Lately, Most Windows users realize that their antivirus applications point to a file called sihclient.exe as a threat to their system. Most likely your firewall blocks this file and puts it in the virus chest (or ask you to confirm).
Sihclient.exe is trying to access the network
What is sihclient.exe and is it dangerous?
Sihclient.exe is a server and Windows initiated repair client 10 run it every day to repair any damage to the operating system. It is a Windows own file and it is a legitimate file which is essential for Windows updates. You can even check Sihclient.exe related scheduled task from task scheduler. Here are the steps to verify SIH programming
-
Hold down the Windows key and press R
-
Enter »taskschd. msc »and hit Enter
Type taskschd.msc in Run to open Task Scheduler
-
Double click Task Scheduler in the left pane.
-
Double click on Microsoft from the left panel.
-
Double click Windows from the left panel.
Navigate to the Windows update section to locate the SihClientes schedule
-
Select Windows Update in the left pane.
Select the Sih schedule to verify the description of the SihCliente
You should be able to see a task called sih (or a variation of that) in the center panel. If you select scheduled task yes, you should also be able to see its details. In your description, should describe SIH as the server-initiated repair client.
However, although it is a legitimate file, this does not mean that you should always let it run. Malware can easily be called sihclient.exe and cause damage to your system. If your security application or your firewall is marking this file, then you should definitely scan your system with an antivirus application. You can also determine if the file is legitimate or not by looking at the scheduled time. Observe the scheduled runtime of the sih by following the steps above. For example, in my case, is scheduled to run at 5 a. M. And every 20 hours from then. Therefore, you shouldn't get the warning message every hour. Then, if you get warnings at random times (when your sihclient is not supposed to run), then you need to thoroughly scan your system. But if you don't want to scan the whole system, We recommend that you use another antivirus program to see if it detects the same file or if you use VirusTotal.
What is VirusTotal?
VirusTotal is a website where you can upload the files and it will tell you if the file contains any malicious components. Click here and click on Choose file and then select the file marked by your antivirus. Check if the file is marked or not. If that is not the case, just ignore the warning and whitelist the file. You must also update your antivirus program.
Use VirusTotal to check the status of the SihClient file
On the other hand, if VirusTotal marks your file as a threat, we recommend that you run a full scan with your antivirus.
Look at VirusTotal results to check if the file was clean or not
What should I do if I find a false positive?
First, you must delete the file from virus vault because your antivirus will block it. You can open your antivirus application and then go to Protection> Virus chest> right click on your file> Select Restore and add an exclusion.
Open the Avast virus chest to access the quarantined SihClient
Although these steps are for Avast antivirus, they should also apply to other antivirus applications. All antivirus have a virus vault and offer an option to restore files from there.
Right click on the quarantined SihClient to restore the virus vault
You must also upload the file on the false positive form to inform Avast about the file. This will prevent future false positives and will be beneficial to everyone.
