Archive for May 28, 2011

What is dpupdchk.exe



What is dpupdchk.exe and Why Is It Running?


You are no doubt reading this article because you are wondering what on earth that
dpupdchk.exe process is doing in your Task Manager window… there’s no description and
it just keeps coming back.
So what is it anyway?
In case you aren’t sure what we’re talking about, if you sort by “Image Name”
you might
see something similar to the screenshot below. And that’s what we’ll be explaining
to you today.


So What Is It Anyway?

This process is some type of automatic update checker from Microsoft IntelliPoint
(as far as we can tell), but here’s how we actually
diagnosed it…
First, if you are using Vista you can right-click on the process and choose to
Open File Location.

…which will open up the containing folder, so you can drill down into exactly what the file
is by looking at the properties. Unfortunately, this process just has zero
in the properties
shame on you, Microsoft!


Further investigation led me into the registry, and by using the
Process Monitor utility
Sysinternals I was able to determine that the process was querying a registry
key named “Intellipoint Pro Auto Update”…
a clear giveaway that this process has to do with updating of some type.


Then there’s also the fact that in the start menu is a shortcut using a similar icon that says
Check for Updates. It’s one of those special shortcuts that you can’t see the
target for…
one has to wonder why they bothered to
this so complicated.

Dear Microsoft: If you are reading this article, perhaps you might leave a comment and shed some light on what it’s really doing. Then you might want to start learning how to document things.

How Do I Get Rid of It?

Keep in mind that removing pieces of Microsoft software without fully understanding what
they are is probably a bad idea and shouldn’t be attempted by anybody 
circumstances ever, even slightly,
Now that the disclaimer is out of the way… here’s where we stand:
You can take
one of two routes to get rid of it:
  1. Uninstall IntelliPoint in Control Panel (losing extra mouse functionality)
  2. Replace the dpupdchk.exe file with a dummy file that does nothing.
A dummy file, you say? Whatever for?

The problem is that if you delete the dpupdchk.exe file, every single time you
open the
mouse panel you will get horrible errors. Since we like to avoid
horrible errors,
I’ve created a dummy executable that does nothing at all, which you can
replace thecurrent one
First, browse down to the following folder (adjusting if necessary for your install path).

C:\Program Files\Microsoft IntelliPoint
Now rename the existing dpupdchk.exe file to something else
(using the handy Take Ownership script if necessary to gain access).

Once you’ve renamed that file, replace it with this fake dpupdchk.exe file created by the
fine folks here at How-To Geek. It’s a blank executable that does nothing, but feel free to
scan it with at least 74 anti-virus engines if you’d like to make
And thus ends the tale of the phantom dpupdchk process. But what about svchost.exe, jusched.exe,
or dwm.exe? The journey continues!

What is mDNSResponder.exe / Bonjour


What is mDNSResponder.exe / Bonjour and How Can


I Uninstall or Remove It? 



You are no doubt reading this article because you’ve noticed the mDNSResponder.exe process 
running in Task Manager, you don’t remember installing it, and it doesn’t show up in the 
programs in Control Panel. So what is it, and how do we get rid of it?


What is mDNSResponder.exe or Bonjour?

The mDNSResponder.exe process belongs to the Bonjour for Windows service, which
is Apple’s “Zero Configuration Networking” application, typically installed 
by iTunes. If you’ve ever wondered how one iTunes install can talk to another on the 
same local network, Bonjour is what actually does this behind the 
Don’t use iTunes? You aren’t alone, and that’s not the only way that Bonjour gets installed
on your computer. It’s also bundled in a whole bunch of other software, like Pidgin, Skype,
and Safari, and used to connect clients together on the same 
It’s implemented as a Windows Service, which you can see if you head into the services panel
(or just type services.msc into the start menu search box). 
You can stop it from here anytime.


The whole problem we have is that it generally doesn’t show up in 
Add / Remove Programs, 
so you can’t get rid of it through any normal methods. Thankfully
you can still 
remove mDNSResponder.exe if you really want to, and it will simply limit some 
of the 
functionality in the apps that might rely on it.

Important: Don’t remove Bonjour if you use iTunes to share libraries, or any other feature
from an application that relies on it.

How Do I Remove It?

First, it should be noted that you can disable Bonjour without necessarily removing it—just head
into the Services panel, double-click on the service, and change the Startup type 
to Disabled.

This is probably your best bet if you don’t really want to break anything—if you have problems you 
can always re-enable it.

Alright, How Do I Really Remove It?

Let’s get down to business. If you’re absolutely sure you want to remove it, it’s really pretty simple.
Open up a command prompt in administrator mode (right-click and choose Run as Administrator),
and then change into the installation directory, usually the following:
\Program Files\Bonjour
If you are using Vista or Windows 7 x64 edition, you’ll need to head into the Program Files (x86) folder instead. Now that you are there, type in the following command to see the options:
mDNSResponder.exe /?

Ah, so now we know what to do to remove it! Simply type in the following:
mDNSResponder.exe –remove
You’ll get a message saying that the service has been removed. (Note again that you need an Administrator mode command prompt)

You’ll want to also disable the DLL file in the directory by renaming it to something else:
ren mdnsNSP.dll mdnsNSP.blah
You should be able to actually remove that entire directory if you really want to.

Wait, How Do I Enable It Again?

Oh, so your favorite application broke? No matter, you can easily re-install the Bonjour service
with the following command:
mDNSResponder.exe -install

But I Deleted It!

See, you really shouldn’t delete things until you are sure they aren’t useful anymore. That’s why renaming is a good thing. Thankfully you can simply head over to Apple’s page and 
install Bonjour again.

What are wmpnscfg.exe and wmpnetwk.exe and Why Are They Running?


 What are wmpnscfg.exe and wmpnetwk.exe and 

Why are they running?


So you’ve been going through Task Manager trying to figure out why so many services are running
when you notice there’s two items for Windows Media Player in the list… but you don’t even use Media Player. What’s up with that?
It’s not like the processes take a lot of memory… I just get irritated when there’s a process
that restarts for no good reason. You disable it, and then somehow it’s back.


What Is This Service Anyway?

Windows Media Player 11 can share media between different computers on the same network,
and can even share media with the XBox 360 as well. For this to work, there’s a network sharing
service that shares the library even if Media Player isn’t open. It’s really a great system if you use it.
Both of these processes are part of the Windows Media Player Sharing system, so if you use
those features you should not disable it.

Disabling Media Sharing in Media Player

The best way to remove these services is to just use the configuration panel… that way they
don’t come back the next time Media Player gets opened, accidentally or
Open up Windows Media Player, and then click on the little arrow under “Library” and choose
the “Media Sharing” option from the menu.


If you are using a custom theme, or otherwise can’t get to that menu, you can also open the
Options panel, choose the Library tab, and then click on “Configure Sharing”


Either one of the above will bring you to the Media Sharing dialog. Uncheck both of the boxes
that you see here.
Note: If they are unchecked, you should check them, click apply, and then uncheck them and 
click OK… basically to reset the settings.


Once you hit the OK button, you’ll be prompted with an extremely important dialog… do you want
to turn sharing off for everybody? Yes!


This will actually turn off the service, and remove the startup entry for wmpnscfg.exe.
(Note that you’ll have to kill that process manually the first time, or log off and back on)
At this point you should be able to use your computer without either of those two processes running.
If you continue to have problems getting rid of them, you can read down further for more
troubleshooting steps.

Disabling Media Player Network Sharing Service in Services

You shouldn’t actually need to do this part, as using the configuration instructions above should
work… but if you are having problems getting rid of it, here’s where you
need to go.
Open up Services from Control Panel, or type services.msc into the start menu search/run box.
Find the service in the list:


Open it up by double-clicking on it, and then change the service to Disabled.


One note here… If you try to re-enable Media Sharing in Media Player, it will ignore the fact that it’s disabled. This is why you need to make the configuration change there
as well.

Alternative Methods using Regedit

If you are still having issues, you can do some further checking to make sure that the two services
won’t be re-enabled again. Open up regedit.exe through the start menu search or run box,
and then browse down to the following key:



There should be a DWORD value on the right-hand side named DisableDiscovery which you
can set to a value of 2 (setting it to 1 also worked for me). Just make sure that it’s not
set to 0.
To make sure that the wmpnscfg.exe is turned off, you can browse down to the following key
in the registry:



This is where Windows turns that application on… if there’s an item for it in this list, then
delete it.

What is ctfmon.exe And Why Is It Running?


What is ctfmon.exe And Why Is It Running? 


You are no doubt reading this article because you are frustrated with the ctfmon.exe 
process that just won’t stop opening no matter what you do. You remove it from the startup 
items and it just magically reappears. So what is it?
Ctfmon is the Microsoft process that controls Alternative User Input and the Office
Language bar. It’s how you can control the computer via speech or a pen tablet, or using the onscreen keyboard inputs for asian languages.
If you are using any of the above, you should leave it enabled. For everybody else, we’ll get to the job of disabling this annoying service.

Depending on your system configuration, there are a number of different steps to disable it. I’ve tried to list all the methods below.

Step 1: Disabling in Microsoft Office 2003

We can remove the alternative text input from Microsoft Office 2003 by just removing 
that feature in the setup.
Note: I haven’t figured out where the equivalent setting is for Office 2007 (if there is one),
but we can also disable it a different way below.
Go to Add/Remove programs, choose to Change your installation of Microsoft Office and 
make sure you check the box for “Choose advanced customization of applications” 
before you hit next.

Find “Alternative User Input” in the list and change the dropdown to “Not available” so it 
looks like this:

Step 2a: Disabling in Windows XP

There’s an additional step we can take to make sure it gets turned off in Windows XP, which 
really seems to be the best answer for XP users.
Open up Control Panel and choose Regional and Language Options.

Choose the Languages tab and then click on Details in the top section.

Now on the Advanced tab you can choose to “Turn off advanced text services”, which should immediately close ctfmon.

You’ll also want to take a look at the first Settings tab, and make sure that your “Installed Services” box looks similar to this one:

If you have more than one Installed service then ctfmon might come back… For instance
on my system there was an input for my drawing tablet so I could use it as a text input… 
which I don’t care about, so I clicked Remove on it.

Step 2b: Disabling in Windows Vista

The setting above for completely disabling text services doesn’t seem to exist in Windows Vista
as far as I can tell, but we can remove the additional input services using a similar method.
Open Control Panel, choose Regional and Language Options and then find “Change keyboards or 
other input methods”.


On the Keyboards and Languages tab, you can select Change keyboards.


Now you’ll finally be at the same screen as in Windows XP. You’ll again want to remove the extra 
installed services in the list other than your default keyboard language.

Step 3: Remove From Startup

You won’t want to perform this step before doing the others, because it will just be overwritten again. Open up msconfig.exe through the start menu run or search box, and then find the Startup tab.


 Find ctfmon in the list and disable it by unchecking the box. Just remember that if you haven’t
disabled ctfmon through one of the other settings this won’t help you a lot.

Step 4: If all else fails

You can just completely unregister the dlls that run the alternative input services by running these two commands from the run box (one at a time) 


Regsvr32.exe /u msimtf.dll
Regsvr32.exe /u msctf.dll
If you perform this step, you should also use Step 3 to get rid of the startup entries.

Step 5: Reboot

Reboot your computer and then open a Microsoft Office application if you do have that installed.
Verify that ctfmon.exe is not running.
For more information you can read the Microsoft article on the subject.

What is dwm.exe And Why Is It Running?


What is dwm.exe And Why Is It Running? 


You are no doubt reading this article because you are wondering why this dwm.exe process
is taking more memory than you think it should, and you are curious what it does. Thankfully
for you, we have the answer.

So What Is It Anyway?

Desktop Window Manager (dwm.exe) is the compositing window manager that gives you all
those pretty effects in Windows Vista: Transparent windows, live taskbar thumbnails
(that you can resize now), and even the Flip3D switcher that you can disable and
replace with Switcher.

What happens in Vista is that applications write the picture of their window to a specific
place in memory, and then Windows creates one “composite” view of all the windows on the
screen before sending it to your monitor. Because Vista is keeping track of the contents
of each window, it can add effects when layering the windows such as the transparency we’re
all used to, as well as the live preview thumbnails.
The benefit to using this approach is that Windows Vista can utilize the hardware acceleration
features in your video card to create very smooth animations for minimizing and restoring,
and even for the transparent effects.

What about Memory Usage?

If you open up Task Manager, you can see the dwm.exe process in the list, typically
taking somewhere between 30-50MB of memory in my testing:


The size of the DWM process is controlled by the number of windows that you have open,
since each window requires a buffer in memory to store the contents of the window.
If you have a large number of very large windows open, DWM will use more memory.
The benefits of using a compositing window manager are worth that relatively small
amount of memory under most circumstances.

Does Switching to the Vista Basic Theme Turn it Off?

The short answer is no, just switching to the Vista Basic theme will not turn off DWM,
but it will reduce the memory usage a great deal.


How do you switch to Vista Basic? Just right-click on the desktop, choose Personalize,
and then Window Color and Appearance:


Click on classic appearance properties at the bottom:


Then choose Windows Vista Basic and click the Apply button:


Note that I’m not recommending switching to the Basic theme, just explaining how to do it.

So How Do I Turn dwm.exe Off Then?

Note that I don’t recommend turning this off unless you are playing games in 
fullscreen mode, and even then it likely won’t help increase speed.
The only way to get rid of the dwm.exe process is to stop the service from running.
Open up Services from Control Panel or the start menu, and then find the “Desktop
Manager Session Manager” service in the list, and click the stop button.
Note that you will be switched to the Vista Basic theme when you click the button.


