What is WUDFHost.exe? Is WUDFHost.exe spyware or a virus?

How to fix WUDFHost.exe related problems?
1. Run Security Task Manager to check your WUDFHost process
2. Run Windows Repair Tool to repair WUDFHost.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Windows Driver Foundation - User-mode Driver Framework Host Process

Product: Windows Vista/7

Company: Microsoft

File: WUDFHost.exe

Security Rating:

"WUDFHost.exe" is a part of Windows Vista and Windows 7/8/10. Some Windows drivers run in user mode (such as USB drivers), specifically in a process running the executable image WUDFHost.exe. See User Mode Driver Framework for a technical reference. www.neuber.com/taskmanager/process/wudfhost.exe.html 

Note: The WUDFHost.exe file is located in the folder C:\Windows\System32. In other cases, WUDFHost.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Click to Run a Free Scan for WUDFHost.exe related errors

Users Opinions

Average user rating of WUDFHost.exe: based on 169 votes. Read also the 179 reviews.

  • 18152 users ask for this file. 110 users rated it as not dangerous. 12 users rated it as not so dangerous. 21 users rated it as neutral. 9 users rated it as little bit dangerous. 17 users rated it as dangerous. 34 users didn't rate it ("don't know").

All comments about WUDFHost.exe:
Service Datei Windows Vista Bernhard
Connects the Zune Player to the USB connection. GaijinTenshi
not a vista user... just sprung up on my computer cant be sure if it's a copy Geo
its not just vista its running itself on my xp machine
It occurs in XP Pro, too. It may have been installed with Windows Desktop Search Phil Wells
On XP computers in c:\WINDOWS\system32\ tim
Im not using Windows Vista (Using XP)....it shows up though --- used for zune Matermine
It is in my WinXP install under system32 Mark
Windows Update Driver Foundation for XP driver exchange searches. Part of Microsoft Update extender. lostinlodos
It is a part of the PlaysForSure framework for mp3 players and also runs on Windows XP with Media Player 11. Simon
Comes up when Creative ZVM is plugged in mohit
Like many other Vista files, tries to access the internet.
Possibly part of the Nokia N95 setup..?!?.. acts as Media Sync in WMP robcooper2001
Connects the Creative Zen mp3 player.
It is not dangerous at all, and it is not only part of vista, as i have it in XP. Jeff
WINDOWS XP has this file in autoexce part if registry Pekka Ritamaki
Appears when Toshiba Gigabeat is connected via USB Ben
It is also in Windows XP; must be some update DiFFeReNT
Local service occasonially eating up clock cycles N/A
Runs in background when Creative Zen Mp3 is connected Aaron C
It's not exclusive to Microsoft Vista, I've got it on Windows XP Professional.....its never been exposed to Vista
Zune USB driver Tinface
Also part of WinXP, this is a helper app to support things like virtual disk drives (e.g. SanDisk Sansa c240). If you unplug your device, this process will stop, and it will start again when you replug your device. If that's happening, it's _probably_ SAFE. Normally occupies 3 - 4 MB of RAM. A Different Bernhard
I had my mp3 plugged in and when I tried to end process it recognized my mp3 player was plugged in right after. I have the SPI mp3 player. Janie
I dont have windows vista, and my sound just bloody peaked/surged on my speaker for a second and now i see this process which i have never seen before. I kill it and the process comes back.
It runs on XP as well after I installed Office converters to be able to read Word documents created in Office 2008 on Office 2003 TheToolMan
It takes up a lot of memory sometimes
It can run away with your resources. It was using 2GB of my RAM Paul
Connects the Creative ZEN mp3 player to the USB connect. (checked it by unplugging my Zen, and watching the process end) Wicked
MTP process used for transferring files to multimedia devices Mandril
showup after installing wmp11 and mtp sebastian fakoff
I Connect My Zen Player to My Win XP SP3 PC and it comes Up then. Geek
seems to have appeared with my sony ericsson software edmundo
It appears if I connect my Sony mp3 player only and Like Bernhard says, desappears if I unplug it. I don't think it's dangerous. Miguel
It basically connects certain mp3 players through the USB port. The same process can be used to connect the Zune, ZEN and even certain iPods. Not dangerous, unless you encounter large memory usage. If this happens, unconnect your mp3 player and reconnect it. Comp. Geek
