sppsvc.exe: Safe Windows Service, High CPU, or Malware?

sppsvc.exe is normally the legitimate Microsoft Software Protection Platform service. Its expected file is C:\Windows\System32\sppsvc.exe, and Windows uses it to enforce digital licenses for the operating system and licensed apps. A short CPU burst during sign-in, activation, or an update can be normal if it settles quickly. Investigate the process when it runs from another folder, lacks a valid Microsoft signature, stays busy repeatedly, or appears in an antivirus alert. Do not delete or permanently disable the real System32 file just because its name looks unfamiliar.

If you see “sppsvc is not working correctly”, first check the service result: an idle process, a missing service and a rejected digital signature need different next steps.

• C:\Windows\System32\sppsvc.exe, valid Microsoft signature, CPU drops after a short licensing check — Usually legitimate. Keep the service and monitor it.
• Correct path, but CPU stays high or activation errors repeat — Check activation and repair Windows components. Persistent CPU use alone does not identify malware.
• sppsvc.exe in AppData, Temp, ProgramData, Downloads, or an unrelated program folder — Investigate as a possible lookalike. Do not run or allow it; scan it and keep any detected copy quarantined.
• Correct System32 path, but the signature is invalid or security software reports Expiro — Check an invalid signature using the service-error and Windows repair steps below. If an antivirus names Expiro, use the Expiro decision flow; the System32 path does not clear an alert.
• The file or Software Protection service is missing after a KMS activator — Remove the activator, repair Windows, and restore legitimate activation. Never download a replacement EXE from a file-library site.

What is sppsvc.exe?

sppsvc.exe runs the Windows service named sppsvc, displayed as Software Protection. Microsoft describes it as the component that downloads, installs, and enforces digital licenses for Windows and Windows applications. Microsoft also recommends that users do not disable the service because Windows and licensed apps may enter notification mode.[1]

The process is not supposed to run at maximum CPU continuously. It can start on demand when Windows checks activation, a licensed application opens, the PC signs in, or licensing components change. A brief spike that ends is different from a process that restarts every few minutes, remains busy for a long time, or appears together with activation errors and security warnings.

Also distinguish the service from similarly named files. Malware can use a familiar filename without being the Windows component. Gridinsoft ThreatInfo, for example, records a separate malicious sample named sppsvc.exe detected as Trojan.Downloader (MD5 de055f7da395a9d1a5266e11e3786f2a). That verdict applies to that sample, not every file with the same name. A filename is an identifier, not a safety certificate.

How to check whether sppsvc.exe is safe

1. Open the running file location. In Task Manager, open the Details tab, right-click sppsvc.exe, and select Open file location. The normal file should open from C:\Windows\System32.
2. Check the digital signature. Right-click the file, choose Properties, open Digital Signatures, and verify that Windows reports a valid Microsoft signature. If this check is unavailable or reports a problem, investigate further; it does not identify malware by itself. An invalid signature can also indicate file corruption.
3. Check the service configuration. Open Terminal or Command Prompt as administrator and run:

sc.exe qc sppsvc

Look at BINARY_PATH_NAME. It should point to the Windows System32 copy, not a user-writable folder or an unrelated application directory.

4. Compare the timing. Restart Windows and watch the process for several minutes. A short activation check that ends is less concerning than repeated high CPU, unexpected network activity, or a process that returns after quarantine.
5. Check the source of any alert. In Windows Security, open Protection History and record the exact detection name, affected path, status, and time. Do not judge the alert by the filename alone. Our Microsoft Defender detection-name guide explains how the label, path, signature, and recurrence work together.

For an unfamiliar executable, use the broader EXE safety checklist before restoring, allowing, or running it.

“sppsvc is not working correctly”: check what actually failed

A process missing from Task Manager is different from a missing service or file. Open Terminal as administrator and run these checks, one at a time. They display the service status and configuration; they do not change its startup type:

sc.exe query sppsvc
sc.exe qc sppsvc

Read STATE in the first result and BINARY_PATH_NAME in the second. The normal executable is in your Windows directory’s System32 folder, usually C:\Windows\System32\sppsvc.exe. STOPPED alone does not mean the file is missing. If activation works and there is no error, an idle service is not a reason to repair it.

If activation is failing, the service exists, and its path and Microsoft signature check out with no unresolved antivirus alert, try starting it once:

sc.exe start sppsvc

Use sc.exe, including the extension, so Terminal runs the service-control program. Save the full result before trying another fix:

• The service starts, is already running, or shows START_PENDING. Wait briefly and run sc.exe query sppsvc again. A successful start is not the same as successful activation: recheck Activation in Settings and the application that failed.
• Error 577. Windows could not validate the file’s digital signature. Microsoft’s definition allows for an incorrectly signed or damaged file as well as malicious software; the number alone does not identify an infection.[4] Check security alerts and use the Windows repair steps below. Do not disable signature enforcement to force the file to run.
• Error 1060. Windows cannot find an installed service with that name.[5] Recheck the spelling sppsvc. If correct, this is a service-registration problem; downloading an EXE will not recreate the proper service configuration. Use the recovery path below.
• Error 1058. The service is disabled or cannot be started in its current configuration.[5] Review any recent debloat tool, activator or service-setting change. On a managed PC, ask IT to restore the approved configuration; do not import registry files or change permissions from a forum recipe.
• Another failure or the same error after repair. Record the error number, Windows version, activation message and recent changes. Give those details to Microsoft support or your administrator instead of repeatedly restarting the service.

Fix sppsvc.exe high CPU without disabling Windows licensing

High CPU is not automatically a virus. First separate a short licensing event from a persistent problem:

• Watch for several minutes after sign-in and see whether usage falls; this is an observation step, not a universal time limit for the service.
• Install pending Windows updates and restart once.
• Check Settings → System → Activation on Windows 11, or Settings → Update & Security → Activation on Windows 10. Record any activation error.
• Note whether the spike begins when Office or another licensed Microsoft application opens. If Task Manager points to OfficeClickToRun.exe, diagnose that Office servicing process separately.
• Check Reliability Monitor for repeated Software Protection, licensing, or application crashes.

If CPU remains high, do not solve it by taking ownership of licensing registry keys, deleting token files at random, or setting Software Protection to Disabled. Those workarounds can hide the symptom while creating activation and update failures.

Repair Windows components instead. Open Terminal as administrator, run DISM first, wait for it to finish, and then run System File Checker:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Microsoft documents this order for restoring missing or damaged Windows components.[2] Restart after both commands finish, check Activation again, and recheck CPU behavior. If SFC cannot repair files, preserve its result rather than downloading sppsvc.exe from an unofficial site.

sppsvc.exe is missing: restore Windows, not a downloaded EXE

Check the actual file location, not just the process list. In File Explorer, enter %windir%\System32 and look for sppsvc.exe. If the file is absent, check your security tool’s quarantine history before assuming it was deleted by Windows. An antivirus detection needs the malware checks below; do not blindly restore the file.

For a missing or damaged Windows component without an unresolved infection alert, run DISM and SFC in the order above. These tools repair Windows components; they do not provide a product key or fix an invalid license. After restarting, repeat the service check and verify activation. A clean SFC result with error 1060 still present means the service problem remains.

If repair fails on Windows 11, back up important files and check Settings → System → Recovery → Fix problems using Windows Update → Reinstall now. Where available, this reinstalls the current Windows version while preserving apps, files and settings.[6] Keep the PC powered and connected to the internet. The option can be unavailable on older builds or PCs managed by work or school; contact your administrator or Microsoft support for the appropriate repair-install path. This option is different from Reset this PC or a clean installation.

A standalone “sppsvc.exe download for Windows 11” is not a safe repair strategy: it may be the wrong build or an untrusted file, and it cannot by itself restore missing service registration. Do not copy a stranger’s executable into System32, take ownership of protected folders, or install another activator.

When sppsvc.exe may be malware

Treat the process as suspicious when one or more of these conditions apply:

• it runs outside C:\Windows\System32;
• the signer is missing, invalid, or not Microsoft;
• the spelling is a lookalike such as sppsvс.exe with a substituted character;
• it starts from an unrelated scheduled task, Run key, browser profile, or recently installed bundle;
• it returns after the visible file is deleted or quarantined;
• it appeared after a crack, KMS activator, repack, fake update, or unknown installer;
• high CPU comes with browser changes, disabled security settings, new exclusions, or unexplained outbound traffic.

A wrong-path copy should not be moved into System32 or renamed to make it look legitimate. Do not run it. Use a full system scan and review the detection before cleanup; keep a detected copy quarantined while investigating its source.

What if Defender reports Expiro on System32\sppsvc.exe?

