articles, focusing mostly on Windows 11, errors, and software.

The genuine VSSVC.exe file is a software component of Microsoft Windows Operating System by .
Microsoft’s «VSSVC.exe» process, residing in «C:\Windows\System32», is a Windows service that starts with Windows and runs in the background. It only works for Microsoft’s proprietary NTFS file system, used since Windows NT 3.1. It can be disabled or set to start manually. Neither is recommended because it is the Volume Shadow Copy Service main component, coordinating «provider» and «writer» routines to allow making copies of files while locked by the system or applications, including transactional processing where all or none of a transaction must succeed. It must be running for Windows or third-party backup to work properly. It can be capturing Shadow Copies even if Windows Backup is not active, enabling users of Vista and Windows 7 (but not 8/8.1/10) to retrieve «Previous Versions» of folders and files. It also exists in Windows Server, although with 150 or more disk volumes it may prevent Windows Server from starting.

VSSvc stands for Volume Shadow Copy Service

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the VSSVC.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for VSSVC.exe related errors

VSSVC.exe file information

Картинка с сайта: www.file.net

The process known as Microsoft Volume Shadow Copy Service or Volume Shadow Copy belongs to software Microsoft Windows Operating System by Microsoft (www.microsoft.com).

Description: VSSVC.exe is an important part of Windows, but often causes problems. VSSVC.exe is located in the C:\Windows\System32 folder.
Known file sizes on Windows 10/11/7 are 1,025,536 bytes (50% of all occurrences), 1,055,232 bytes and 11 more variants.  
The process is a service, and the service name is VSS. The service manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail.


The file is a Windows core system file. The program is not visible. VSSVC.exe is a Microsoft signed file.
Therefore the technical security rating is 4% dangerous, but you should also take into account the user reviews.

Recommended: Identify VSSVC.exe related errors

• If VSSVC.exe is located in a subfolder of the user’s profile folder, the security rating is 58% dangerous. The file size is 13,179,660 bytes (95% of all occurrences) or 483,328 bytes.
  The program has no visible window. The VSSVC.exe file is not a Windows system file.
  VSSVC.exe is able to record keyboard and mouse inputs, monitor applications and manipulate other programs.
• If VSSVC.exe is located in a subfolder of C:\Windows, the security rating is 20% dangerous. The file size is 1,600,512 bytes (50% of all occurrences), 1,454,080 bytes, 1,455,104 bytes or 1,055,232 bytes.
  VSSVC.exe is not a Windows core file. The program has no visible window. The file is a trustworthy file from Microsoft.
• If VSSVC.exe is located in a subfolder of «C:\Program Files», the security rating is 68% dangerous. The file size is 13,179,660 bytes.
  

Important: Some malware disguises itself as VSSVC.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the VSSVC.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer’s security. This was one of the Top Download Picks of The Washington Post and PC World.

Best practices for resolving VSSVC issues

A clean and tidy computer is the key requirement for avoiding problems with VSSVC. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows’ 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the VSSVC.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

avgssie.dll c2c_service.exe seaport.exe VSSVC.exe browserprotect.dll syshook.dll nvtmrep.exe fnplicensingservice.exe dropbox.exe dcservice.exe audiodg.exe [all]