File description |
Msnmsgr.exe with description Windows Live Messenger is a process file from company Microsoft Corporation belonging to product Windows Live Messenger.
The file is
digitally signed from Microsoft Corporation - Microsoft Time-Stamp Service
We do not recommend removing digitally signed files from Microsoft Corporation
What is msnmsgr.exe?
This is the main process for the MSN Messenger/Windows Live Messenger software. The following is a screenshot of Windows Live Messenger running under Windows XP:

This process is not essential to the operation of the system. Killing it will result in MSN Messenger/Windows Live Messenger closing. There is no harm in preventing it from running at startup; however, if you wish to remove the software entirely, you should follow the normal uninstallation procedures for MSN/Windows Live Messenger. The following screenshot illustrates how this process should appear in the Task Manager:

Notice that msnmsgr.exe always runs as the current user (in this case, Mike). A process with this name running as a user other than the current user may indicate a malware infection.
Dangers of msnmsgr
As this is a program that runs on many Windows systems, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.
Some malicious files may have the same name as this but be stored somewhere other than in %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. Other malware may use a name that appears similar to that of the legitimate one but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as msnmsgr.exe:
- W32/Rbot-AVP (%SystemRoot%)
- This is a worm that spreads via several known network vulnerabilities, including the RPC DCOM exploit.
- W32/Mytob-A (%SystemRoot%\System32)
- This is a mass mailing worm and a backdoor Trojan that accepts remote commands via an IRC channel.
- W32/Annew-A (%SystemRoot%\System32)
- This is a worm that actively attempts to prevent its removal and includes functionality to infect removable storage devices.
There will typically be only one instance of this process running at a given time on a system, as it is uncommon to run more than one copy of MSN/Windows Live Messenger at once. The presence of multiple instances may be an indicator of a malware infection. If you are not running MSN/Windows Live Messenger, the presence of this process is a strong indicator of a malware infection.
Common problems
- This process uses 100% CPU time
- This known to occur in isolated instances. First, try reinstalling Windows Live Messenger. If you were using MSN Messenger, uninstall it and get Windows Live Messenger, as it supersedes the former.
- If you are using an nVidia graphics card, try updating or reinstalling your graphics card drivers.
- If you are using Microsoft Office, ensure it is up-to-date.
|
Automatic startup locations |
 |
001 Running Processes |
 |
002 Autorun registry entries local machine |
 |
003 Autorun registry entries Current User |
 |
004 All users startup startmenu |
 |
005 Current user startup startmenu |
 |
006 Start Menu\Programs\Startup |
 |
007 Roaming Start Menu\Programs\Startup |
 |
008 Autorun registry entries Default user |
 |
009 Autorun registry entries SYSTEM user |
 |
010 Installed services |
 |
012 Autorun registry entries S-1-5-XX users |
 |
033 Winlogon Userinit |
 |
035 Active Setup Installed Components |
 |
042 HKLM Internet Explorer Extensions |
 |
073 %windir%\Tasks |
 |
135 Current User Runonce (+ subkeys) |
 |
136 Local Machine Runonce (+subkeys) |
 |
166 HKCU Policies\Explorer\Run |
 |
167 HKLM Policies\Explorer\Run |
 |
191 Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run |
|
Digital signatures found for this file |
| |
Signer of certificate |
Issuer of certificate |
 |
Microsoft Corporation |
Microsoft Time-Stamp Service |
 |
Microsoft Corporation |
Microsoft Timestamping Service |
 |
Microsoft Corporation |
VeriSign Time Stamping Services Signer |
 |
Microsoft Corporation MSN |
VeriSign Time Stamping Service |
|
|
MD5 security rating in our database |
 |
 |
|
571 |
files (Not yet rated
and
not
signed) |
 |
|
18 |
files (Not yet rated
and
digitally
signed) |
 |
|
1 |
files (Safe
and
not
signed) |
 |
|
1212 |
files (Safe
and
digitally
signed) |
|
|
|
Some versions of this filename have not yet been checked for safety.
|
| Warning: Some malware might rename itself to msnmsgr.exe. Always make sure that your file is from a verified publisher. |
|
Application errors |
|
| User comments. |
There are no comments yet.
 |
Fromt the creator of Runscanner:
Lansweeper is an automated asset management tool. It can quickly scan your computers and has over 200 default reports available.
There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality. |
|
|