What is winsys.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the winsys.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for winsys.exe related errors

Winsys.exe file information

Windows Task Manager with winsys
Winsys.exe process in Windows Task Manager

The process known as DOT MFC Application or Stub belongs to software DOT Application or Windows mngr by Microsoft (

Description: Winsys.exe is not essential for Windows and will often cause problems. The file winsys.exe is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/8/7/XP are 135,168 bytes (48% of all occurrences), 200,704 bytes, 196,608 bytes, 55,296 bytes or 309,760 bytes. 
The software has no file description. Winsys.exe is not a Windows core file. The program has no visible window. Winsys.exe is located in the Windows folder, but it is not a Windows core file. The program starts upon Windows startup (see Registry key: MACHINE\Run, Run, MACHINE\RunServices). Winsys.exe is able to record keyboard and mouse inputs. Therefore the technical security rating is 67% dangerous, however you should also read the user reviews.

Recommended: Identify winsys.exe related errors

External information from Paul Collins:
There are different files with the same name:

Important: Some malware camouflages itself as winsys.exe, for example Trojan.Gen or W32.SillyFDC (detected by Symantec), and Trojan.Win32.Agent.abpfp or not-a-virus:Monitor.Win32.KeySpy.104 (detected by Kaspersky). Therefore, you should check the winsys.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

cant find any valid windows processes with this name but have found *^*LOTS*^* of trojan/worms which do use this filename. although norton fails to find it despite listing in symantec security response. likes to connect to internet, and add reg keys to run at startup
  Lord Verminartus  
Packed along with other spyware, was all over my startup entries in registry
It depends. It seems there is a virus/trojan going around with this name, but I know for sure that WinSys.exe comes with some MSI video cards as part of their DOT (Dynamic Overclocking Technology) software package. So, if you have this process running, and you are also running an MSI video card that supports the DOT stuff, you should be ok.
associated with MSI DOT (dynamin overclocking technology)
In my computer it is located together Nvidia files (backup ?), in \system32\reinstallbackups\032\. Don´t have any mention (in properties) to nvidia...
It's true that there's a virus that uses the same location and filename but lMSI_Fan has described it very clearly: This program is also delievert with MSI grafic cards and without the process the Dynamic Overclocking Technologie doesn't work. Check the display properties after disableing the process - on the tab 'MSI Clock' the DOT related checkboxex are disabled. Check the properties of the WinSys.Exe, in the secure version the manufacturer is MSI is shown there.
  BudeII   (further information)
Correct! It is the Dynamic Overclocking Technology .exe used with MSI made nVidia Video Cards. Original file name DOT.exe but now called WinSys.exe which is located in the Windose/Sys32 folder and is 132 KB (135,168 bytes) in size. Of course it is in the start up registry because you want it to be running while playing games etc. Can't recall it asking for net access previously so if yours is, and is in the Windows root directory, maybe you have a problem (or just a poor install!). Rock On!
  Rockman   (further information)
keeps coming back and isn't recognized by scans. good call on MSI DOT, i have MSI video card, and MoBo.
its called WinXSys.exe, i found it in C:\Windows and though i delete it, still doesn't solve the problem
nVidia Video Cards WinSys.exe DOT (Dynamic Overclocking Technology)
It is packed with MSI Nvidea videocards, i checked and it`s not dangerous
is in my nvidia download "" 132 kb. DOT file, Xsoftspy says it is high risk?? Ad-Aware does not detect my version!!
Packed with MSI videocards, DOT overclocking software for gfx
Zone Alarms' Program Control sees Winsys.exe as "DOT MFC Application". So if you are not sure if it is for MSI Overclocking (which I have), you can always block this program in Zone Alarm so that it cannot get internet access.
Trojan Downloader
WinSys.exe was found on a server in location c:\windows\system - it IS malicious in this instance - it was downloading other viral programs - had to use pskill to kill it in a looped batchfile while I then delete it - it was causing crashing over 24 hours as it grabbs lots of process threads - so beware there is a virus that uses the filename wmisys.exe!!! not just the one relating to graphics adaptors!
  Erebus   (further information)
Is track as a program on the tolbar
  Robert Aling  
I also have MSI video card with Dynamic Overclocking Technology. WinSys.exe loads when D.O.T. is enabled, and is located in C:\Windows\System32.
Definitely dangerous. It was taking pics of all my tabs that was open in the internet and it heated up my comp like crazy. All my audio tabs went out of sync. If you have ubuntu alongside windows, access windows via ubuntu and delete the winsys.
Virus with the name to mimic Microsoft. Select it, view details, and read the publisher name closely. Couple letters switched, in my experience

Rating chart

Summary: Average user rating of winsys.exe: based on 36 votes with 21 user comments. 17 users think winsys.exe is essential for Windows or an installed application. 4 users think it's probably harmless. 6 users think it's neither essential nor dangerous. 9 users think winsys.exe is dangerous and recommend removing it. 3 users don't grade winsys.exe ("not sure about it").

Do you have additional information?
What do you know about winsys.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving winsys issues

A clean and tidy computer is the key requirement for avoiding problems with winsys. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the winsys.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

winsys.exe [all]