What is Msosync.exe and Should I Remove it?

Some Windows users have have been reaching us with questions after checking out their Task Manager and noticing that the Msosync.exe process is taking a considerable amount of system resources at all times. In some cases, affected users are reporting that the resource usage exceeds 50% of their CPU power (sometimes over 80%). Because of this, they are wondering if the process that they’re dealing with is genuine or is a security threat.

What is MSOSYNC.EXE?

The genuine msosync.exe process is a software component that is signed by Microsoft Corp. and belongs to the Microsoft Office suite. This particular executable is associated with the Microsoft Office Document cache and doesn’t pose a threat to your PC.

Msosync.exe is the default Microsoft Office Document Cache (ODC) synchronizer and cache management program for Microsoft Office. It was introduced with Office 2010 to enhance the interaction of Excel, Word, PowerPoint SharePoint, OneDrive for Business and other web-based collaboration systems.

The default location of this process is C:\Program Files\Microsoft Office\OfficeVV\msosync.exe, where VV is the version indicator of Office. It also contains a registry subkey called valueOfficeSyncProcess that’s located in HKCU\Software\MicrosoftWindows\CurrentVersion\Run which is what’s starting the process at every system startup.

Even though it has no visible interaction window, it responds to the settings made inside the Office Upload Center GUI. The most recent Office programs use this process to keep updated versions of Word, Excel and powerpoint documents readily available for local use.

In the vast majority of cases, this process is being used by your Microsoft Office version to cache your documents to facilitate faster viewing times. Keep in mind that by default, msosync.exe will cache Excel, Word and Powerpoint documents to make them load faster.

The normal usage of this process is around 3-5 MB, but the user might exceed 10 MB in situations where multiple Office documents are being cached at the same time. But in case there’s a SharePoint workspace or the operation goes through OneDrive (or similar service with its synchronization routine) expect to see a severely elevated CPU consumption.

Is MSOSYNC.EXE safe?

As we’ve explained above, the genuine msosync.exe process doesn’t pose a security threat to your system. But keep in mind that certain malware products will specifically pose as processes such as this one to avoid being detected by security scanners.

Since the msosync.exe process has enhanced privileges, it’s a perfect target for this type of malware products. To make sure that’s not the case, we encourage you to perform a series of investigations that will help you determine if the executable that you’re dealing with is genuine or not.

First, you should start by checking if the parent application is installed. If you’re using Microsoft Office products, you’re likely dealing with a genuine process. But if you don’t have Microsoft Office installed and you never used a product from this suite, you’re likely dealing with a false process.

If the first investigation caused you some suspicions, you should start looking into the location of the msosync.exe process by utilizing Task Manager. To do this, press Ctrl + Shift + Enter to open up a Task Manager window.

Once you’re inside Task Manager, select the Processes tab from the horizontal menu, then scroll down to the list of Background processes and locate msosync.exe. Next, choose Open file Location from the newly appeared context menu.

If the revealed location is different than C:\Program Files\Microsoft Office\Office*VV*\msosync.exe and is located in a System folder (like C:\Windows or C:\Windows\System32), the chances of dealing with a malware file are very high.

In case the investigation above has raised suspicions that you might be dealing with a virus, you should follow that up by uploading the file to a virus signature database to verify if the file is indeed malicious. As of now, the most reliable way of doing this is to upload the file on VirusTotal. To do this, access this link (here) and wait for the analysis to complete.

Note: If this file analysis has determined that the msosync.exe file is genuine, you can skip the next section and move directly to the ‘Should I Remove MSOSYNC.EXE?’ section.

But if the analysis has raised some red flags, continue with the next section below for some step-by-step instructions on dealing with the virus infection.

Dealing with the security threat

If you previously revealed some concerns that the file you’re dealing with might not be genuine, it’s highly recommended that you proceed by deploying a security scanner that’s capable of identifying and dealing with the infected system file.

Keep in mind that in case the location of the file was different from the default, you’re likely dealing with malware with cloaking-capabilities. These nasty virus types are harder to detect, as not all security suites are efficient in identifying and quarantining them. If you’re already paying for a security scanner, go ahead and initiate a scan with it.

However, if you prefer something free and just as efficient, we encourage you to install and use Malwarebytes. A deep scan with this utility should allow you to dig out and quarantine the vast majority of malware files that are avoiding detection by posing as processes with elevated privileges. If you’re unsure of how to initiate a deep scan with Malwarebytes, follow this step by step article here.

If the utility managed to quarantine and remove the infected items, restart your computer, then move down to the next section below to see if the high usage of the msosync.exe is still happening.

Should I Remove MSOSYNC.EXE?

If the investigations above didn’t reveal any security issues and you’re certain that the executable you’re dealing with is genuine, you should keep an eye on it and see if it’s still using up a lot of system resources in Task Manager (Ctrl + Shift + Enter).

If the resource consumption is still high and you are determined to limit its usage, you can do it without affecting any critical system files.

However, if you go through with it, your Microsoft Office installation will lose it’s the ability to save cached files that you’re using regularly.

How to Remove MSOSYNC.EXE

In case you performed every verification to ensure that the file is genuine, you have two ways of ensuring that the msosync.exe process is no longer taking up a lot of system resources.

The first approach (uninstalling the entire Office suite) is extreme and should not be followed if you’re actively relying on Office products.

However, if you’re on Windows 10, there’s a better option that ensures that msosync.exe will no longer run. Since OneDrive is completely integrated with the OS, you can prevent the office process from running by disabling the File collaboration feature.

Here’s a quick guide on doing this:

1. Right-click on the OneDrive tray icon and choose Settings from the newly appeared context menu.

   

2. Inside the Microsoft OneDrive settings menu, select the Office tab and uncheck the box associated with Use Office to sync Office files.

   

3. Click Apply to save the changes, then reboot your computer. Once the next startup is complete, you will no longer see the msosync.exe process taking out system resources.