ChaituSingams: What Is That Process?

Showing posts with label What Is That Process?. Show all posts

Saturday, 26 May 2012

What is ipoint.exe and Why Is It Running?

ipoint.exe is a process that belongs to Microsoft IntelliPoint, a software usually used if you have a Microsoft brand mouse to provide enhancements to the way the mouse works.

[hide]

General Information

This process is the core executable for IntelliPoint. It is not a threat, and should not necessarily be removed or deleted, as long as it's installed in the normal location.

File Location

The process is usually installed in the C:\Program Files\Microsoft IntelliPoint directory, but depending on your installation it could be located in a different place.

Manufacturer

This process is created by Microsoft

Uninstallation

The entire IntelliPoint or IntelliType software can be easily uninstalled by opening Add/Remove programs, selecting Microsoft IntelliPoint in the list, and choosing to uninstall. Note that removal of the software will remove functionality that you might be used to, and isn't necessarily recommended.

Additional Information

List of Common Windows Processes v
Services	itype.exe - wfcrun32.exe - dpupdchk.exe - ipoint.exe - mobsync.exe - wfica32.exe - eventvwr.exe -WLLoginProxy.exe

Note: the valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on… so keep reading.

Using Windows Vista’s Task Manager

One of the great features in Windows Vista’s Task Manager is the ability to see the full command line for any running application. For instance, you’ll see that I have two rundll32.exe processes in my list here:

If you go to View \ Select Columns, you’ll see the option for “Command Line” in the list, which you’ll want to check.

Now you can see the full path for the file in the list, which you’ll notice is the valid path for rundll32.exe in the System32 directory, and the argument is another DLL that is actually what is being run.

If you browse down to locate that file, which in this example is nvmctray.dll, you’ll usually see what it actually is when you hover your mouse over the filename:

Otherwise, you can open up the Properties and take a look at the Details to see the file description, which usually will tell you the purpose for that file.

Once we know what it is, we can figure out if we want to disable it or not, which we’ll cover below. If there isn’t any information at all, you should either Google it, or ask somebody on a helpful forum.

Using Process Explorer on Vista or XP

Instead of using Task Manager, we can use the freeware Process Explorer utility from Microsoft to figure out what is going on, which has the benefit of also working in Windows XP.

Simply launch Process Explorer, and if you are using Vista you’ll want to choose File \ Show Details for All Processes.

Now when you hover over the rundll32.exe in the list, you’ll see a tooltip with the details of what it actually is:

Or you can right-click, choose Properties, and then take a look at the Image tab to see the full pathname that is being launched, and you can even see the Parent process, which in this case is the Windows shell (explorer.exe), indicating that it was likely launched from a shortcut or startup item.

You can browse down and view the details of the file just like we did in the task manager section above. In my instance, it’s a part of the NVIDIA control panel, and so I’m not going to do anything about it.

Disabling the Process

Depending on what the process is, you won’t want to necessarily disable it, but if you would like to, you can type msconfig.exe into the start menu search or run box and you should be able to find it by the Command column, which should be the same as the “Command line” field we saw in Process Explorer. Simply uncheck the box to prevent it from starting automatically.

Sometimes the process doesn’t actually have a startup item, in which case you’ll likely have to do some research to figure out where it was started from. For instance, if you open up Display Properties on XP you’ll see another rundll32.exe in the list, because Windows internally uses rundll32 to run that dialog.

When all else fails, you should post the full command path over on a helpful forum and get advice from somebody else that might know more about it.

What are wmpnscfg.exe and wmpnetwk.exe and Why Are They Running?

So you’ve been going through Task Manager trying to figure out why so many services are running when you notice there’s two items for Windows Media Player in the list… but you don’t even use Media Player. What’s up with that?

It’s not like the processes take a lot of memory… I just get irritated when there’s a process that restarts for no good reason. You disable it, and then somehow it’s back. Annoying!

What Is This Service Anyway?

Windows Media Player 11 can share media between different computers on the same network, and can even share media with the XBox 360 as well. For this to work, there’s a network sharing service that shares the library even if Media Player isn’t open. It’s really a great system if you use it.

Both of these processes are part of the Windows Media Player Sharing system, so if you use those features you should not disable it.

Disabling Media Sharing in Media Player

The best way to remove these services is to just use the configuration panel… that way they don’t come back the next time Media Player gets opened, accidentally or otherwise.

Open up Windows Media Player, and then click on the little arrow under “Library” and choose the “Media Sharing” option from the menu.

If you are using a custom theme, or otherwise can’t get to that menu, you can also open the Options panel, choose the Library tab, and then click on “Configure Sharing”

Either one of the above will bring you to the Media Sharing dialog. Uncheck both of the boxes that you see here.

Note: If they are unchecked, you should check them, click apply, and then uncheck them and click OK… basically to reset the settings.

