Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.98%
6.2.9200.16384 (win8_rtm.120725-1247)	1.96%
6.2.9200.16384 (win8_rtm.120725-1247)	1.47%
6.2.9200.16384 (win8_rtm.120725-1247)	0.98%
6.2.9200.16384 (win8_rtm.120725-1247)	1.47%
6.1.7600.16385 (win7_rtm.090713-1255)	11.27%
6.1.7600.16385 (win7_rtm.090713-1255)	8.33%
6.0.6000.16386 (vista_rtm.061101-2205)	11.76%
6.0.6000.16386 (vista_rtm.061101-2205)	3.92%
6.0.6000.16386 (vista_rtm.061101-2205)	53.92%
6.0.6000.16386 (vista_rtm.061101-2205)	3.92%

Relationships

ersvc.dll (Windows Error Reporting Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

ConvertSidToStringSidW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, DuplicateTokenEx, ConvertStringSidToSidW, SetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, RegGetValueW, RegOpenKeyExW, RegDeleteValueW, RegCloseKey, RegisterServiceCtrlHandlerExW, GetLengthSid, GetTokenInformation, CreateProcessAsUserW, TraceMessage, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, RevertToSelf, ImpersonateLoggedOnUser, OpenProcessToken, OpenThreadToken, SetServiceStatus, ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-appmodel-runtime-l1-1-0.dll

GetApplicationUserModelId, GetPackageFullName

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI, DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-1.dll

UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError

api-ms-win-core-handle-l1-1-0.dll

CloseHandle, DuplicateHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, GetProcessHeap, HeapAlloc

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalFree

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedExchange, InterlockedCompareExchange, InterlockedDecrement, InterlockedIncrement

api-ms-win-core-kernel32-legacy-l1-1-0.dll

LoadLibraryW, WTSGetActiveConsoleSessionId

api-ms-win-core-libraryloader-l1-1-1.dll

LoadLibraryExW, DisableThreadLibraryCalls, FreeLibrary, GetProcAddress

api-ms-win-core-memory-l1-1-1.dll

MapViewOfFile, CreateFileMappingW, ReadProcessMemory, UnmapViewOfFile

api-ms-win-core-namespace-l1-1-0.dll

OpenPrivateNamespaceW, ClosePrivateNamespace, CreatePrivateNamespaceW

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessTimes, OpenThreadToken, OpenProcessToken, CreateProcessAsUserW, ResumeThread, TerminateProcess, GetCurrentProcessId, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, GetExitCodeProcess, GetProcessId, ProcessIdToSessionId, GetCurrentThreadId, GetCurrentProcess, CreateProcessW, OpenThread, CreateThread, GetThreadId, OpenProcess

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW

api-ms-win-core-psapi-obsolete-l1-1-0.dll

K32GetModuleFileNameExW

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, RegOpenKeyExW

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrlenW

api-ms-win-core-synch-l1-2-0.dll

Sleep, ResetEvent, SetEvent, CreateMutexW, InitializeCriticalSection, WaitForSingleObject, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, WaitForMultipleObjectsEx, CreateEventW, OpenEventW

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemDirectoryW, GetSystemTime, GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0.dll

WaitForThreadpoolWaitCallbacks, TrySubmitThreadpoolCallback, CloseThreadpoolWait, SetThreadpoolWait, CloseThreadpoolCleanupGroup, LeaveCriticalSectionWhenCallbackReturns, CreateThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, CreateThreadpoolWait

api-ms-win-core-threadpool-legacy-l1-1-0.dll

UnregisterWaitEx

api-ms-win-core-timezone-l1-1-0.dll

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0.dll

DecodePointer, EncodePointer

api-ms-win-core-version-l1-1-0.dll

VerQueryValueW, GetFileVersionInfoExW, GetFileVersionInfoSizeExW

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage

api-ms-win-security-base-l1-2-0.dll

AllocateAndInitializeSid, GetTokenInformation, FreeSid, SetTokenInformation, ImpersonateLoggedOnUser, GetSidSubAuthority, GetSidSubAuthorityCount, SetSecurityDescriptorDacl, CheckTokenMembership, RevertToSelf, InitializeSecurityDescriptor, DuplicateToken, CreateWellKnownSid, DuplicateTokenEx

api-ms-win-service-core-l1-1-0.dll

RegisterServiceCtrlHandlerExW, SetServiceStatus

api-ms-win-service-core-l1-1-1.dll

RegisterServiceCtrlHandlerExW, SetServiceStatus

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle, OpenServiceW, OpenSCManagerW

