There are a couple of things.
CiscoWorks LMS per se has both a syslog analyzer (which is a process controlled via the CiscoWorks interface) and a syslog daemon (which it installs as a Windows service assuming you don't already have an alternative one installed when CiscoWorks Common Services (CWCS - formerly known as "Disc 1") installs).
To stop the former, go into CW under Server Configuration, Administration, Process Management, Stop Process and choose "Syslog analyzer" and click the "Finish" button.
For the latter, from the Windows Desktop, Start, Settings, Control Panel, Administrative Tools, Services and choose the "CWCS syslog service".
Note that both pieces will automatically restart upon a system restart unless you take extraordinary measure to exclude them as processes and services.
