What is Shell.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the Shell.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for Shell.exe related errors

Shell.exe file information

Windows Task Manager with Shell
Shell.exe process in Windows Task Manager

The process known as MS Shell or System belongs to software Gsoft or xCoin Miner by Ufasoft (

Description: Shell.exe is not essential for Windows and will often cause problems. Shell.exe is located in a subfolder of the user's profile folder. Known file sizes on Windows 10/8/7/XP are 119,296 bytes (12% of all occurrences), 117,248 bytes and 23 more variants. 
The Shell.exe file is a file with no information about its developer. The program has no visible window. It is not a Windows system file. The program listens for or sends data on open ports to a LAN or the Internet. Therefore the technical security rating is 68% dangerous; however you should also read the user reviews.

Recommended: Identify Shell.exe related errors

Important: Some malware also uses the file name Shell.exe, for example Trojan.Generic.4851587 or Gen:Variant.Kazy.4494 (detected by BitDefender), and Win32:Cycbot-Y (detected by Avast). Therefore, you should check the Shell.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

when i start windows, it gives a message that c:\windows\shell.exe not found. i want to remove this error.
There are so many files with the name shell. That is why an attacker could insert a counterfeit file -- for example, turtleshell.exe or SallySellsSeaShells.dll -- with a virus or spyware. How the heck are we gonna know the difference? Well, the Sally one maybe sounds suspicious. But getting back to the point. The more files with the same name makes it easier for the bad guys to mask a fake one as if it fits right in with the others. I used RemoveAny spyware remover program to delete it. They said it was suspicious. I had been having internet and virus troubles before. Now there is no internet. It keeps saying page can't be displayed. According to RemoveAny the one I deleted was located in %user_profile%\application data\microsoft\windows\shell.exe and started by %user_profile%\LOCALS~1\Temp\ChB.exe. They said DrWeb Antivirus detected it as Trojan_MulDrop1.49782. RemoveAny claimed it established internet connections with and on port World Wide Web HTTP(80). I'm not blaming RemoveAny.
Be careful. Deleting shell.exe may cause screen problems in internet. Words may be different sizes and out of place.
My mcafee detected %username%\AppData\Roaming\Microsoft\Windows\shell.exe as a backdoor... i deleted it... did i do the right thing?
  Nelson (Kaspersky), W32/Mytob-CA (Sophos)
  Frank   (further information)
is it dangerous
Well, AT the moment I am in safe mode with networking so I can get on here. I accidently deleted Shell.exe not knowing what it was, Now I cant access My Internet without using safe mode.

Rating chart

Summary: Average user rating of Shell.exe: based on 7 votes with 7 user comments. 2 users think Shell.exe is essential for Windows or an installed application. 2 users think it's probably harmless. One user suspects danger. 2 users think Shell.exe is dangerous and recommend removing it. 3 users don't grade Shell.exe ("not sure about it").

Do you have additional information? Help other users!
What do you know about Shell.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving Shell issues

A clean and tidy computer is the key requirement for avoiding problems with Shell. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the Shell.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

Shell.exe [all]