What is MSGSYS.EXE?

[William]

This constantly runs on my computer, One person said it
was a system file for msn messenger, but no matter what
even If i have msn messenger turned off. it still shows.
and it was in the taskmanager list before i installed msn
messenger.
Just wondering what it is.
thanks in advance.
Sincerely,
William Baker

 

[Ray at]

Are you running av software? If not, get some and scan.

Ray at home

 

[William]

yes im running av software, nothing pops up, and i'm
running the best i think one can get, norton corperate
edition the latest edition.

got the latest definitions, but nothing comes up. and
adaware, and spy bot dont bring any thing up either.

 

[FuzionMan]

Go to Search in your Start Menu, and type in that file name. Find out what
directory it's in...

 

[Doug Knox MS-MVP]

This appears to be a trojan.

http://www.cs.uwaterloo.ca/~mpatters/SWG/evilexp.htm
http://vil.nai.com/vil/content/v_100639.htm

 

[William Baker]

sorry bout the email send doug. lol hit the wrong button.
but yeah thanks for the links, the first place only mentions msgsys.exe in
the task manager program list, it only shows up in google cause its
mentioned.

but the 2nd site says its a trojan, yet i've yet to figure out how to use
that sites tools to remove it. and norton doesn't mention any thing bout it
on there site.

 

[William Baker]

its in Windows/System32
Fuzion.

I just did a main scan of that file it self with norton and no viruses we're
reported.

 

[Jim Macklin]

Try using SpyBot Search and Destroy from
www.security.lolla.de to remove Trojans, dialers and
spyware.


message
| its in Windows/System32
| Fuzion.
|
| I just did a main scan of that file it self with norton
and no viruses we're
| reported.
|
|
message
| | > Go to Search in your Start Menu, and type in that file
name. Find out
| what
| > directory it's in...
| >
| > | > > This constantly runs on my computer, One person said
it
| > > was a system file for msn messenger, but no matter
what
| > > even If i have msn messenger turned off. it still
shows.
| > > and it was in the taskmanager list before i installed
msn
| > > messenger.
| > > Just wondering what it is.
| > > thanks in advance.
| > > Sincerely,
| > > William Baker
| > >
| >
| >
|
|

 

[Doug Knox MS-MVP]

William,

Do the following. Open Task Manager, if it will open and locate the entry
for this EXE file in the Running Processes. Highlight it and select End
Process. Then go to the directory its located in and delete the EXE itself.
From NA's write up, there are actually two copies, as MSSYS.EXE and
MSAPIN32.DLL, so end process on both of these, if found, and delete the
files.

The go to Start, Run and enter REGEDIT Go to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Look in the right pane for the value mssys. Right click it and select
Delete.

You can also boot the computer into Safe Mode, and the trojan shouldn't run,
since startup programs aren't processed. Follow the removal instructions
above, except you shouldn't have to end task on the processes.

 

[105]

This is a legitimate Symantec/Intel Lan Desk file...!!!


http://service1.symantec.com/SUPPOR...88256a56005428b1?OpenDocument&src=bar_sch_nam


http://service1.symantec.com/SUPPOR...88256a220026a73a?OpenDocument&src=bar_sch_nam



http://service1.symantec.com/SUPPOR...88256a220026a73a?OpenDocument&src=bar_sch_nam

Not to down anybody....but research should be done before scaring the
crap out of people...this link in particular
http://vil.nai.com/vil/content/v_100639.htm doesn't even reference the
file in question, it talks about MSSYS.EXE, a tatic which is common in
trojan and virus writers (make the file appear as close to legitimate
by using a known safe file i.e. svchost.exe to svchost32.exe)