Re: What's "mspmspv.exe"?

From: Ronnie Vernon MVP (ronv_at_mvps.org)
Date: 12/30/04 

Date: Thu, 30 Dec 2004 11:14:24 -0800

Milt wrote:
> Can you tell me what "mspmspv.exe" is/does? It is in
> C:\Windows\System32. It's listed twice in msconfig\System
> Configuration Utility\Startup. Once under
> HKCU\Microsoft\Windows\Current Version\Run and once under
> HKLM\Microsoft\Windows\Current Version\Run. There's also
> an entry in C:\Documents and Settings\All Users\Start
> Menu|Programs\Startup\Microsoft Office.hta. which
> generates this page at every bootup:
> TG!'?#_Xgҭc?<Zm_X
>  |"\
> Dw=?"I<Zm_X 2'?Item1
>  ?#aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?_
>
> It seems to generate a request for internet access in my
> Zone Alarm firewall. It doesn't show up in SpyBot, AdAware
> or NAV.
>
> I'd like to get rid of the page but don't know if I should
> delete the Registry entries, disable one or both entries
> in msconfig\Startup or just delete the entry in
> C:\Documents and Settings\All Users\Start
> Menu\Programs\Startup. I'd like to know why it recently
> appeared too.
>
> Thanks,
> Milt

Are you sure about the spelling of that file?

There is a legitimate XP file spelled "MsPMSPSv.exe" (extra S) that is
associated with the Windows Media Player DRM service. This is a service that
runs in XP, but I don't believe that it needs to be in the Start Up of
msconfig? You should remove this item from both "Run" locations in the
Registry. It can also be disabled in the Services, where it is shown as WMDM
PMSP Service.

If your spelling is correct, I would immediately remove all instances of
this file from the system.

The Microsoft Office.hta file is a mystery. An .hta file can execute code. I
would remove this file from the Start Up folder and place it in another
folder for the time being until you can determine where it came from.

Make sure that your anti-virus programs have the latest definition files and
run a complete scan from Safe Mode. 

-- 
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Relevant Pages

  • Re: Whats "mspmspv.exe"?
    ... >Milt wrote: ... >associated with the Windows Media Player DRM service. ... >would remove this file from the Start Up folder and place ... >Microsoft MVP ...
    (microsoft.public.windowsxp.basics)
  • Re: WPDNSE
    ... MS MVP-Windows (IE, OE, Security, Shell/User) ... Milt wrote: ... believe that it's caused by Windows Media Player 11. ... Why is Microsoft doing ...
    (microsoft.public.windowsxp.general)