Once you hit the OK button, you’ll be prompted with an extremely important dialog… do you want to turn sharing off for everybody? Yes!

This will actually turn off the service, and remove the startup entry for wmpnscfg.exe. (Note that you’ll have to kill that process manually the first time, or log off and back on)

At this point you should be able to use your computer without either of those two processes running. If you continue to have problems getting rid of them, you can read down further for more troubleshooting steps.

Disabling Media Player Network Sharing Service in Services

You shouldn’t actually need to do this part, as using the configuration instructions above should work… but if you are having problems getting rid of it, here’s where you need to go.

Open up Services from Control Panel, or type services.msc into the start menu search/run box. Find the service in the list:

Open it up by double-clicking on it, and then change the service to Disabled.

One note here… If you try to re-enable Media Sharing in Media Player, it will ignore the fact that it’s disabled. This is why you need to make the configuration change there as well.

Alternative Methods using Regedit

If you are still having issues, you can do some further checking to make sure that the two services won’t be re-enabled again. Open up regedit.exe through the start menu search or run box, and then browse down to the following key:

HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\HME

There should be a DWORD value on the right-hand side named DisableDiscovery which you can set to a value of 2 (setting it to 1 also worked for me). Just make sure that it’s not set to 0.

To make sure that the wmpnscfg.exe is turned off, you can browse down to the following key in the registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

This is where Windows turns that application on… if there’s an item for it in this list, then delete it.

What is ctfmon.exe And Why Is It Running?

You are no doubt reading this article because you are frustrated with the ctfmon.exe process that just won’t stop opening no matter what you do. You remove it from the startup items and it just magically reappears. So what is it?

Ctfmon is the Microsoft process that controls Alternative User Input and the Office Language bar. It’s how you can control the computer via speech or a pen tablet, or using the onscreen keyboard inputs for asian languages.

If you are using any of the above, you should leave it enabled. For everybody else, we’ll get to the job of disabling this annoying service.

Depending on your system configuration, there are a number of different steps to disable it. I’ve tried to list all the methods below.

Step 1: Disabling in Microsoft Office 2003

We can remove the alternative text input from Microsoft Office 2003 by just removing that feature in the setup.

Note: I haven’t figured out where the equivalent setting is for Office 2007 (if there is one), but we can also disable it a different way below.

Go to Add/Remove programs, choose to Change your installation of Microsoft Office and make sure you check the box for “Choose advanced customization of applications” before you hit next.

Find “Alternative User Input” in the list and change the dropdown to “Not available” so it looks like this:

Step 2a: Disabling in Windows XP

There’s an additional step we can take to make sure it gets turned off in Windows XP, which really seems to be the best answer for XP users.

Open up Control Panel and choose Regional and Language Options.

Choose the Languages tab and then click on Details in the top section.

Now on the Advanced tab you can choose to “Turn off advanced text services”, which should immediately close ctfmon.

You’ll also want to take a look at the first Settings tab, and make sure that your “Installed Services” box looks similar to this one:

If you have more than one Installed service then ctfmon might come back… For instance on my system there was an input for my drawing tablet so I could use it as a text input… which I don’t care about, so I clicked Remove on it.

Step 2b: Disabling in Windows Vista

The setting above for completely disabling text services doesn’t seem to exist in Windows Vista as far as I can tell, but we can remove the additional input services using a similar method.

Open Control Panel, choose Regional and Language Options and then find “Change keyboards or other input methods”.

On the Keyboards and Languages tab, you can select Change keyboards.

Now you’ll finally be at the same screen as in Windows XP. You’ll again want to remove the extra installed services in the list other than your default keyboard language.

Step 3: Remove From Startup

You won’t want to perform this step before doing the others, because it will just be overwritten again. Open up msconfig.exe through the start menu run or search box, and then find the Startup tab.

Find ctfmon in the list and disable it by unchecking the box. Just remember that if you haven’t disabled ctfmon through one of the other settings this won’t help you a lot.

Step 4: If all else fails

You can just completely unregister the dlls that run the alternative input services by running these two commands from the run box (one at a time)

Regsvr32.exe /u msimtf.dll

Regsvr32.exe /u msctf.dll

If you perform this step, you should also use Step 3 to get rid of the startup entries.

Step 5: Reboot

Reboot your computer and then open a Microsoft Office application if you do have that installed. Verify that ctfmon.exe is not running.

For more information you can read the Microsoft article on the subject.

What is jusched.exe And Why Is It Running?

If you’ve looked in Task Manager and wondered what on earth the jusched.exe process is and if you can turn it off, then you are in luck. This process is the Java Update scheduler, which is a process that wastes memory all the time just to check once a month whether there are new updates to Java.

