msmsgs.exe

pheasant · Oct 19, 2005

Is it a worm, or to start Messenger?

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Deleted in task manager, and also disabled through a command line.

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Anybody here have a permanent fix, (other than linux)

Mark

Groove · Oct 19, 2005

pheasant said this...

Is it a worm, or to start Messenger?

http://www.sophos.com/virusinfo/analyses/w32agobotnl.html

here's one to check..

Bill's Dead · Oct 19, 2005

pheasant said:
Is it a worm, or to start Messenger?

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Deleted in task manager, and also disabled through a command line.

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Anybody here have a permanent fix, (other than linux)

Mark

http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Groove · Oct 19, 2005

Bill's Dead said this...

http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Hmm. That tells you about the regular 'kosher' messenger file. I have my
doubts about this one however. When messenger runs on my system it uses 2-
3% CPU time in standby.
I'd be very worried about something hogging system time in this way.

John Doe · Oct 19, 2005

pheasant said:
Is it a worm,

Do a virus check and find out.

or to start Messenger?

I think it starts Windows Messenger.

Such problems aren't really for this group as much as they are for a
software group.

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

That's odd.

Did a Google and seems no one knows for sure what exactly it does.

Try again.

Deleted in task manager, and also disabled through a command line.
After a reboot, it was back. Just disabled it again, and know
after a reboot will have to manually fix it. :\

You might try starting Windows Messenger and turning off the option
to start Windows Messenger when Windows starts. Or you might try
removing it from your Control Panel Add/Remove Programs Windows
Components.

Anybody here have a permanent fix, (other than linux)

"Feed the trolls
Tuppence a bag
Tuppence, tuppence, tuppence a bag
la la la"

David Maynard · Oct 20, 2005

pheasant said:
Is it a worm, or to start Messenger?

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Your confusion stems from it being both. msmsgs.exe is part of MS Messenger
and lives in C:\Program Files\Messenger.

The virus/worm/trojan people, being ever clever in trying to hide their
dirty work, use the same name, for the obvious reason, in the
W32.Alcarys.B@mm worm but that one is dumped into C:/windows/system32.

Deleted in task manager,

You mean you terminated the process. That doesn't 'delete' anything.

and also disabled through a command line.

'Disabled' how?

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Of course, since simply killing it in task manager doesn't alter any
startup settings.

Anybody here have a permanent fix, (other than linux)

First find out which it is.

If it's the 'real' one it may have been a network problem.

If it's the worm then get a removal tool from one of the AV providers.

Peter · Oct 20, 2005

Is it a worm, or to start Messenger?

Why don't you find where the file exists, right mouse click on it and go
to properties. That will tell you who made it and it's version. Plus
it will give a file size if you only suspect it has had extra code
added. You could then post info here for others to compare.

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Deleted in task manager, and also disabled through a command line.

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Messenger will do that if you haven't disabled it's request to start
every time windows starts, under the preferences tab, because it resides
in your startup group.

Plus it will often reappear, despite this, especially if you use Outlook
Express.

What O/S?

Anybody here have a permanent fix.

I don't have messenger appear by disabling it and not using OE. Not
sure what would happen if you permanently deleted it?

Mike T. · Oct 20, 2005

Is it a worm, or to start Messenger?

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Deleted in task manager, and also disabled through a command line.

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Anybody here have a permanent fix, (other than linux)

Mark

Do you use messenger? If not, you might want to disable it permanently, or
even uninstall it. There are various methods to do this, some involving
registry edits (so be careful). You should visit the Trend Micro web site
to perform a system scan to make sure it's not a virus, also. -Dave

http://www.auditmypc.com/freescan/readingroom/disable-messenger-msn.asp
(disable msn messenger)
http://housecall60.trendmicro.com/en/start_corp.asp?id=scan
http://www.neowin.net/forum/index.php?showtopic=9061 (uninstall
directions about halfway down this page, works)

Copied below in case the web server is down:

1. Navigate to C:\windows\inf\
2. Open sysoc.inf
3. find msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7 in the file and take
out the word hide so the line would look like
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,,7
4. Close the file and save it
5. Now go to the Add and remove programs applet in the control panel and you
will be able to uninstall windows messenger.
6. Make sure to click on the add remove windows components button.
Note: You will be able to uninstall other unneeded programs by removing hide
from the sysoc.inf file as well.