Windows User-mode Driver Framework Host  See also: Link Guy-dude
It happens when you connect your media player (iPod, Zen, etc.)  See also: Link Michael
Used in my case to connect to zune. My daughter moved her zune act to the main computer. while trying to sync, software detected the dns request. Ted
Description wudfhost.exe is a Windows Driver Foundation - User-mode Driver Framework Host Process\r from Microsoft Corporation\r belonging to Microsoft® Windows® Operating System  See also: Link Uk M.S. Tester
As "A Different Bernhard" said above: "Also part of WinXP, this is a helper app to support things like virtual disk drives (e.g. SanDisk Sansa c240)." I have several sansa devices and when attached in MTP mode via USB, I see an instance of this process for each attached device. Terminates when the Sansa is removed. Uses about 4 MB of RAM wooster
Connects to from port 52481 on initial use of USB flash drive. The drive works, even if you block the connection. Dave
Ad-Aware Free notes this as a "WNAD Ad Client. TwistedHumor. I'm running Windows 7 (Also like Vista) and I do not a own a Zune nor am I using any virtual discs. Ad-Aware recommends to Quarantine it. Not a virus, adware. TedM
Also found on the Beta of Windows & Jeff
Harmless program (see rating). I use it for shutting down my neighbors computer. EM EN EM
nothing but I have vista at home and xp sp3 at work and realized microsoft had taken quite a few of the processes as well as security enhancements and integrated them into sp3 (not well mind you) I would imagine if you see that and your running sp3 thats most likely why
Any storrage device connected via usb can potentially require this program. Including many usb flash drives and mp3 players such as Microsoft Zune and Creative Zen, however Ipod does not use it. Lepar_m
Name: local service. Used after after connection of nokia 6133, remove thru taskmngr. no issue. inback09
its just a microsoft thing once again. its not a virus, but sometimes it starts taking up a lot of cpu processing power and your CPU meter goes to %100 and its pretty danged annoying. Chuck Norris
Part of Device USB drivers, is Enable when a Massive storage driver is connected Malstrom
can run away with resources, but is necessary for some MP3 players to connect Krad
It appears when I plug my Creative Zen in. It appears to be something to do with the USB connection. KitDreamer
It dissepears from the processlist as fast as the Sony NWZ-E436F are disconnected. It comes back when it is connected again. ELF
Same happens when I plug in my Archos 5. I can't "Safely Remove" the Archos while WUDFhost is running. FNicodem
it also appears when my sony ericsson mobile is connected matt
It starts when I connect my SonyEricsson mobile via usb. Les
Samsung YP-S3 MP3 Naow
Same as toolman. Have noticed after installing Office patch Kookaburra
Sony Walkmanplayer needs this Mi4uric3
it appears when I connect my nokia 5800 on the pc, I have xp pro by the way..., not dangerous at all
It loads when I plug my Zen Media Player In on XP SP3 Computer Technician
It starts when I connect my n91 4gb mobile via usb Muammer
Windows XP SP3 - Process begins when I am syncing my Creative Labs Nomad Jukebox. Trixie.in.Dixie
Zune related cuca
Annoying thing and can be removed after Renaming the file in System32, NO WEBSITE gave me solution so i did it my self:@ RanKer
Appears when Creative Zen player is connected Lou
Nervt beim USB sTick Dirk
occurs when connecting Samsung MP3 player (Yp53) to USB Running XP Home SP3. Firmy
MS Component ; User Mode Driver Host Michael
It enables the use of mp players with media player and recharging. When USB for mp player is connected it shows in Task Manager.When removed so is Wugfhost.exe Nosebleed
process also runs when Motorola phone is connected via USB jimfitter
allows data transfer to mobile devices slambo511
it appears when usb devices are connectd.. harmless pool
works with my SanDisk MP3 player StarFishDeb
Disapears when I disconnect my phone and exit NOKIA OVI SUITE LordBlunt
Shows on when Sansa MP3 player is connected via USB. Windows XP Kris
it loads drivers for USB connections hoggie
Other users say it's a driver for a Zune, Zen, or Sansa e series MP3 player. I only notice it when I have my Sansa Fuze plugged in. It seems to be an MP3 player driver.
