What is Usnsvc.exe

Messenger Sharing Folders USN Journal Reader service - Messenger - Microsoft Corporation

File description

Usnsvc.exe with description Messenger Sharing Folders USN Journal Reader service is a process file from company Microsoft Corporation belonging to product Messenger.
The file is digitally signed from Microsoft Corporation - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Corporation

What is usnsvc.exe?
This is the Messenger USN Journal Reader Service. It is part of some versions of MSN Messenger/Windows Live Messenger. Its purpose is to provide the ability to share folders through MSN/Windows Live Messenger.

This process is not essential to the operation of the system and can safely be disabled. It should not, however, be deleted, as that could interfere with the proper operation of MSN/Windows Live Messenger. Note that disabling this process will prevent you from being able to use shared folders with MSN/Windows Live Messenger. The screenshot below illustrates how this process should appear in the task manager:

As you can see in this screenshot, usnsvc.exe typically runs as SYSTEM. A process with this name running as a different user may be indicative of a malware infection.

Dangers of usnsvc
As this is the name of a process that runs on any system with MSN/Windows Live Messenger installed, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %Program Files%\MSN Messenger or %Program Files%\Windows Live\Messenger. Other malware will use a name that appears similar to that of the legitimate one but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as usnsvc.exe:
  • W32/Kobot-C (%ProgramFiles%\Common Files\system)
    • This is a backdoor Trojan that can connect to a remote IRC server to receive commands from an attacker.
  • W32/Tilebot-KI (%SystemRoot%)
    • This is a Trojan that contains the ability to run various types of servers and other services at the whim of an attacker. This includes running an FTP server, a proxy server, harvesting information from the infected system, and participating in distributed denial of service attacks.
There should not typically be more than one instance of usnsvc.exe running at a given time on a system. The presence of multiple instances may be an indicator of a malware infection. If you do not have MSN Messenger or Windows Live Messenger installed, the presence of this executable is a possible sign of a virus infection.

Common problems
  • This process runs even when I am not using MSN/Windows Live Messenger
    • This is by design. If you do not want this to occur, you can terminate the process from the Task Manager.

Automatic startup locations

001 Running Processes
002 Autorun registry entries local machine
010 Installed services

Digital signatures found for this file

31 Microsoft Corporation - Microsoft Timestamping Service
4 Microsoft Corporation - VeriSign Time Stamping Services Signer

MD5 security rating in our database

131 files (Not yet rated and not signed)
3 files (Not yet rated and digitally signed)
47 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to usnsvc.exe. Always make sure that your file is from a verified publisher.

User ratings for this file

File rating: Average rating of usnsvc.exe: by 181 files and users.

Application errors

Fix usnsvc.exe application error:  Run a FREE registry scan

User comments

There are no user comments yet for this file.

Please add your comments if you have more information about this file or if you know how to solve usnsvc.exe application errors.

File safety :

File security rating :

Are you human? How much is 11+16:

Like this page?

Please support this free service by giving us a Google+1

Browse files by letter


More system processes

USP10.dll USPro.exe uspss.exe
uSpywBlockc1.EXE usq.exe usqmq.exe
usr.exe USR_BSC2.sys USR_CD2.sys
USR_MDM.sys USR_MDMV.sys USR_Vista32.sys

Lansweeper computer inventory From the creator of Runscanner:

is an automated IT asset management tool. It can quickly scan your computers and has over 250 default reports available.

There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality.