What is MpShHook.dll?

MpShHook.dll is a Windows DLL file. DLL is the abbreviation for Dynamic Link Library. DLL files are needed by programs or web browser extensions, because they contain program code, data, and resources. The following information can help you determine if MpShHook.dll is a Windows system file or if it belongs to an application that you can trust.

Click to Run a Free Scan for MpShHook.dll related errors

MpShHook.dll file information

The process known as Shell Execution Monitor belongs to software Windows Defender by Microsoft (

Description: MpShHook.dll is not essential for the Windows OS and causes relatively few problems. The MpShHook.dll file is located in a subfolder of "C:\Program Files (x86)" (normally C:\Program Files (x86)\Windows Defender\). Known file sizes on Windows 10/8/7/XP are 83,224 bytes (98% of all occurrences) or 81,616 bytes. 
This is a special .dll file (Dynamic Link Library), which starts automatically when programs are launched. So it can monitor or manipulate all of your program starts. The program is not visible. MpShHook.dll is certified by a trustworthy company. The file is not a Windows core file. The process can be uninstalled in the Control Panel. It monitors program starts. Therefore the technical security rating is 39% dangerous; but you should also compare this rating with the user reviews.

Uninstalling this variant: In case of any problems with MpShHook.dll, you may want to do the following:
  1) uninstall the associated program (Start > Control Panel > Uninstall a Program > Windows Defender)
  2) go to the support area of the Microsoft website
  3) update the program to the latest version.

Recommended: Identify MpShHook.dll related errors

Important: Some malware camouflages itself as MpShHook.dll, particularly when located in the C:\Windows or C:\Windows\System32 folder. Therefore, you should check the MpShHook.dll process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Microsoft Windows Defender (formerly Microsoft Antispyware beta 1) ... safe
Gehört zum Windows Defender Tool. Sollte eigentlich harmlos sein
it is from microsoft, and it supposed to stop hackers on site, so therefore, it only does something when a hijacker or hacker comes in, otherwise kind uses RAM up
  a geek...  
It's part of user installed Microsoft Windows Defender.
This process is part of Microsoft Antispyware package.
Part of Windows Defender
    (further information)
Freeware for virus protection
Safe as a house. If that made sense.

Rating chart

Summary: Average user rating of MpShHook.dll: based on 10 votes with 8 user comments. 7 users think MpShHook.dll is essential for Windows or an installed application. 2 users think it's probably harmless. One user thinks MpShHook.dll is dangerous and recommends removing it. One user is not sure about it.

Do you have additional information?

Best practices for resolving MpShHook issues

A clean and tidy computer is the key requirement for avoiding problems with MpShHook. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the MpShHook.dll process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

MpShHook.dll [all]