Windows Driver Foundation - User-mode Driver Framework Host Process thomas
From what I have seen it most of these comments it is a .exe from most MP3 compatible USB devices thus so I see it as not a threat however I could be wrong it showed up only recently when I plugged in my Insignia Kix mp3 device and when disconnected the .exe turned itself off. Zan
Starts with Sony Ericsson Mobile via USB, Also some licensing service... matt the doctor
Windows Driver Foundation - User-mode Driver  See also: Link Saurabh Tyagi
starts /stops when plugging /unplugging Creative Zen to USB Pawel
it annoys me greatly. just keeps runnining and running - definately associated w/ external flash. vmv
It's a part of the freenet virus Viggy
Same as others (Sansa USB) Jimbob
I know The File Is Used by My MagicJack Randy
suddenly appeared with a window update, and won't disable, and i am using Windows XP 2000. Randomly pulls resources even when system is idling, lags system and more than likely is an excuse for forcing people to upgrade UpsetwithMicrosoft
Used by windows media player when mp3 connected Weather5
Only seems to come up when I plug my samsung mp3 player in
It is a file that is used when connecting an MP3 player to a USB drive on your computer.  See also: Link Eric
My phone uses the process, but thats cause it can be used as a mp3 player...
I disconnect my MP3 player and the process stopped. Plugged the MP3 player back in and the process starts again Dawn N
This is simply the USB device driver. It's harmless. mdg
Showed up after i installed my Samsung P2450H "Rose Black" monitor. I keep good track of whats installed and not and this was installed with the monitor so i call it safe if you installed a Samsung monitor too. Alex
Needed for Zune Andy
it cause to hang up my pc. no solution found so i kill the process and delete it! end. Enayat 567
Legitimate Windows 7 Service / Windows Driver Foundation - User-mode Driver Framework Host Process SB
Its also on Windows 7 Paul
appeared only when i plugged in my psp chris
Windows Driver Foundation - User-mode Driver Framework Host Process. Kevin
It is also used for MTP devices such as a Sony Walkman MP3 player to add music, videos, photos, pod casts as well as other things. Thats also assuming that it is in the C:\Windows\System32 folder. Jakk Ripp
usb driver for media storage and sync walter n.
MTP process used for transferring files to multimedia devices - appears in XP PRO SP3 too when I connect Nokia 6303i Classic through an USB hub Dax Endar
It showed up yesterday when I installed Sansa Clip firmware updater. CPU usage 100%. Running XP SP3. I highlighted the process in Task Manager and watched it disappear/end as i unplugged my Sansa Clip. Only location is system 32 folder. Al
Apears when mp3 player SanDisk Sansa m250 is connected to PC. Madalin
Spawned by Svchost.exe; used for Zune I/O; inc WWW. SteveO'Bama
Generic USB Driver Host used by certain USB devices (Zune for one) It activates when Zune is plugged in. Scott M.
It is a Windows file. The reason why it eats memory is because a poorly programmer driver is using it. Try to uninstall drivers newyuppie
Windows User-mode Driver Framework Host  See also: Link Unbekannter
If you dont have iTunes installed, Windows 7 will launch this instead when you plug in an iPhone. It gives you access to the phones picture directory. I believe one process runs for each memory card you plug in as well. Eric
when i try to open file location it will not open a folder and when i close it the process starts again jb
appeared when i plugged in Zune, fine if in system 32 folder elaine
Shows when you use mp player-Charging etc.Goes when diconnected. cacti
appears when I plugin bluetooth device on XP Sp3 oğuz
It starts up when I plug in my Creative Zen Mozaic MP3 player. It's a safe application. Sara S.
USB controller/host/driver for portable usb devices like mp3 players. Nizzine
I don't know, if it's dangerous, but it shows up when i connect my Samsung Smartphone with my Windows-PC via KIES (USB) Dark Shaman 667
shows up for usb flash drive. goes away when u unplug it. ZiM
Will Upload Data From Host Hulu
I'm assuming it's an acronym for Windows Universal Device Framework Host. It only pops up when I attach my mp3 player that I have not installed the included drivers for. Reion
When I plug in a USB pen with lots of big pictures, WUDFHost accesses them all, according to Vista's Resource Monitor. Takes some time. André
