SCardSvr.exe
Smart Card Resource Management Server by Microsoft
This is a Windows system installed file with Windows File Protection (WFP) enabled.
Warning 3 antivirus scanners has detected malware in various versions of SCardSvr.exe.
Overview
There are 27 versions of scardsvr.exe in the wild, the latest version being 5.2.3790.3959 (srv03_sp2_rtm.070216-1710). It is started as a Windows Service called 'SCardSvr' with the name 'SYSTEM\CurrentControlSet\Services\SCardSvr' and described as “Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). This is executed as a shared service (which simply means that this service can share a process with other Win32 services). The average file size is about 95.69 KB. During the process's lifecycle, the typical CPU resource utilization is about 0.0002% including both foreground and background operations, the average private memory consumption is about 1.62 MB with the maximum memory reaching around 3.38 MB. Addionally, typically read and write I/O disk operations is about 62 Bytes per minute for reads and 50 Bytes per minute for writes.
What is scardsvr.exe?
Windows integrate the smart card base components into the operating system to support public key services, such as smart card logon. The Smart Card Base Components are outlined below. The basic components of the smart card subsystem are based on PC/SC standards, a Resource Manager that uses a Windows API. A user interface (UI) that works with the Resource Manager.
About scardsvr.exe (from Microsoft)
“A smart card adds a level of integrity to secure email applications because it stores the private key on the card, protected by a PIN. In order to compromise the private key and send signed email as s”
 Details
|
| File name: | scardsvr.exe |
| Publisher: | Microsoft Corporation |
| Product name: | Smart Card Resource Management Server |
| Description: | Microsoft® Windows® Operating System |
| Typical file path: | C:\Windows\System32\scardsvr.exe |
| Windows Service |
| Service name: | SYSTEM\CurrentControlSet\Services\SCardSvr |
| Display name: | SCardSvr |
| Description: | “Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.” |
| Type: | Win32ShareProcess |
Behaviors
(Note, the behaviors below are for all versions of scardsvr.exe, select a unique version for details.)
Services
Runs under 'SYSTEM\CurrentControlSet\Services' as a shared service by the Service Host (svchost.exe)
- SCardSvr
- 'SCardSvr' (Smart Card)
Malware detections
Based on 40+ industry antivirus scanners, 3 of them detected the following malware.
All file variations of scardsvr.exe
Distribution by Windows OS
| OS version | distribution |
| Microsoft Windows XP |
93.20% |
|
| Windows XP Professional |
3.24% |
|
| Windows XP Home Edition |
1.62% |
|
| Windows 7 Home Premium |
1.29% |
|
| Windows Server 2003, Standard Edition |
0.32% |
|
| Microsoft Windows XP Home Edition |
0.32% |
|
Distribution by country
United States installs about 45.04% of Smart Card Resource Management Server.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
46.96% |
|
| Intel |
11.30% |
|
| Toshiba |
6.96% |
|
| American Megatrends |
6.96% |
|
| Compaq |
6.09% |
|
| Hewlett-Packard |
5.65% |
|
| GIGABYTE |
5.22% |
|
| ASUS |
3.48% |
|
| Sahara |
2.61% |
|
| Gateway |
1.74% |
|
| Acer |
1.30% |
|
| Lenovo |
0.87% |
|
| Sony |
0.87% |
|
