English | Deutsch

How to remove an winsys error

Winsys.exe is a executable file (a program) for Windows. The filename extension .exe is the abbreviation for executable. Only run executable files from publishers you trust, because executable files can potentially change your computer settings or harm your computer. The free file information forum can help you determine if winsys.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or an application you can trust.

Click to Run a Free Scan for winsys.exe related errors.

Winsys.exe file information

The process known as DOT MFC Application or Aurthor: Ben Nelson or Module or WinLog Daemon Service

belongs to software DOT Application or Winlog or winsys32 or NNC module or DOT MFC Application

by Microsoft (www.microsoft.com) or NoName or Daemon (www.daemon-tools.cc) or MLabs (www.mlabs.com).

Description: The file winsys.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 135,168 bytes (63% of all occurrences), 200,704 bytes and 7 more variants. http://www.file.net/process/winsys.exe.html 
The software has no file description. Winsys.exe is not a Windows core file. The program has no visible window. Winsys.exe is located in the Windows folder, but it is not a Windows core file. The program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell). Winsys.exe is able to record inputs. Therefore the technical security rating is 63% dangerous, however also read the users reviews.

Recommended: Identify winsys.exe related errors .

If winsys.exe is located in the folder C:\Windows, the security rating is 82% dangerous. The file size is 12,288 bytes (47% of all occurrences), 8,704 bytes and 7 more variants. There is no information about the author of the file. The file is not a Windows core file. The winsys.exe file is an unknown file in the Windows folder. The program has no visible window. Winsys.exe is able to record inputs, manipulate other programs, monitor applications and connect to the Internet.

If winsys.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 48% dangerous. The file size is 28,160 bytes (50% of all occurrences) or 548,864 bytes. The program is not visible. Winsys.exe is not a Windows core file.

If winsys.exe is located in a subfolder of C:\Windows, the security rating is 88% dangerous. The file size is 49,152 bytes.

If winsys.exe is located in a subfolder of "C:\Program Files", the security rating is 64% dangerous. The file size is 361,984 bytes.

If winsys.exe is located in a subfolder of C:\Windows\System32, the security rating is 70% dangerous. The file size is 3,415,040 bytes.

External information from Paul Collins:
There are different files with the same name:

  • "Microsoft Update" definitely not required. Added by the RBOT-GV WORM!
  • "ssate.exe" definitely not required. Added by the BEAGLE.K WORM!
  • "Winsys" can run at start up. Win-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it 

Important: Some malware camouflages itself as winsys.exe, for example W32.SillyFDC or Adware.Gen (detected by Symantec), and Worm:Win32/Autorun.BZ or VirTool:Win32/VBInject (detected by Microsoft). Therefore, you should check the winsys.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

cant find any valid windows processes with this name but have found *^*LOTS*^* of trojan/worms which do use this filename. although norton fails to find it despite listing in symantec security response. likes to connect to internet, and add reg keys to run at startup
  Lord Verminartus  
Packed along with other spyware, was all over my startup entries in registry
It depends. It seems there is a virus/trojan going around with this name, but I know for sure that WinSys.exe comes with some MSI video cards as part of their DOT (Dynamic Overclocking Technology) software package. So, if you have this process running, and you are also running an MSI video card that supports the DOT stuff, you should be ok.
associated with MSI DOT (dynamin overclocking technology)
In my computer it is located together Nvidia files (backup ?), in \system32\reinstallbackups\032\. Don´t have any mention (in properties) to nvidia...
It's true that there's a virus that uses the same location and filename but lMSI_Fan has described it very clearly: This program is also delievert with MSI grafic cards and without the process the Dynamic Overclocking Technologie doesn't work. Check the display properties after disableing the process - on the tab 'MSI Clock' the DOT related checkboxex are disabled. Check the properties of the WinSys.Exe, in the secure version the manufacturer is MSI is shown there.
  BudeII   (further information)
Correct! It is the Dynamic Overclocking Technology .exe used with MSI made nVidia Video Cards. Original file name DOT.exe but now called WinSys.exe which is located in the Windose/Sys32 folder and is 132 KB (135,168 bytes) in size. Of course it is in the start up registry because you want it to be running while playing games etc. Can't recall it asking for net access previously so if yours is, and is in the Windows root directory, maybe you have a problem (or just a poor install!). Rock On!
  Rockman   (further information)
keeps coming back and isn't recognized by scans. good call on MSI DOT, i have MSI video card, and MoBo.
its called WinXSys.exe, i found it in C:\Windows and though i delete it, still doesn't solve the problem
nVidia Video Cards WinSys.exe DOT (Dynamic Overclocking Technology)
It is packed with MSI Nvidea videocards, i checked and it`s not dangerous
is in my nvidia download "5663_xp2000.zip" 132 kb. DOT file, Xsoftspy says it is high risk?? Ad-Aware does not detect my version!!
Packed with MSI videocards, DOT overclocking software for gfx
Zone Alarms' Program Control sees Winsys.exe as "DOT MFC Application". So if you are not sure if it is for MSI Overclocking (which I have), you can always block this program in Zone Alarm so that it cannot get internet access.
Trojan Downloader
WinSys.exe was found on a server in location c:\windows\system - it IS malicious in this instance - it was downloading other viral programs - had to use pskill to kill it in a looped batchfile while I then delete it - it was causing crashing over 24 hours as it grabbs lots of process threads - so beware there is a virus that uses the filename wmisys.exe!!! not just the one relating to graphics adaptors!
  Erebus   (further information)
Is track as a program on the tolbar
  Robert Aling  
I also have MSI video card with Dynamic Overclocking Technology. WinSys.exe loads when D.O.T. is enabled, and is located in C:\Windows\System32.
Definitely dangerous. It was taking pics of all my tabs that was open in the internet and it heated up my comp like crazy. All my audio tabs went out of sync. If you have ubuntu alongside windows, access windows via ubuntu and delete the winsys.

Rating chart

Summary: Average user rating of winsys.exe: based on 35 votes with 20 reviews.
17 users think winsys.exe is essential for Windows or an installed application. 4 users think it's probably harmless. 6 users think it's neither essential nor dangerous. 8 users think winsys.exe is dangerous and recommend removing it. 3 users don't grade winsys.exe ("not sure about it").

Do you have additional information?
What do you know about winsys.exe: 
How do you rate it: 
Link for more info's: 
Your Name: 

Winsys scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.

Other processes

winsys.exe [all]