activated with my Sony mp3 player claymore
Starts running on XP when plug samsung mobile into USB. Stops when unplugged. Harmless Mark
This appears when i connect my (Nokia 6303i) cellphone (XP SP2) Répalaki Edömér
windows 7. No user name or description. At first it opened and I went to properties, then wouldn't open again. It vanished when I googled it and started ad-aware.??
appears on my pc in task manager when i connect a mp3 player to the usb port (am running windows XP tono
Starts when I plug in my Sony Ericsson Xperia Arc with PC Companion, software for SE cellphones Åke Bergman
when i try to download cyclone its appear
Runs when nokia 6500 is connected and disappears once a USB connection type is chosen on the phone. Carlos
Same as what Mark said. It's about USB (Appears on XP aswell) DurrFuck
It appears this file is present in all windows versions from XP onwards, on my system it keeps trying to reserve 20GB of RAM, apparently certain drivers require it, it seems to consistently use up large amounts of RAM though, even when idling. Adam
Appears when i connect my samsung android phone. Disappears when on unplug. kancaras
Came to me with Chromium 19.0.1042.0.zip Upon double clicking the application in the extracted Chromium, Avira removed two files. That happened three times to me today. It wrote in two folders: in D:\MSCache\B65.tmp (you must delete MSCache folder) Status: Infected Quarantine object: 52c7de64.qua Detection: TR/Crypt.XPACK.Gen3 Source: C:\Users\****\AppData\Local\Windows Driver Foundation\WUDFHost.exe Status: Infected Quarantine object: 4aa3f12c.qua Detection: TR/Crypt.XPACK.Gen2 Both are 'MALWARE'.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system. Also it adds a scheduled task. As said the The WUDFHost.exe that is Windows OS component must be located in System32 folder. Tarig
Shows up when my ZuneHD is connected. Goes away after disconnecting. Aris
it only comes up when connecting phones,mp3 etc through usb port. oldget
on Win7 it will start to scan all the files on attached USB-disk. All my files. I suspend it and shutdown PC after done. anon
It gives you blue screen of death noby
WUDHost.exe will hide. Very very hard to find. It steal internet connection along with changing your network. Ive been looking for the file for years....I just found a place its says its listed in. There will be many more host files with it. WUD will steal configurations and empty out every one of ur file folders on your pc. It will also put parental controls on your act which leaves u only the read and write. no downloading, uploading, opening system files, ...it basically leaves you with nothing. It says its windows but never believe what u read. Found it in resource monitor. Click on overview tab. WUD puts proxy settings on ur connections. It does this even if the dont use proxy settings is checkec. I could go on and on about the damage WUD does to your whole computer. Every bit of it....If u can't see any system files but only empty folders thru out ur system... i ran diagnostics and diagnostics turned to a report over 8 feet long after printing. heres a few lines of my report i ran after my configurations were taken and left me with empty file folders again PJ
windows service user
It just popped up one day REL
it's show up when you use readyboost whit usb flash or sd card. koko
Runs when my samsung phone is plugged into the computer Snakebite
File will run when the computer is connected via MTP (Media Transfer Protocol) to another device. Mediates the exchange of multimedia files. Harmless, sometimes even necessary. It should not take too many resources. Deihan
If you are worried about WUDF host using up CPU time in Windows 7 you can use Task Manager to set it to low priority. Alan
It takes too much memory Fadi
dunno after isntalling memory card reader in pc which uses internal usb connector it appears and appears even if i shut it off... not sure it should be here allways who cares
This process start when a "SD"-card is inserted. mrgratzie
On XP SP3 machine, immediately loads on connection of GT-N7100 (Samsung Galaxy Note 2) mobile phone. Process cannot be ended via Task Manager, but disappears on disconnection of phone. AndyH55
service starts when i connect my DROID phone. seems harmless (WinXP) zhopa
File will run when the computer is connected via MTP (Media Transfer Protocol) to another device. Runs when my samsung phone is plugged into the computer. Paweł
