dasHost.exe (Device Association Framework Provider Host) is a file provided by Microsoft and used in Windows operating systems. Under normal circumstances, it shouldn’t be moved or deleted because it’s necessary for certain operations.

dasHost.exe is used to connect wireless and wired devices to the computer, such as a printer or mouse. You’ll likely run into it only when browsing through Task Manager; it’s listed along with other running services. It’s also visible in the System32 folder.

Usually, this file is 100 percent clean of threats and causes no problems. However, if you see multiple dasHost.exe files running or one or more of them are hogging an excessive portion of the CPU or memory, you need to investigate further to see if it’s a virus.

Is dasHost.exe a Virus?

There’s really only one true dasHost.exe file that your computer needs in order to successfully pair devices, so any others you find aren’t necessary, and can be safely removed manually or with a malware cleaning tool.

Here are three ways to know if dasHost.exe is malware pretending to be real, or if it’s the actual file that Windows needs:

Check the File Location

dasHost.exe is used legitimately by Windows in this folder only:

C:\Windows\System32

This means if dasHost.exe is located there, and you have no other instances of it on your computer, chances are it’s completely benign and there’s nothing you need to worry about.

However, if you find a file by that same name elsewhere, like on the Desktop or in your Downloads folder, or in any other important-looking Windows folder, it means that Windows isn’t using it as a real service.

Here’s how to see where dasHost.exe is truly located:

This file is used exclusively in Windows 11, Windows 10, and Windows 8. If you see it in Windows 7 or an older version of Windows, it’s most definitely a virus, or at least a file that isn’t important for Windows to operate normally. It’s possible it’s legitimately used by a third-party program that just so happens to go by the same name, but that’s unlikely.

  • Open Task Manager. Ctrl+Shift+Esc is one quick way, or you can right-click the Start button to open it from the Power User Menu.
  • Go into the Details tab.
  • Right-click dasHost.exe.
  • Select Open file location.

So long as the folder that opens is C:\Windows\System32, you’re fine leaving the file there, since Windows is using it like it should. However, if the folder is anything other than System32, skip down to the bottom of this page to learn how to delete the dasHost.exe virus.

Open Task Manager. Ctrl+Shift+Esc is one quick way, or you can right-click the Start button to open it from the Power User Menu.

Go into the Details tab.

Right-click dasHost.exe.

Select Open file location.

If you have more than one dasHost.exe file running, repeat these steps for each one. Multiple Device Association Framework Provider Host instances just means that a separate process has been opened for each device that Windows is paired to. You might see one operating under the LOCAL SERVICE username and another under NETWORK SERVICE.

Check the File Size

Something else you can check to validate whether dasHost.exe is real is the file size. The answer isn’t as straightforward as the folder method, but it can be helpful to verify any suspicions that your dasHost.exe is potentially harmful.

If dasHost.exe isn’t in the correct folder, check how much space the EXE file is taking up on the hard drive. It should be less than 200 KB, so if it’s much more than that, and especially if it’s several megabytes, and it’s not in the right folder, you can be absolutely sure that it needs to be deleted immediately.

Check the Spelling

It’s common for viruses to pretend to be real by slightly changing the name of the executable file. The file might be in the System32 folder, but since it’s not spelled correctly, it can still exist undetected right next to the real one.

Here are just a few examples of how the dasHost.exe lookalike might appear:

  • dassHost.exedasH0st.exedasHosts.exedsHost.exe

Why Is dasHost.exe Using So Much Memory?

Under normal conditions when you aren’t actively pairing a device, dasHost.exe shouldn’t use more than 10 MB of RAM. If Device Association Framework Provider Host is consuming a lot more memory or there are drastic spikes in the CPU usage showing heavy use by this process, the first thing you should do is look into updating the drivers.

Use a driver updater tool or check the device manufacturer’s website for an update. Also look in Device Manager to see if there are any devices listed as unknown that a driver installation or Windows Update release could fix.

If there aren’t any driver updates, and you’re still not sure why dasHost.exe is using so many system resources, you’re left checking your computer for malware which could be utilizing the process without your knowledge or masquerading as the real dasHost.exe file.

Can You Disable dasHost.exe?

The Device Association Framework Provider Host service can’t be disabled, which is good considering it’s required for device pairing to work. However, you can shut it down temporarily to see if that helps with any problems you’re having with it.

It’s possible that a virus is holding the file hostage, and shutting it down will let you deal with it properly. Or, maybe there are some lingering tasks using dasHost.exe that are making it appear in Task Manager to be using up all your system resources.

