List of files in running processes

axel · 9th November 2004

Running Ad-Aware, I detected some files in the running process which I do not recognize:MSGSRV32.EXE, MPREXE.EXE, RPCSS.EXE, WMIEXE.EXE and TAPISRV.EXE
Can someone please tell me what these files are, what they do, whether they are neccessary and, if not, how I can adjust the system so that those files are not running in the future? Any help is apreciated.

**markp62** · 9th November 2004

Most of those are necessary, legitimate windows files, and there is only one in the list I recommend to get rid of, Rpcss.Exe.
Msgsvr32
Mprexe.Exe
Wmiexe
Tapisrv
Get UnPlug n' Pray to disable Rpcss. The download page for UnPnP will explain some of this.

axel · 10th November 2004

Thanks for your help, mark62,
I have tried Unplug n' Pray and it tells me that UnPnP is not installed on my system. However, when I log on to the net Zone Alarm asks me whether I want to allow Rpcss.exe which I decline. How can I get rid of this file trying to intrude?
I also discovered a file called Services.exe in the folder Windows/System/MSOffice. It's the only file in there. Do you know what this one is all about?
Thanks again
Axel

**markp62** · 10th November 2004

Sorry about the mistake, hard day yesterday. I should have recommended the Dcombobulator. Click on 'Dcombobulate Me!' when this program is running.
This 'services.exe' located in the folder 'Windows/System/MSOffice' is not a good sign. There is a legitimate windows file by that name, but it doesn't exist in that folder.
I would say it is a good time for a free online AV scan.
RAV Online Scan
The appearance of this file most likely came from some sort of malware, it would not hurt to run Spybot and Ad-Aware on this machine. You can find where to get these free programs at the Quicklinks below. Update each one after installing.
If either of these programs finds something other than just cookies, please post a HijackThis log. It will be looked at, to see if anything else is amiss.

axel · 13th November 2004

Quote:

Originally Posted by markp62

Sorry about the mistake, hard day yesterday. I should have recommended the Dcombobulator. Click on 'Dcombobulate Me!' when this program is running.
This 'services.exe' located in the folder 'Windows/System/MSOffice' is not a good sign. There is a legitimate windows file by that name, but it doesn't exist in that folder.
I would say it is a good time for a free online AV scan.
RAV Online Scan
The appearance of this file most likely came from some sort of malware, it would not hurt to run Spybot and Ad-Aware on this machine. You can find where to get these free programs at the Quicklinks below. Update each one after installing.
If either of these programs finds something other than just cookies, please post a HijackThis log. It will be looked at, to see if anything else is amiss.

Thanks again for your comments, mark62,
I use Spybot and Adaware daily for years. These programmes did not detect the files in question. After using ravantivirus other rubbish - gone unnoticed so far - came up. I renamed services.exe to see what would happen. The system does not seem to need it. I'll leave it for a while and if everything is working fine as it does now I'll delete it.
Thanks again
Axel