An alert such as Virus:Win64/Expiro.DA!MTB or Virus:Win32/Expiro.HNW!MTB changes the decision. Expiro is a file-infector family: Microsoft reports that it searches drives and modifies executable files.[3] Therefore, a detection on the correct C:\Windows\System32\sppsvc.exe path can mean that a real Windows file was modified. The correct folder alone does not clear it.

Use these signals:

• Several unrelated EXE files are detected: a real file-infector incident is more likely. Disconnect external drives, avoid opening programs, and follow the full Expiro removal and safe-backup guide.
• The alert returns after reboot or spreads to USB/external drives: do not restore quarantined executables. Scan connected media and prepare for a clean reinstall if detections are widespread.
• Only one signed core file is flagged after a clean installation: update security definitions, run an offline scan, verify the signature again, and submit the file to Microsoft for analysis before restoring it. This pattern can justify a false-positive review, but it does not prove a false positive.
• Other software begins triggering Expiro alerts: stop installing or restoring applications. A previously connected drive, old installer, synced executable, driver package, or infected backup can reintroduce files even after Windows itself was reinstalled.

Do not jump from a post-install alert to an unsupported BIOS or firmware-infection claim. First verify the installation media, attached drives, restored files, OEM packages, exact hashes, signatures, and whether multiple executables are actually changing.

How to repair or remove a suspicious sppsvc.exe safely

If the file was detected or you found a suspicious lookalike, start with containment and scanning. High CPU from the verified Windows service alone does not require malware removal.

1. Contain a possible file-infector incident. When several executable files are being detected, disconnect external drives and avoid opening more programs. Do not restore or allow an Expiro-detected copy while investigating.
2. Scan and review the findings. Download and install Gridinsoft Anti-Malware from the link below, update it, run a Full Scan, review the detected items, apply the appropriate cleanup and restart. Then recheck the original alert and scan again if it recurs. A scan does not establish that every file is safe.
3. Repair Windows after containment. Use DISM and SFC as described above rather than downloading a replacement executable. Recheck activation: Windows 11 uses Settings → System → Activation; Windows 10 uses Settings → Update & Security → Activation. Use your legitimate license or your organization’s approved activation service.
4. Escalate recurring detections. Microsoft Defender Offline is an additional option when malware may be interfering with normal scanning; save your work because it restarts the PC. If warnings persist, review scheduled tasks, services, startup entries, exclusions and recent bundled apps with support. Manual inspection is a fallback, not an extra requirement after a successful scan and cleanup.
5. Consider a clean reinstall for widespread infection. If Expiro keeps appearing in many executables, create installation media on a trusted computer and follow the clean Windows USB workflow. Restore documents and media selectively; do not restore old program folders or installers.

A security tool may quarantine the visible file while an associated loader, scheduled task or bundled component remains and recreates the warning. A full scan can check for those related detections; removing only the named file may miss them.

What if a KMS activator changed sppsvc?

KMSPico, AutoKMS, AutoPico, and similar tools are not repairs for Software Protection. They can add scheduled tasks and services, alter licensing behavior, create exclusions, or arrive inside bundled installers. If sppsvc.exe became missing, disabled, or constantly busy after an activator, remove the activator and its persistence first. The KMSPico cleanup guide covers that workflow.

After cleanup, run DISM and SFC, restart, and restore legitimate activation. Do not install a second activator, replace sppsvc.exe manually, or import registry permissions from an unknown script.

SppExtComObj.exe is the separate KMS Connection Broker. If it is making unexpected network connections or appears with a hook DLL or IFEO entry, follow the SppExtComObj.exe path, signature, and activation-context checks rather than applying service-only fixes.

FAQ

References

1. Microsoft. “Security guidelines for disabling system services in Windows Server: Software Protection.” Microsoft Learn, accessed November 8, 2026. Source
2. Microsoft. “Use the System File Checker tool to repair missing or corrupted system files.” Microsoft Support, accessed November 8, 2026. Source
3. Microsoft Security Intelligence. “Win32/Expiro.” Microsoft Malware Encyclopedia, accessed November 8, 2026. Source
4. Microsoft. “System Error Codes (500–999).” Accessed November 8, 2026. System Error Codes (500–999)
5. Microsoft. “System Error Codes (1000–1299).” Accessed November 8, 2026. System Error Codes (1000–1299)
6. Microsoft. “Fix issues by reinstalling the current version of Windows.” Accessed November 8, 2026. Fix issues by reinstalling the current version of Windows