DasHost.exe High CPU: Fix Device Association Host Safely

DasHost.exe high CPU usually means Windows is repeatedly trying to associate with a printer, scanner, Bluetooth accessory, USB device, or network device whose driver is not responding correctly. The legitimate process is C:\Windows\System32\dasHost.exe and is called Device Association Framework Provider Host. Do not delete it or disable it permanently. First identify the device that makes the load appear; treat the file as suspicious only when its path, signature, startup behavior, or network activity does not fit the Windows component.

What Is DasHost.exe?

DasHost.exe hosts device-association providers for wired and wireless hardware. Windows can start it when a device is discovered, paired, installed, reconnected, or queried. A brief increase while a device connects is not the same as a process that remains near the top of Task Manager while the PC is idle.

You may also see more than one Device Association Framework Provider Host. Multiple instances are not automatically malicious: Windows can isolate work for different devices or providers. Compare the file location and publisher instead of assuming the process count proves an infection.

Find the Device Causing the CPU or Memory Spike

Do this before repairing all of Windows. The strongest clue is usually the last device that was paired, woke up, lost connection, received a driver update, or started failing.

1. Open Task Manager and sort the Processes or Details tab by CPU. Confirm that the busy item is Device Association Framework Provider Host or dasHost.exe.
2. Disconnect one nonessential device at a time. Start with a recently added printer, scanner, Bluetooth headset, mouse, game controller, webcam, USB receiver, smart display, or network-discovered device.
3. Wait 20 to 30 seconds after each disconnect. If CPU drops, reconnect the device once to confirm the relationship.
4. Open Device Manager and check that device for a warning icon or error in Properties > General > Device status.
5. If the problem is a storage device that shows 0 bytes or disappears, use the separate USB No Media decision guide. Do not keep reinstalling unrelated device providers.

For a printer-related spike, also check whether spoolsv.exe is consuming resources. A stuck print job belongs in the Print Spooler high-CPU workflow; a dasHost-only spike that follows printer discovery points more strongly to the device or its association driver.

Is It Safe to End DasHost.exe?

Ending the task once is a reasonable diagnostic step after saving your work. Windows may restart the process when the device-association service needs it again. Connected-device discovery, pairing, or setup can pause until that happens.

If the load returns immediately, repeatedly ending the process only hides the trigger. Do not rename, delete, or replace C:\Windows\System32\dasHost.exe, and do not download a copy from a file-library site. Fix the device or driver that calls it.

Repair the Device or Driver

Use the narrowest repair that matches the device you identified:

1. Reconnect cleanly. Turn a Bluetooth device off and on, unplug its receiver, or power-cycle the printer or scanner. Remove a failed duplicate device entry only when you know which physical device it represents.
2. Install Windows updates. Check Windows Update, including relevant optional driver updates. Restart afterward.
3. Update from the manufacturer. For a printer, scanner, chipset, Bluetooth adapter, or specialty USB device, use the PC or device maker’s official support page. Avoid generic driver-updater apps.
4. Roll back a recent driver. If the loop began immediately after a driver change and Roll Back Driver is available, use it and restart.
5. Reinstall the identified device. In Device Manager, choose Uninstall device, restart Windows, and let Windows redetect it. Microsoft documents update, rollback, and reinstall paths in its current driver guidance.

Do not remove every item in Device Manager. That makes attribution harder and can disconnect keyboards, network adapters, storage controllers, or accessibility hardware.

Repair Windows Components If Every Device Triggers It

If the System32 process remains busy after the responsible device is removed, Windows component corruption may be involved. Install pending updates, restart, then open Terminal or Command Prompt as administrator and run Microsoft’s repair order:

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

Let both commands finish. Restart and repeat the one-device-at-a-time test. DISM and SFC repair Windows components; they do not update the device manufacturer’s firmware or prove that a third-party driver is compatible.

Should You Allow DasHost.exe Through the Firewall?

Device discovery and association can involve local network traffic, so a firewall prompt is not proof of malware. Check three details before choosing:

• the process path is exactly C:\Windows\System32\dasHost.exe;
• the activity starts when a known printer, display, media device, or other local device is discovered;
• the destination is a local network address or expected device, not an unexplained public Internet host.

A blanket block can break discovery or pairing, while a blanket allow can hide a wrong-path copy. If the prompt names a file in Temp or AppData, or activity continues with all devices disconnected, use the security branch below.

Is DasHost.exe a Virus?

The Microsoft-signed file in System32 is a Windows component. The name alone is not proof: Microsoft has documented Backdoor:MSIL/Medirot.A creating %TEMP%\dashost.exe and adding a startup value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. That is a different file using a familiar name.

Right-click the process in Task Manager, choose Open file location, then open the file’s Properties. A suspicious location, missing or invalid Microsoft signature, unexpected startup entry, or unexplained remote connection deserves a full investigation. You can collect the active paths and signature status in an elevated PowerShell window:

Get-Process dasHost -ErrorAction SilentlyContinue | Select-Object Id, Path, CPU
Get-AuthenticodeSignature C:\Windows\System32\dasHost.exe | Select-Object Status, SignerCertificate

If a wrong-path copy already ran, quarantine the detection and check for persistence rather than deleting only the visible file. Review the suspicious startup entries guide. Repeated alerts after reboot can mean a scheduled task, startup value, loader, or bundled module is recreating the file. Gridinsoft Anti-Malware can scan for those related artifacts through the official download path. It cannot prove that no compromise occurred, so change important passwords from a clean device if browser sessions or credentials may have been exposed.

If you are comparing another familiar process running from Temp or AppData, the fake svchost.exe path check explains the same name-versus-location principle without treating every Windows host process as malware.

FAQ

References

1. Microsoft. Update drivers through Device Manager in Windows. Microsoft Support, current living documentation. Accessed August 18, 2026.
2. Microsoft. Using System File Checker in Windows. Microsoft Support, current living documentation. Accessed August 18, 2026.
3. Microsoft Security Intelligence. Backdoor:MSIL/Medirot.A threat description. Published December 21, 2015; updated September 15, 2017. Accessed August 18, 2026.