WFS.exe appears in process monitor following Windows update reboot

Topic

New Reply

I always check the process monitor in my Panda Dome free antivirus as the final step to make sure everything ran as expected following the installation of every months Windows updates.

This time when I checked it, both WFS.exe (winsxs) and wfs.exe (system32) versions were listed among the normal processes expected to be there after updating.

I have my process monitor set to show the latest detected processes at the top of the list, judging from these processes location on the list I’m reasonably sure that the reason they showed up has something to do with the update I installed for .NET 4.7, but I can’t fathom what that reason is.

Reply | Quote

Replies

Both of those executables belong to the Windows Fax and Scan utility, so they should be legit. If you have any doubts, run a scan on them with your Panda software.

I’m running Win 10 Pro x64 version 2004 fully updated, and I don’t have those running currently nor after rebooting according to Task Manager. I also have the Fax service set as a manually started service.

I don’t have a multi-function device attached to my computer, either, just a plain ol’ ordinary printer. If you do have a multi-function-capable device (such as a fax, print and scan all in one device) that would probably explain the presence of the executables just after booting your machine.

If you are like I am, and don’t have a multi-function fax and/or scan capable device attached to your computer, then possibly the executable was just running by default after the update’s installation to confirm for itself that you don’t have a fax or scan capable machine attached to your computer.

1 user thanked author for this post.

Moonbear

Reply | Quote

I have an ancient HP Officejet j3600.

It can send faxes and scan as well as print but I’ve never had it set up to send a fax (no phone line attached) and in the eleven years I’ve had it I’ve literally used the scan feature 1 time to see if it worked.

According to the process monitor, the 2 wfs processes ran during the install of this months .net 4.7 patch. I saw that they had ran after the system rebooted.

Reply | Quote

My guess is that what you saw is probably the only time you’ll ever notice the Windows Fax & Scan executable run, aside from actually scanning something and saving it as some sort of image file on your computer which, from the sounds of your post, you’ll probably never need to do.

There is a DeskJet 2540 attached to the computer I’m using to type this post, and wfs.exe is not currently running although the 2540 has a scanning capability but no fax capability. Also on this computer, the Fax service isn’t currently running and is set to a startup type of “Manual”.

I hope this helps for future encounters with the Windows Fax & Scan executable!

R/

Bob99

1 user thanked author for this post.

Moonbear

Reply | Quote