John Doe · Oct 20, 2005

Peter said:
kiavan02 yahoo.com says...

... You could then post info here for others to compare.

Or he could post to an appropriate group.

What O/S?

Since we are in a PC group, talking about Windows Messenger, you can
assume Windows.

I don't have messenger appear by disabling it and not using OE.
Not sure what would happen if you permanently deleted it?

Permanently deleting what?

Hopefully you know more about hardware.

The Outsider · Oct 20, 2005

I don't have messenger appear by disabling it and not using OE. Not
sure what would happen if you permanently deleted it?

XPantispy comes with an option to delete the Messenger files. I used
it to delete them and have no issues. It also has the option to not
start Messenger with Outlook Express.

XPantispy: http://www.xp-antispy.org/

John Doe · Oct 20, 2005

The Outsider <no spam.here> wrote:

....

XPantispy comes with an option to delete the Messenger files.

What's the point?

I used it to delete them and have no issues.

I don't delete them and have no issues.

It also has the option to not start Messenger with Outlook
Express.

Why does it matter?

The Outsider · Oct 21, 2005

The Outsider <no spam.here> wrote:

...

What's the point?

I don't delete them and have no issues.

Why does it matter?

Because I don't use Messenger and don't want it loading or on my PC at
all. Get the point now, dumbass.

John Doe · Oct 21, 2005

The Outsider said:
On Thu, 20 Oct 2005 22:52:37 GMT, John Doe <jdoe
usenet.love.invalid>

Because I don't use Messenger and don't want it loading or on my
PC at all. Get the point now, dumbass.

That might be okay for you. Not long ago I figured out that
Application Sharing in MSN Messenger won't work unless Windows
Messenger (msmsgs.exe) is running. That's why I ask, what harm is it
doing? Whoever's fault, messing with Windows is a waste of time, and
can easily be counterproductive.

pheasant · Oct 21, 2005

David said:
Your confusion stems from it being both. msmsgs.exe is part of MS
Messenger and lives in C:\Program Files\Messenger.

The virus/worm/trojan people, being ever clever in trying to hide their
dirty work, use the same name, for the obvious reason, in the
W32.Alcarys.B@mm worm but that one is dumped into C:/windows/system32.

Ran NAV nothing found

You mean you terminated the process. That doesn't 'delete' anything.

'Disabled' how?

To disable it for good go to RUN and enter this command: RunDll32
advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

Of course, since simply killing it in task manager doesn't alter any
startup settings.

I don'y use Messenger, and use Mozilla's Thundrtbird for email and news.
Firefox for browser.

Peter · Oct 21, 2005

Or he could post to an appropriate group.

Whatever. He's here so this is where my suggestion to post goes. Guess
I'm just more interested in trying to help than in nit-picking as to
whether this group is the relevant one to post to.

Since we are in a PC group, talking about Windows Messenger, you can
assume Windows.

O/S version. If he was to post data here, it would be have been useful
to know on which O/S that file data came from.

Permanently deleting what?

Deleting the msmsgs.exe file as was mentioned. Like I said, I'm not
sure what would happen. Excuse my ignorance.

Hopefully you know more about hardware.

Based upon what? A couple of lines of text and you think I don't know
anything about this subject?

Hopefully you're more polite when talking face to face to people.

This is a self-help group. Sometimes we make suggestions that work.
Some that don't. No need for the attitude, is there?

John Doe · Oct 22, 2005

Mike T. said:
<the author gives no introduction>

Do you use messenger?

Do you mean Windows Messenger, or do you mean MSMSGS.EXE?

If not, you might want to disable it permanently, or
even uninstall it.

Better would be to figure out what the problem is.