To permanently disable it, double click on the item and select Disabled from the “Startup type” drop-down:


If you want to use the command line instead, you can open an administrator mode command prompt and use one of these commands:

Stop Service net stop uxsms
Start Service net start uxsms
Disable Service sc config uxsms start= disabled
Enable Service sc config uxsms start= auto

By now you should understand what the process does… do you really still want to get rid of it?

What is jusched.exe And Why Is It Running?


What is jusched.exe And Why Is It Running? 


If you’ve looked in Task Manager and wondered what on earth the jusched.exe process is and
if you can turn it off, then you are in luck. This process is the Java Update scheduler, 
which is a process that wastes memory all the time just to check once a month whether 
there are new updates to Java.
There’s a scheduled tasks feature built into Windows for this type of thing… the java update 
scheduler is obviously not being used for critical updates since it’s only scheduled to
once each month. Since I simply can’t understand why the process needs to waste my memory, 
it has to go.

What you’ll need to do is open up Control Panel, and then if you are in XP you can click on the Java icon, or in Vista you can click on Additional Options, and then click on Java.
Once you have the Java Control Panel open, select the Update tab, and then uncheck the box for “Check for Updates Automatically”


You’ll receive a warning message stating that if somebody finds a security hole in Java that it will take up to a month before you are protected from it: 


Does anybody else think that the sentence should read “the fastest and most secure Java”
instead of the way it’s worded?
After you click the Never Check button above, you’ll probably receive this error message if 
you are in Windows Vista, stating that it also hasn’t been properly certified to work with Vista in the 
first place. Just click that it works correctly.

That does make me wonder… I guess we’ll miss the update that fixes the problem with 
the control panel… or will we? What you can do instead is schedule a task to run monthly 
using the built-in Task scheduler. If you don’t care about updates to Java, then disregard
the next part.

Schedule Java Update Check (Optional)

Just type in Task Scheduler into the start menu search box to open the task scheduler,
and then click on Create Basic Task.
Follow the wizard along to pick a month and date, and then when you get to the “Start a Program” 
screen, use this as the path, adjusting if you are running a different version of Java. The key 
thing is that you run the jucheck.exe in your Java directory.

“C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe”

Now when the scheduled task runs once a month, or whenever you schedule it, you’ll get 
this dialog if there is a new version, or another dialog stating there are no updates to Java.


What is svchost.exe And Why Is It Running?

What is svchost.exe And Why Is It Running?

You are no doubt reading this article because you are wondering why on earth
there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, 
and you don’t remember starting them… so what are they?
This article is part of our series explaining various processes found in Task Manager,
including: jusched.exe, dwm.exe, ctfmon.exe, wmpnetwk.exe, wmpnscfg.exe, 
mDNSResponder.exe, conhost.exe, rundll32.exe, Dpupdchk.exe, and Adobe_Updater.exe.
Do you know what those services are? Better start reading!

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that 
run from dynamic-link libraries”. Could we have that in english please?
Some time ago, Microsoft started moving all of the functionality from internal Windows
services into .dll files instead of .exe files. From a programming perspective this makes
sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows,
it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are 
a Lot of services required by Windows. If every single service ran under a single svchost.exe instance,
a failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and then a single svchost.exe instance is 
created for each group. For instance, one svchost.exe instance runs the 3 services related 
to the firewall. Another svchost.exe instance might run all the services related to the user interface,
and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t 
absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.
The biggest problem is identifying what services are being run on a particular svchost.exe instance…
we’ll cover that below.
If you are curious what we’re talking about, just open up Task Manager and check the 
“Show processes from all users” box:

Checking From the Command Line (Vista or XP Pro)

If you want to see what services are being hosted by a particular svchost.exe instance, you can
use the tasklist command from the command prompt in order to see the list of services.
tasklist /SVC
The problem with using the command line method is that you don’t necessarily know what these
cryptic names refer to.

Checking in Task Manager in Vista

You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.
This will flip over to the Services tab, where the services running under that 
svchost.exe process 
will be selected: 

The great thing about doing it this way is that you can see the real name under the
Description column,
so you can choose to disable the service if you don’t want it running.

Using Process Explorer in Vista or XP

You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.
Hovering your mouse over one of the processes will show you a popup list of all the services:

Or you can double-click on a svchost.exe instance and select the Services tab, where you can 
choose to stop one of the services if you choose.


Disabling Services

Open up Services from the administrative tools section of Control Panel, or type services.msc 
into the start menu search or run box.
Find the service in the list that you’d like to disable, and either double-click on it or right-click
and choose Properties.
Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.
You could also use the command prompt to disable the service if you choose.
In this command
“trkwks” is the Service name from the above dialog, but if you go back to the 
tasklist command
                    at the beginning of this article you’ll notice you can find it there as well. 


sc config trkwks start= disabled