How to remove WinSys error

WinSys.exe file information

The process DOT MFC Application or Windows System or WinLog Daemon Service or Aurthor: Ben Nelson or Module belongs to the software DOT Application or Sistema operacional Microsoft® Windows® or WinSys.exe or DOT MFC Application or Winlog or NNC module by Microsoft Corporation (www.microsoft.com) or MLabs or Daemon or NoName Corp.

Description: File WinSys.exe is located in the folder C:\Windows\System32 or sometimes in a subfolder of "C:\Program Files". Known file sizes on Windows XP are 135168 bytes (70% of all occurrence), 200704 bytes, 173568 bytes, 196608 bytes, 130136 bytes, 1264128 bytes, 3286016 bytes.
The file is not a Windows system file. There is no file information. The application starts when Windows starts (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run). The program has no visible window. WinSys.exe is an unknown file in the Windows folder. WinSys.exe is able to record inputs. Therefore the technical security rating is 63% dangerous, however also read the users reviews.

If WinSys.exe is located in the folder C:\Windows then the security rating is 60% dangerous. File size is 12288 bytes (25% of all occurrence), 541696 bytes, 43008 bytes, 470150 bytes. There is no file information. File WinSys.exe is not a Windows core file. The process starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run). WinSys.exe is able to record inputs, monitor applications, hide itself, manipulate other programs.

If WinSys.exe is located in a subfolder of C:\Windows then the security rating is 88% dangerous. File size is 49152 bytes. There is no file information. The program is not visible. File WinSys.exe is an unknown file in the Windows folder. Program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run). WinSys.exe is not a Windows core file. Program uses ports to connect to LAN or Internet. WinSys.exe is able to record inputs, hide itself.

If WinSys.exe is located in a subfolder of C:\Windows\System32 then the security rating is 70% dangerous. File size is 3415040 bytes.

If WinSys.exe is located in a subfolder of "C:\Documents and Settings" then the security rating is 42% dangerous. File size is 28160 bytes.

External information from Paul Collins:
There are different files with the same name:

• "Microsoft Update" definitely not required. Added by the RBOT-GV WORM!
• "ssate.exe" definitely not required. Added by the BEAGLE.K WORM!
• "Winsys" can run at start up. Win-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it 

Important: Some malware camouflage themselves as WinSys.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the WinSys.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.

D.ynamic O.verclocking T.echnology von MSI
  headbanger  

Zone Alarms' Program Control sees Winsys.exe as "DOT MFC Application". So if you are not sure if it is for MSI Overclocking (which I have), you can always block this program in Zone Alarm so that it cannot get internet access.
  Dragonlord  

Kann sich unter Win98/SE auch im Ordner C:\Windows\System befinden und loggt Systemprozesse und Programmstarts mit wie Dr. Watson oder der Diagnosestart.Die Datei kann ohne weiteres entfernt werden und gehört auf keinen Fall in den Autostart wegen der Verwechslung mit Virenmanipulierten Dateien sollte sie auf jeden Fall entfernt werden (Remmen genügt)
  Axel Grimmer   (further information)

Packed with MSI videocards, DOT overclocking software for gfx
  Jimbo  

Als Originaldatei Bestandteil von MSI-Grafikkarten, Kann jedoch den Wurm W32/Rbot-AEF enthalten. Empfehlung: Überprüfung mit AntiVirus-Software (korrekte Erkennung bei allen Anbietern)
  Bildmuxer  

is in my nvidia download "5663_xp2000.zip" 132 kb. DOT file, Xsoftspy says it is high risk?? Ad-Aware does not detect my version!!
  Michael  

kein Virus oder Trojaner / Bestandteil von MSI D.O.T.
  streuner32  

It is packed with MSI Nvidea videocards, i checked and it`s not dangerous
  mEssEd-UP  

zu MSI Treiber
  mosis  

nVidia Video Cards WinSys.exe DOT (Dynamic Overclocking Technology)
  RCadmin  

ich bin der meinung es ist wirklich dieses MSI dynamic overclocking technology
  atze  

its called WinXSys.exe, i found it in C:\Windows and though i delete it, still doesn't solve the problem
   

keeps coming back and isn't recognized by scans. good call on MSI DOT, i have MSI video card, and MoBo.
  SlAppY  

DOT application ist von MSI und heisst soviel wie "DYNAMIC OVERCLOCKING TECHNOLOGY" wenn man am desktop rechte maustaste drückt dann eigenschaften und MSI Clock drückt sieht man ganz unten die DOT schaltfläche und einigen einstellungen zur automatischen overclocking Technologie ,
  iggi   (further information)

Correct! It is the Dynamic Overclocking Technology .exe used with MSI made nVidia Video Cards. Original file name DOT.exe but now called WinSys.exe which is located in the Windose/Sys32 folder and is 132 KB (135,168 bytes) in size. Of course it is in the start up registry because you want it to be running while playing games etc. Can't recall it asking for net access previously so if yours is, and is in the Windows root directory, maybe you have a problem (or just a poor install!). Rock On!
  Rockman   (further information)

Sofern du eine Grafikkarte mit installierten D.O.T Treibern hast kann diese Datei ruhig im Hintergrund laufen. Wenn nicht ist es höchstwarscheinlich ein Virus/Wurm.
   

winsys.exe ist eine anwendung von nvidia tuning besonders zu sehen bei geforce 6 karten meistens aktiviert bei DOT anwendungen bzw automatisches tuning
  DayWalkerx  

It's true that there's a virus that uses the same location and filename but lMSI_Fan has described it very clearly: This program is also delievert with MSI grafic cards and without the process the Dynamic Overclocking Technologie doesn't work. Check the display properties after disableing the process - on the tab 'MSI Clock' the DOT related checkboxex are disabled. Check the properties of the WinSys.Exe, in the secure version the manufacturer is MSI is shown there.
  BudeII   (further information)

In my computer it is located together Nvidia files (backup ?), in \system32\reinstallbackups\032\. Don´t have any mention (in properties) to nvidia...
  Giovanni  

associated with MSI DOT (dynamin overclocking technology)
   

Keine sinnvolle Funktion, nach beendigung des Tasks keine Nachteile festgestellt... wie oben bereits erwähnt unter Google meistens als Virus/Wurm gefunden.
   

It depends. It seems there is a virus/trojan going around with this name, but I know for sure that WinSys.exe comes with some MSI video cards as part of their DOT (Dynamic Overclocking Technology) software package. So, if you have this process running, and you are also running an MSI video card that supports the DOT stuff, you should be ok.
  MSI_Fan  

Packed along with other spyware, was all over my startup entries in registry
   

scheint ein wurm zu sein(z.B. W32/Rbot-GV). es gibt da aber mehr möglichkeiten.
  derLude   (further information) (further information)

cant find any valid windows processes with this name but have found *^*LOTS*^* of trojan/worms which do use this filename. although norton fails to find it despite listing in symantec security response. likes to connect to internet, and add reg keys to run at startup
  Lord Verminartus  

WinSys scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Spyware Doctor detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

Registry Booster free scans, cleans, repairs and optimizes your system.

Other processes