What is DefWatch.exe?

The genuine DefWatch.exe file is a software component of Symantec AntiVirus by Symantec.
DefWatch detects out-of-date virus software definitions for the Norton Anti-Virus software. It's particularly useful if updates aren't set to be installed automatically and manual updates are irregular. Semantec develops security, storage, backup and availability software and offers professional support services for its software. It's a Fortune 500 company.

DefWatch stands for Virus Definition Watch Daemon

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the DefWatch.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for DefWatch.exe related errors

DefWatch.exe file information

Windows Task Manager with DefWatch
DefWatch.exe process in Windows Task Manager

The process known as Virus Definition Daemon belongs to software Symantec AntiVirus or Symantec AntiVirus Client or Norton AntiVirus or Norton AntiVirus Corporate or Symantec Client Security by Symantec (

Description: DefWatch.exe is not essential for the Windows OS and causes relatively few problems. DefWatch.exe is located in a subfolder of "C:\Program Files"—generally C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\ or C:\Program Files\NavNT\. Known file sizes on Windows 10/8/7/XP are 32,768 bytes (33% of all occurrences), 19,648 bytes and 11 more variants. 
The program has no visible window. The DefWatch.exe file is not a Windows core file. The process can be removed using the Control Panel's Add\Remove programs applet. The file is a Verisign signed file. The file has a digital signature. DefWatch.exe is able to hide itself. Therefore the technical security rating is 20% dangerous; however you should also read the user reviews.

Uninstalling this variant: The software publisher Symantec provides direct support ( and update information ( You could safely remove the program using the uninstall program of Symantec AntiVirus or Symantec AntiVirus Client (Control Panel ⇒ Uninstall a Program).

Recommended: Identify DefWatch.exe related errors

If DefWatch.exe is located in the C:\Windows\System32 folder, the security rating is 90% dangerous. The file size is 31,624 bytes. The DefWatch.exe file is a file with no information about its developer. The program is not visible. DefWatch.exe is located in the Windows folder, but it is not a Windows core file. DefWatch.exe is not a Windows core file. The application uses ports to connect to or from a LAN or the Internet.

External information from Paul Collins:

Important: Some malware camouflages itself as DefWatch.exe, particularly when located in the C:\Windows or C:\Windows\System32 folder. Therefore, you should check the DefWatch.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Used in Symantec Anti Virus Corp Editions
It is a file from norton av and not to worry abt it, while takes quite cpu resources during startup. Better to check if it is a malware.
  Parvesh Paliwal  
This helps deaf users.
  Keith Mghee  
Norton / symantec virus definition updater.
It's a virus. Chews away at your registry files
This is a safe Norton Symantic file that watches for new virus, worm, trogen definitions and initiates a process to download them if the system operator has not run a Live Update for virus definitions for a set period of time. Set Norton to automatically update definitions at an obsure hour every day and this file will no longer need to run on startup.
component of Norton CE - 280K reported in task manager
it is not malicious
More comments can be found here:
    (further information)

Rating chart

Summary: Average user rating of DefWatch.exe: based on 55 votes with 9 reviews. 42 users think DefWatch.exe is essential for Windows or an installed application. 4 users think it's probably harmless. One user thinks it's neither essential nor dangerous. 8 users think DefWatch.exe is dangerous and recommend removing it. 2 users don't grade DefWatch.exe ("not sure about it").

Do you have additional information?
What do you know about DefWatch.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving DefWatch issues

A clean and tidy computer is the key requirement for avoiding problems with DefWatch. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the DefWatch.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

DefWatch.exe [all]