This file is a windws process that indexes all media to add it to windows media player - the service is cpu intensive,but on completion it should standby and resources return to normal. It is Possiby too cpu intensive for notebooks not using 15/7 processors, Even 17 laptops will report 30% cpu use over 8 logical cores - so this is not light to say the least. EMC
Not dangerous. Runs when my samsung phone is plugged into the computer rufinmusic
Agree with Another Berhnard, this is on XP and is present when Galaxy S2 plugged in and removes itself on disconnection. I think it messes with my keyboard though, I get things like that happen when it is running and not when it isn't. Mike Russell
I found it after I installed Paragon Hard Disk Manager 14
Runs on SVR 2003 as well, seems to be used by ABB 800XA automation software - runs about 10 copies at once. dave
This is a host service for Charging my Daughters Android Cell Phone. bluewolph
C:\Program Files (x86)\Common Files\Windows Driver Foundation\WUDFHost.exe and cvtres.exe -a scrypt - bitcoin miner - Hiding use Process Explorer - Remove using HitmanPro and malwarebytes  See also: Link Somebody
Shows up when I plug in USB devices, such as cellular phones. t1m
Memory hogger Gokal
safe but uses a lot of internet
uses TOO much CPU! Nick
According to virus total, only the commodo virus scanner thinks this file is dangerous. 55 other scanners didn't agree.
I have been suspecting a neighbor of hacking all the devices on my network. This exe kept re-appearing after killing it in the task manager. After changing permissions on the file, I heard someone from my neighbor's home conversing about how they were now not able to get in to my computer. THIS FILE IS USED FOR SPYING!!! Todd
This service is loaded when you connect a 3rd party device with a 3rd party driver loaded. This can also occur when you use Virtual Drives. Neo
Ok so I was a little worried about this when I saw it pop up in my task manager. So I looked it up online read some comments and did some testing. I have found that it only pops up when my KindleFire or my Samsung mp3 player are plugged up and turned on, so I'd have to say that you shouldn't be too worried about it unless you don't have something external plugged up. Mandi
McAfee just popped up and said that this program wants internet access. I'm using Windows 8. NightWolfCP
It's just a driver check/run process. Don't Worry!!! WK
Shows up when charging Android phone on USB port (Win7).Goes with some driver i guess. Mate
Takes up almost a GB of Memory.... not good john
Starts when a Creative Zen Vision:M MP3 player is plugged into a Windows XP PC. Disappears when the player is removed. Canuck
Eating all my remaining CPU, up to 99% and my notebook cannot function correctly, no response for most programmes! It comes up everytime when I turn on the notebook, dont know why this messy .exe file start to work, I am not connecting to any external drives but it still attempts to eat up all my CPU! I think it is a bug for Win8.1, yes I am using Win8.1 the latest update! drivey
It can be dangerous. My computer suddenly started running slow one day and the culprit was Driver Manager Foundation, when I ended the process, my computer was running smooth agian. Enriko
Takes up almost a GB of Memory.... not good john
Dell Latitude E5550 - We are finding this process is eating new system memory, it starts out normal but increases usage of the memory by the minute until the system memory is completely taken up, in addition it drives the processor hard and I have seen Thermal Shutdowns. No idea as to the cause yet. Adrian Lawler
It pushes multiple local bytes through multiple ports even though its safe i wouldnt trust it! dashie
SP3 Comes up when samsung mobile is connected to USB
Just popped up when I started my laptop up. I have Windows 8.1, not XP or anything like that. Never saw it before I did updates earlier today. Megan
Activates when Kindle is charging. Steven Reaves
Nvidia driver for graphics Dude

If you know more about WUDFHost.exe, share your knowledge and help other users.

Security Rating:
Your opinion about this file:
Web page with more details:
Your first name:

More process information

Is WUDFHost.exe spyware or a virus, trojans, adware or worm? Is there a known WUDFHost.exe error?

Other Processes

[WUDFHost.exe in German] [all processes]