How to remove an WinSys error

The free file information forum can help you determine if WinSys.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or an application you can trust.

Click to Run a Free Scan for WinSys.exe related errors

WinSys.exe file information

The process known as DOT MFC Application or Aurthor: Ben Nelson or Module or WinLog Daemon Service

belongs to software DOT Application or Winlog or winsys32 or NNC module or DOT MFC Application

by Microsoft (www.microsoft.com) or NoName or Daemon (www.daemon-tools.cc) or MLabs (www.mlabs.com).

Description: The file WinSys.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 135,168 bytes (63% of all occurrences), 200,704 bytes and 7 more variants.
Program has no file description. WinSys.exe is not a Windows core file. The program has no visible window. WinSys.exe is located in the Windows folder, but it is not a Windows core file. The program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell). WinSys.exe is able to record inputs. Therefore the technical security rating is 63% dangerous, however also read the users reviews.

Recommended: Identify WinSys.exe related errors

If WinSys.exe is located in the folder C:\Windows, the security rating is 82% dangerous. The file size is 12,288 bytes (47% of all occurrences), 8,704 bytes and 7 more variants. There is no information about the author of the file. The file is not a Windows core file. File WinSys.exe is an unknown file in the Windows folder. The program has no visible window. WinSys.exe is able to record inputs, manipulate other programs, monitor applications and connect to Internet.

If WinSys.exe is located in a subfolder of C:\Windows, the security rating is 88% dangerous. The file size is 49,152 bytes. The application has no file description. The program is not visible. The file is located in the Windows folder, but it is not a Windows core file. The process starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell). It is not a Windows core file. The process listens for or sends data on open ports to a LAN or the Internet. WinSys.exe is able to record inputs and hide itself.

If WinSys.exe is located in a subfolder of "C:\Program Files", the security rating is 64% dangerous. The file size is 361,984 bytes.

If WinSys.exe is located in a subfolder of C:\Windows\System32, the security rating is 70% dangerous. The file size is 3,415,040 bytes.

If WinSys.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 42% dangerous. The file size is 28,160 bytes.

External information from Paul Collins:
There are different files with the same name:

"Microsoft Update" definitely not required. Added by the RBOT-GV WORM!
"ssate.exe" definitely not required. Added by the BEAGLE.K WORM!
"Winsys" can run at start up. Win-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it

Important: Some malware camouflages itself as WinSys.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the WinSys.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

cant find any valid windows processes with this name but have found *^*LOTS*^* of trojan/worms which do use this filename. although norton fails to find it despite listing in symantec security response. likes to connect to internet, and add reg keys to run at startup
Lord Verminartus

Packed along with other spyware, was all over my startup entries in registry

It depends. It seems there is a virus/trojan going around with this name, but I know for sure that WinSys.exe comes with some MSI video cards as part of their DOT (Dynamic Overclocking Technology) software package. So, if you have this process running, and you are also running an MSI video card that supports the DOT stuff, you should be ok.
MSI_Fan

associated with MSI DOT (dynamin overclocking technology)

In my computer it is located together Nvidia files (backup ?), in \system32\reinstallbackups\032\. Don´t have any mention (in properties) to nvidia...
Giovanni

It's true that there's a virus that uses the same location and filename but lMSI_Fan has described it very clearly: This program is also delievert with MSI grafic cards and without the process the Dynamic Overclocking Technologie doesn't work. Check the display properties after disableing the process - on the tab 'MSI Clock' the DOT related checkboxex are disabled. Check the properties of the WinSys.Exe, in the secure version the manufacturer is MSI is shown there.
BudeII (further information)

Correct! It is the Dynamic Overclocking Technology .exe used with MSI made nVidia Video Cards. Original file name DOT.exe but now called WinSys.exe which is located in the Windose/Sys32 folder and is 132 KB (135,168 bytes) in size. Of course it is in the start up registry because you want it to be running while playing games etc. Can't recall it asking for net access previously so if yours is, and is in the Windows root directory, maybe you have a problem (or just a poor install!). Rock On!
Rockman (further information)

keeps coming back and isn't recognized by scans. good call on MSI DOT, i have MSI video card, and MoBo.
SlAppY

its called WinXSys.exe, i found it in C:\Windows and though i delete it, still doesn't solve the problem

nVidia Video Cards WinSys.exe DOT (Dynamic Overclocking Technology)
RCadmin

It is packed with MSI Nvidea videocards, i checked and it`s not dangerous
mEssEd-UP

is in my nvidia download "5663_xp2000.zip" 132 kb. DOT file, Xsoftspy says it is high risk?? Ad-Aware does not detect my version!!
Michael

Packed with MSI videocards, DOT overclocking software for gfx
Jimbo

Zone Alarms' Program Control sees Winsys.exe as "DOT MFC Application". So if you are not sure if it is for MSI Overclocking (which I have), you can always block this program in Zone Alarm so that it cannot get internet access.
Dragonlord

Trojan Downloader
Unknow

WinSys.exe was found on a server in location c:\windows\system - it IS malicious in this instance - it was downloading other viral programs - had to use pskill to kill it in a looped batchfile while I then delete it - it was causing crashing over 24 hours as it grabbs lots of process threads - so beware there is a virus that uses the filename wmisys.exe!!! not just the one relating to graphics adaptors!
Erebus (further information)

Is track as a program on the tolbar
Robert Aling

I also have MSI video card with Dynamic Overclocking Technology. WinSys.exe loads when D.O.T. is enabled, and is located in C:\Windows\System32.

c:\users\ak-47\appdata\roaming\winsys\winsys.exe
fredy

Summary: Average user rating of WinSys.exe: based on 34 votes with 19 reviews.

17 users think WinSys.exe is essential for Windows or an installed application. 4 users think it's probably harmless. 6 users think it's neither essential nor dangerous. 7 users think WinSys.exe is dangerous and recommend removing it. 3 users doesn't grade WinSys.exe ("not sure about it").

WinSys scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.

Other processes