api-ms-win-service-management-l2-1-0.dll

QueryServiceConfigW

kernel32.dll

LoadLibraryExW, CompareFileTime, GetFileInformationByHandle, CreateFileW, FindNextChangeNotification, FindFirstChangeNotificationW, FindResourceW, DisableThreadLibraryCalls, DecodePointer, InitializeCriticalSection, DeleteCriticalSection, FreeLibrary, LocalFree, CloseHandle, UnmapViewOfFile, LeaveCriticalSection, EnterCriticalSection, OpenEventW, GetLastError, GetCurrentProcessId, HeapFree, CreatePrivateNamespaceW, HeapAlloc, GetProcessHeap, ClosePrivateNamespace, WaitForSingleObject, EncodePointer, GetProcAddress, LoadLibraryW, CreateProcessW, GetSystemDirectoryW, DuplicateHandle, GetCurrentProcess, OpenProcess, GetThreadId, GetProcessId, WaitForMultipleObjects, ResumeThread, MapViewOfFile, CreateFileMappingW, ProcessIdToSessionId, CreateEventW, SetEvent, CloseThreadpoolCleanupGroupMembers, InterlockedDecrement, TerminateProcess, InterlockedIncrement, LeaveCriticalSectionWhenCallbackReturns, TrySubmitThreadpoolCallback, CreateThread, CreateThreadpoolCleanupGroup, DelayLoadFailureHook, InterlockedCompareExchange, LoadLibraryA, GetCommandLineA, GetVersionExA, GetModuleHandleA, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, OutputDebugStringA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, HeapSize, WriteFile, GetModuleHandleW, GetCPInfo, GetACP, GetOEMCP, Sleep, VirtualAlloc, SetFilePointer, GetConsoleCP, GetConsoleMode, MultiByteToWideChar, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, VirtualProtect, GetSystemInfo, VirtualQuery, CreateFileA, FlushFileBuffers, OpenThread, SetThreadpoolWait, SystemTimeToFileTime, GetSystemTime, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, GetProcessTimes, GetExitCodeProcess, lstrlenW, CreateThreadpoolWait, InterlockedCompareExchange64, DeleteTimerQueueEx, CreateTimerQueueTimer, CreateTimerQueue, SizeofResource, LockResource, LoadResource, GetSystemWow64DirectoryW, RegCreateKeyExW, RegSetValueExW, K32GetModuleFileNameExW, QueryFullProcessImageNameW, LoadLibraryExA, InterlockedExchange, OpenPrivateNamespaceW, ResetEvent, UnregisterWait, CloseThreadpoolCleanupGroup, ReadProcessMemory

msvcrt.dll

DllMain

ntdll.dll

RtlUnwind, NtAlpcCreatePort, AlpcInitializeMessageAttribute, AlpcGetMessageAttribute, NtSetSystemInformation, ShipAssert, WinSqmEventWrite, NtDuplicateToken, NtQueryInformationToken, RtlUpcaseUnicodeChar, WinSqmAddToStream, NtAlpcAcceptConnectPort, NtAlpcConnectPort, NtAlpcSendWaitReceivePort, RtlInitUnicodeString, RtlCreateBoundaryDescriptor, RtlCreateServiceSid, RtlAddSIDToBoundaryDescriptor, RtlDeleteBoundaryDescriptor, NtAlpcOpenSenderProcess, NtAlpcOpenSenderThread, NtClose, NtOpenEvent, NtTerminateProcess, EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, EtwTraceMessage, NtQueryInformationProcess

Export table

ServiceMain

SvchostPushServiceGlobals

wersvc.dll

Windows Error Reporting Service by Microsoft

Remove wersvc.dll

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	32b88481d3b326da6deb07b1d03481e7
SHA1:	acc4f5b1f53639d577f9c1565f95f5fccf826622
SHA256:	821fbaf147e525ed15eb9391b16a96c6d5464841258b11f277efb57a3bd50e37

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is wersvc.dll?

The error reporting feature enables users to notify Microsoft of application faults, kernel faults, unresponsive applications, and other application specific problems. Microsoft can use the error reporting feature to provide customers with troubleshooting information, solutions, or updates for their specific problems.

About wersvc.dll (from Microsoft)

“Windows provides crash, non-response, and kernel fault error reporting by default without requiring changes to your application. The report will include minidump and heap dump information if required.”

Details

File name:	wersvc.dll
Publisher:	Microsoft Corporation
Product name:	Windows Error Reporting Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wersvc.dll
Original name:	wersvc
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	124 KB (126,976 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Hosted services

Runs as a shared service under the Windows svcHost

Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'

Distribution by Windows OS

OS version	distribution
Windows Vista Home Premium	51.00%
Windows Vista Home Basic	11.50%
Windows 7 Home Premium	7.00%
Windows Vista Ultimate	7.00%
Windows 7 Ultimate	6.50%
Windows 7 Ultimate N	4.50%
Windows Vista Business	4.00%
Windows 7 Professional	2.00%
Windows 8	2.00%
Windows 8 Pro	1.50%
Windows 8 Pro with Media Center	1.00%
Windows 8.1 Pro	0.50%
Windows 8.1 Enterprise	0.50%
Windows Vista™ Home Premium	0.50%
Microsoft Windows XP	0.50%

Distribution by country

United States installs about 58.76% of Windows Error Reporting Service.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	27.54%
Hewlett-Packard	21.56%
Toshiba	11.98%
ASUS	10.78%
Sony	9.58%
Gateway	7.19%
Acer	5.39%
Samsung	1.80%
Lenovo	1.20%
Intel	1.20%
American Megatrends	0.60%
GIGABYTE	0.60%
Packard Bell	0.60%

Remove Adware and Spyware Programs, FREE Download!