Wmpnscfg.exe and wmpnetwk.exe processes – what are they?

Wmpnscfg.exe and wmpnetwk.exe processes – what are they?
Wmpnscfg.exe, wmpnetwk.exe, Windows Media Player
Written by Wilbur Woodham

Different users ask about the wmpnscfg.exe and wmpnetwk.exe processes. You will not likely see it until you make use of its parental application – Windows Media Player. However, some people are getting scared that their PC is infected after seeing processes running in the background. In this post, I will tell you the purpose of those processes, and also explain how to figure out if your system is infected.

What are wmpnscfg.exe and wmpnetwk.exe?

As I have mentioned, both of these processes belong to the Windows Media Player. This app is the default media player for all Windows versions up to 7. You will not likely see these processes in Windows 8 and 10, since WMP is disabled by default in these OS versions. However, some users who were used to Windows Media Player were not excited with new multimedial solutions from Microsoft, and found a way to use the tool they liked.

Wmpnscfg.exe and wmpnetwk.exe processes are responsible for media sharing and network sharing in Windows Media Player. These abilities are present in WMP to share the currently playing song and the whole library through the local network. The fact that you can do these tricks without any additional software is very cool. However, Microsoft does not support the Media Player anymore, because the company decided to concentrate on Groove Music and Films&TV applications.

Can I disable the wmpnscfg.exe and wmpnetwk.exe processes?

If you do not use that ability of WMP, you can just disable the corresponding features in the program settings. Click the Library tab, then go to the Media Sharing button and choose “Configure Sharing”. In the appeared window, unmap both of the boxes to stop the media sharing, and press “OK”. In case if they are already disabled, mark them, apply, unmark, and apply again. That action will reset the settings, and possibly solve the problem.

wmpnscfg.exe and wmpnetwk.exe disable

That was the guide for wmpnscfg.exe. Network sharing process, or wmpnetwk.exe must be switched off through the Services application. Press Win+R, then run search for Windows Media Player Network Sharing Service. Click it with the right mouse button, choose “Properties” in the drop-down menu. In the Properties dialog set the Startup Type value to “Disabled”. Now, the service will not start as it used to.

wmpnscfg.exe and wmpnetwk.exe disable services

However, I cannot imagine the situation when these services may create a serious problem for your PC performance. Both of them are running in the background and consume minimal amounts of CPU/RAM capacity. Disabling it will not give you a huge performance boost, but you will lose several useful features which made the Windows Media Player beloved by users. However, if you have got in such a situation, try to check the Microsoft troubleshooting guide. The times when you can stop the Windows processes to increase the system performance have passed long ago. When Windows XP was the last actual OS version, computers were quite weak, and their upgrade was quite expensive, disabling several services could really make your PC faster without any significant problems. Nowadays, such tricks can make things even worse.

How can I understand that these processes are malicious?

Both wmpnscfg.exe and wmpnetwk.exe processes belong to the system application. Hence, they must be located in the folder of Windows Media Player. The exact path of it differs for every user. The only thing you may be sure about is that wmpnscfg.exe or wmpnetwk.exe are malicious if you see that they are located somewhere away from the mentioned folder. Different trojan-miners may use the names of those processes as a disguise. People often trust the familiar names and do not even check the properties of each process. To remove the viruses which are consealed in such a way, you need to use anti-malware software. I can recommend you to use GridinSoft Anti-Malware1.

Removing the viruses with GridinSoft Anti-Malware

  • Download and install the GridinSoft Anti-Malware. After the installation, you will be offered to perform the standard scan. Apply this action.
  • GridinSoft Anti-Malware during the scan process

  • Standard scan lasts up to six minutes and checks the system files together with the files of the programs you have installed on your computer.
  • GridinSoft Anti-Malware scan results

  • When the scan is complete, press “Apply” to wipe out the malicious items that are present on your PC.
  • Malware removing with GridinSoft Anti-Malware

    Frequently Asked Questions

    Can I just delete the process from the root directory?

    No. In case if the process belongs to the legitimate system element, you will not be able to edit the root directory of the system, where it is stored, without granting yourself permission for this action. And its deletion will surely lead to the loss of certain system functions, which may be needed in future.

    Is it possible to decrease the hardware consumption of this process?

    That process consumes literally nothing, so you will likely see no occasions when there is a need to make it less greedy with resources. However, if you see that it takes more than 20-30% of your CPU and the same amount of RAM, it is likely a virus. Perform the guide I wrote above.

    How can I know this process is malicious without checking its root directory?

    As was mentioned in the previous question, the CPU/RAM consumption of the original process is very low. So, the processes that uses a lot of hardware capacity are definitely malicious. Another way to understand that this process belongs to a malicious program is its location inside of the Process Explorer. System processes are listed in the corresponding thread, so that process’ application among the user’s background processes is a sign of malware presence.

    User Review
    0 (0 votes)
    Comments Rating 0 (0 reviews)


    1. Reasons why I recommend you to use GridinSoft Anti-Malware.
    Wmpnscfg.exe and wmpnetwk.exe processes – what are they?
    Wmpnscfg.exe and wmpnetwk.exe processes – what are they?
    Wmpnscfg.exe and wmpnetwk.exe processes are responsible for certain networking functions of Windows Media Player. Names of these processes are sometimes used by malware creators to disguise their viruses.

    About the author

    Wilbur Woodham

    I was a technical writer from early in my career, and consider IT Security one of my foundational skills. I’m sharing my experience here, and I hope you find it useful.

    Leave a Reply