|Windows Help > Windows Processes > ehmsas.exe|
ehmsas.exe - Windows Media ComponentWindows XP Media Edition introduced the Media Center State Aggregator Service (or Status Center) which is responsible for the ehmsas.exe process. This is a legitimate Windows Media Center component, and should not be terminated manually since the consequences to the running OS may be significant. It's a low risk executable. No adverse events have been reported to date regarding its use.
This process will appear only on XP Media Center and Vista machines; if it is found to be running on other variants of the Windows OS, it should be treated as malware. The most common location for the legitimate, installed copy of this file is c:\windows\ehome (not the usual system file location in system32). In general, the process appears to consume very little memory or CPU time.
This file is used by ehtray.exe and ehshell.exe; it receives user event information from these executables and sends relevant metadata to third party "sinks" (like front panel displays). For instance, it might send information regarding the current user experience, user actions, information about the current media being played (like a list of songs on a CD), whether the mute button has been pushed, etc. Thus, events involving the media services will no longer be reported and acted upon if this process is disabled.
As always, malware authors may attempt to make use of legitimate Windows file names when creating harmful code. If you find copies of this file in other directories on your system, it's another reason to suspect it's malware of some type. Take appropriate action in order to protect the integrity of your system and personal data.
If you are suspicious about a particular program or process, you should obtain and run a current copy of a spyware and antivirus removal tool. Be sure to retrieve the latest virus and malware signature updates to ensure all known applications can be caught and removed.