I've just noticed this appearing several times in Processes....



In fact, the other day there must have been around 25 entries.

It seems to use not an insubstantial amount of RAM as well.

I've done multi malware searches but nothing comes up.

Should I be worried ?

cheers

swayzak

Winword.exe is Office Word.

It can be opened if you're using Outlook or Microsoft Office Word.

You can disable it within Outlook if you want but I'd recommend using it just for the features of Word and writing/reading emails.

Thanks

But why multiple entries in Processes (just a single instance of Outlook open) - each using around 12 MB !

I smelt a virus or other malware (Googling shows some references to winword.exe related naughties).

Did the usual Ad-aware / Spybot clean. Also several virus scans - these showed nothing.

Appears to have stopped doing it now - so maybe it was one of the spywares ?

swayzak

Every time you open word you get a new "instance" which is what you're seeing.

I don't believe the newer version of Office does this.. you might be on Office XP?

Outlook opens its own version. Word will open its own version for each document opened.

Though, sometimes it doesn't always close down. End-task or Kill each one and see what you lose. When you open Outlook it'll re-open the instance it needs.

Also, typing "winword" in the Run command will start Word for you.

I think the new version of Office opens one version and all instances stay in that.. but I'm not sure offhand. I'd have to check.

You are right there. No need to check.

thanks again

I'm using Office 2003 SP2

And as I'm typing this, there a 3 instances of winword.exe running (plus outlook.exe).

Only Outlook is actually running.

Seem alot better than the 10 or so instances I had running at one point before - but still a bit worrying....?

swayzak

Winword will load when you open Office.

If you have any emails open or preview pane, that may also cause more instances to open.

Try end-tasking them and see what you lose. Or open a few emails up and see how many instances start up.

Make sure you're fully patched. It could be an issue that each instance isn't closing down when you close it down. I've seen that happen before but I think that was on 2000, not 2003.

Download this::Process Explorer
Once downloaded, go to the download folder and extract,, than Execute procexp.exe, ,than go and view the process in task manager with more detailed view. Most satisfying thing is knowing what is using what.

Oh God - today I opened the Processes window & there were at least 20 instances of winword.exe, with available RAM down to 70 MB (on 512 PC) :x

Just Office 2003 open, with no emails open.

Close all instances & claimed back all the memory.

This MUST be malware - only none of the scans I've done have made any difference (McAffee, Ad-aware, Spybot S&D...)

I'm really pissed off now because I don't want to do a reinstall...

I'm thinking you've got a mass-emailing worm. I know at one time with Office, you could use MS Word as your email editor... if that's the case, then it would explain why you've got so many instances of winword.exe... one instance for every email being sent from your computer.

Try replacing Mcafee with NOD32 or Avast! and c what happens.

Thanks - but this is a network work PC so no option there.

thanks

Haven't picked up a worm on scanning yet (although I'm currently running MS OneCare scan as a last resort).

I do receive & send quite a few emails and open Xcel files throughout the day - maybe it's something to with that ?

But surely Office 2003 shouldn't leave an instance of winword.exe open for every email transaction / Excel file I open (taking upto 12MB of ram) ?

Arrgghhhh....


And here's the (predictable) result of manually ending all those winwords:




:x

Office is updated with all service packs and other updates?

www.safer-networking.org

Download Spybot Search and Destroy.

Update it. Immunize, check for problems.

It might not be a virus but spyware doing it.

Have done this (and Ad-Aware search) and, touch wood, there have been no instances of winword.exe today

Bit puzzled because I normally use these everyday anyway :?


swayzak

Go into C:\Doc and settings\your username\somethingsomething\templates


Do a search for "Normal.dot" - It will be a Word document. It should be under a templates folder.

Close all instances of Word.

Delete Normal.dot

Test it out.

That should resolve your issue. The .dot is a template, it holds what your basic view of Word looks like. You can create, file - save as - document template, normal.dot in the location if you want to make another.

Just a quick update for anyone who's interested.

Problem solved.

We have software at work that "under the bonnet" is rather clunky & has a DOS-like interface.

The company that wrote this created a better GUI for the users.

There was a badly written .exe file for this gui, which left many instances of winword.exe open, hoovering up system memory.

An updated version solved this (and now my PC seems about 10x faster).


thanks again for the advice


swayzak

Good to hear... Any chance you can say what the program at work is? That is, if its a main stream program that would likely show up elsewhere?