Path: newssvr27.news.prodigy.net!newsdbm04.news.prodigy.com!newsdst02.news.prodigy.com!newsmst01b.news.prodigy.com!prodigy.com!newscon06.news.prodigy.com!prodigy.net!border1.nntp.dca.giganews.com!nntp.giganews.com!newsfeed-east.nntpserver.com!nntpserver.com!newsfeed-west.nntpserver.com!green.octanews.net!news-out.octanews.net!authen.white.readfreenews.net.POSTED!not-for-mail
From: "Mike T." <hello howyadoin.now>
Newsgroups: alt.comp.hardware.pc-homebuilt
References: <tsOdnVv2sriAtsvenZ2dnUVZ_tOdnZ2d midco.net>
Subject: Re: msmsgs.exe
Date: Thu, 20 Oct 2005 10:38:14 -0400
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
X-RFC2646: Format=Flowed; Response
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Lines: 42
Message-ID: <4357abd6$0$81196$892e7fe2 authen.white.readfreenews.net>
Organization: Read Free News
NNTP-Posting-Date: 20 Oct 2005 09:38:14 CDT
NNTP-Posting-Host: e10618e1.authen.white.readfreenews.net
X-Trace: DXC=6lWQkQXbF6_6i 4aZHOgSVb_[jUcf=dBWPH=X44`;MPYZ\Y>mfg:0C\7[<C8:?l_5[6?3JGRk^LDTd2`Bj:l>c0[dM`;_;h>=C]
X-Complaints-To: abuse readfreenews.net
Xref: newsmst01b.news.prodigy.com alt.comp.hardware.pc-homebuilt:447881

John Doe · Oct 22, 2005

....

Hopefully you're more polite when talking face to face to people.

One might also be more responsible for bad advice given face to
face.

It is a big leap from the original poster's problem to removing
Windows Messenger. You don't even know what the cause of his problem
is.

My stern objection is based on the idea your advice might wipe out a
user's ability to do application sharing through MSN Messenger. MSN
Messenger has a very very useful tool (code taken from the old
NetMeeting) accessed through the menu (Activities -- Application
Sharing) which allows someone like me or someone in this group who
does instant messaging and is forward thinking to help one of his
contacts as if he were there on the spot. However much by chance, I
think it might be a little ironic to give such advice here in this
group.

GTS · Oct 22, 2005

pheasant said:
Is it a worm, or to start Messenger?

Last night the CPU was hot 47C and running at 100%
Looked in task manager, this was the culprit.

Did a Google and seems no one knows for sure what exactly it does.

Deleted in task manager, and also disabled through a command line.

After a reboot, it was back. Just disabled it again, and know after a
reboot will have to manually fix it. :\

Anybody here have a permanent fix, (other than linux)

Mark

If you search for msmsgs.exe at
http://www.lafn.org/webconnect/mentor/startup/PENINDEX.HTM you will see that
there are many virus / trojans that use this name. Use any virus scanner to
check and rectify your system - or for a free scan first use the online
virus scanner at
http://security.symantec.com/ssc/home.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=GQYIDICRZDUUTVJHLOP

To stop the real Messenger from starting:

Program Name: MSMSGS

Executable Name: msmsgs.exe

Required: User's choice

Comments: Windows Messenger utility. If you don't use Windows Messenger,
this can be annoying. Available via Start -> Programs. Go to Windows
Messenger > Tools > Options > Preferences and uncheck "Run this program when
Windows starts"

Graham

Peter · Oct 22, 2005

...

One might also be more responsible for bad advice given face to
face.

It is a big leap from the original poster's problem to removing
Windows Messenger. You don't even know what the cause of his problem
is.

I did not suggest removing windows messenger. I said I did not know
what would happen if it was deleted, which is what he was talking about
doing. Re-read the text.

My stern objection is based on the idea your advice might wipe out a
user's ability to do application sharing through MSN Messenger. MSN
Messenger has a very very useful tool (code taken from the old
NetMeeting) accessed through the menu (Activities -- Application
Sharing) which allows someone like me or someone in this group who
does instant messaging and is forward thinking to help one of his
contacts as if he were there on the spot. However much by chance, I
think it might be a little ironic to give such advice here in this
group.

Makes all this irrelevant.

Mickey4Paws · Oct 24, 2005

The said:
XPantispy comes with an option to delete the Messenger files. I used
it to delete them and have no issues. It also has the option to not
start Messenger with Outlook Express.

XPantispy: http://www.xp-antispy.org/

Thanks for posting this. Nifty little program!

msmsgs.exe

pheasant

Groove

Bill's Dead

Groove

John Doe

David Maynard

Peter

Mike T.

John Doe

The Outsider

John Doe

The Outsider

John Doe

pheasant

Peter

John Doe

John Doe

GTS

Peter

Mickey4Paws