Here’s how to shut down dasHost.exe:

  • Open Task Manager and locate from the Processes tab the dasHost.exe task that’s slowing down your computer or behaving erratically. It’s called Device Association Framework Provider Host.
  • Right-click it and select End task.
  • If you get an error, right-click Device Association Framework Provider Host again but this time select Go to details, and then right-click dasHost.exe from the Details tab, and select End process tree.
  • Restart your computer.

Device Association Framework Provider Host will start automatically again when Windows starts back up. Although it isn’t shut down permanently, the “refresh” it performed might be all it needed to return the system resources it was using or unhinge itself from the virus.

Open Task Manager and locate from the Processes tab the dasHost.exe task that’s slowing down your computer or behaving erratically. It’s called Device Association Framework Provider Host.

Right-click it and select End task.

If you get an error, right-click Device Association Framework Provider Host again but this time select Go to details, and then right-click dasHost.exe from the Details tab, and select End process tree.

Restart your computer.

How to Remove a dasHost.exe Virus

Whether dasHost.exe is using all your memory, it’s located in a folder other than C:\Windows\System32, or you’re just paranoid that the real dasHost.exe file is infected, you can scan your computer to check for and remove any infections.

Here are four ways to do this:

  • Try deleting the file manually. Do this by either following the Task Manager steps above or using the Everything search tool to find the real location of dasHost.exe, and then right-click to find the Delete option.
  • If you can’t delete dasHost.exe manually, it might be locked in place by another process. Use Process Explorer to isolate it from its parent programs and try again. To do that, double-click dasHost.exe (it might be embedded in an svchost.exe entry) from the list of processes and select Kill Process from the Image tab.
  • Install Malwarebytes or some other free on-demand virus scanner tool to run a full system scan of your entire computer. Delete anything it finds.
  • Use a full antivirus program if Malwarebytes or another malware scanner didn’t successfully delete the dasHost.exe virus. We have a list of our favorite Windows AV programs here.
  • Boot your computer to a free bootable antivirus program if none of the in-Windows programs above worked. These tools work great if the file is locked or restricted by the virus because all file locks are lifted when Windows isn’t running.

Try deleting the file manually. Do this by either following the Task Manager steps above or using the Everything search tool to find the real location of dasHost.exe, and then right-click to find the Delete option.

If you can’t delete dasHost.exe manually, it might be locked in place by another process. Use Process Explorer to isolate it from its parent programs and try again. To do that, double-click dasHost.exe (it might be embedded in an svchost.exe entry) from the list of processes and select Kill Process from the Image tab.

Install Malwarebytes or some other free on-demand virus scanner tool to run a full system scan of your entire computer. Delete anything it finds.

Use a full antivirus program if Malwarebytes or another malware scanner didn’t successfully delete the dasHost.exe virus. We have a list of our favorite Windows AV programs here.

Boot your computer to a free bootable antivirus program if none of the in-Windows programs above worked. These tools work great if the file is locked or restricted by the virus because all file locks are lifted when Windows isn’t running.

If you’ve confirmed through its location and file name that dasHost.exe is not dangerous, but your security software thinks it is, it might be time to get some new software. It’s possible it’s throwing some false virus alerts when there’s really nothing to be concerned about. This is unlikely to happen to a real system file, but it’s not impossible.

  • Is DllHost.exe safe?
  • Yes. The DllHost.exe file is a Microsoft system process. However, if you see more than one DllHost.exe file running, it could be a virus.
  • What is Msmpeng.exe?
  • Msmpeng.exe is a key component of Windows Security, which keeps your computer safe from malware. You can disable Msmpeng.exe to free up CPU resources, but that leaves your system vulnerable to viruses.
  • Is Yourphone.exe a virus?
  • No. Yourphone.exe represents the Microsoft Your Phone app, which allows you to make calls and send texts from your PC. If you don’t want it running in the background, you can disable it in your Windows startup programs.

Yes. The DllHost.exe file is a Microsoft system process. However, if you see more than one DllHost.exe file running, it could be a virus.

Msmpeng.exe is a key component of Windows Security, which keeps your computer safe from malware. You can disable Msmpeng.exe to free up CPU resources, but that leaves your system vulnerable to viruses.

No. Yourphone.exe represents the Microsoft Your Phone app, which allows you to make calls and send texts from your PC. If you don’t want it running in the background, you can disable it in your Windows startup programs.

Get the Latest Tech News Delivered Every Day