There’s a scheduled tasks feature built into Windows for this type of thing… the java update scheduler is obviously not being used for critical updates since it’s only scheduled to check once each month. Since I simply can’t understand why the process needs to waste my memory, it has to go.

What you’ll need to do is open up Control Panel, and then if you are in XP you can click on the Java icon, or in Vista you can click on Additional Options, and then click on Java.

Once you have the Java Control Panel open, select the Update tab, and then uncheck the box for “Check for Updates Automatically”

You’ll receive a warning message stating that if somebody finds a security hole in Java that it will take up to a month before you are protected from it:

Does anybody else think that the sentence should read “the fastest and most secure Java” instead of the way it’s worded?

After you click the Never Check button above, you’ll probably receive this error message if you are in Windows Vista, stating that it also hasn’t been properly certified to work with Vista in the first place. Just click that it works correctly.

That does make me wonder… I guess we’ll miss the update that fixes the problem with the control panel… or will we? What you can do instead is schedule a task to run monthly using the built-in Task scheduler. If you don’t care about updates to Java, then disregard the next part.

Schedule Java Update Check (Optional)

Just type in Task Scheduler into the start menu search box to open the task scheduler, and then click on Create Basic Task.

Follow the wizard along to pick a month and date, and then when you get to the “Start a Program” screen, use this as the path, adjusting if you are running a different version of Java. The key thing is that you run the jucheck.exe in your Java directory.

“C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe”

Now when the scheduled task runs once a month, or whenever you schedule it, you’ll get this dialog if there is a new version, or another dialog stating there are no updates to Java.

It’s actually somewhat ironic that there’s an update to Java on the day that I write this article…

What is dwm.exe And Why Is It Running?

You are no doubt reading this article because you are wondering why this dwm.exe process is taking more memory than you think it should, and you are curious what it does. Thankfully for you, we have the answer.

So What Is It Anyway?

Desktop Window Manager (dwm.exe) is the compositing window manager that gives you all those pretty effects in Windows Vista: Transparent windows, live taskbar thumbnails (that you can resize now), and even the Flip3D switcher that you can disable and replace with Switcher.

What happens in Vista is that applications write the picture of their window to a specific place in memory, and then Windows creates one “composite” view of all the windows on the screen before sending it to your monitor. Because Vista is keeping track of the contents of each window, it can add effects when layering the windows such as the transparency we’re all used to, as well as the live preview thumbnails.

The benefit to using this approach is that Windows Vista can utilize the hardware acceleration features in your video card to create very smooth animations for minimizing and restoring, and even for the transparent effects.

What about Memory Usage?

If you open up Task Manager, you can see the dwm.exe process in the list, typically taking somewhere between 30-50MB of memory in my testing:

The size of the DWM process is controlled by the number of windows that you have open, since each window requires a buffer in memory to store the contents of the window. If you have a large number of very large windows open, DWM will use more memory.

The benefits of using a compositing window manager are worth that relatively small amount of memory under most circumstances.

Does Switching to the Vista Basic Theme Turn it Off?

The short answer is no, just switching to the Vista Basic theme will not turn off DWM, but it will reduce the memory usage a great deal.

How do you switch to Vista Basic? Just right-click on the desktop, choose Personalize, and then Window Color and Appearance:

Click on classic appearance properties at the bottom:

Then choose Windows Vista Basic and click the Apply button:

Note that I’m not recommending switching to the Basic theme, just explaining how to do it.

So How Do I Turn dwm.exe Off Then?

Note that I don’t recommend turning this off unless you are playing games in fullscreen mode, and even then it likely won’t help increase speed.

The only way to get rid of the dwm.exe process is to stop the service from running. Open up Services from Control Panel or the start menu, and then find the “Desktop Window Manager Session Manager” service in the list, and click the stop button. Note that you will be switched to the Vista Basic theme when you click the button.

To permanently disable it, double click on the item and select Disabled from the “Startup type” drop-down:

If you want to use the command line instead, you can open an administrator mode command prompt and use one of these commands:

Stop Service	net stop uxsms
Start Service	net start uxsms
Disable Service	sc config uxsms start= disabled
Enable Service	sc config uxsms start= auto

By now you should understand what the process does… do you really still want to get rid of it?

What is svchost.exe And Why Is It Running?

You are no doubt reading this article because you are wondering why on earth there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, and you don’t remember starting them… so what are they?

This article is part of our series explaining various processes found in Task Manager, including: jusched.exe, dwm.exe, ctfmon.exe, wmpnetwk.exe, wmpnscfg.exe,mDNSResponder.exe, conhost.exe, rundll32.exe, Dpupdchk.exe, and Adobe_Updater.exe.

Do you know what those services are? Better start reading!

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.

The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.

If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box:

Checking From the Command Line (Vista or XP Pro)

If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.

tasklist /SVC

The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.

Checking in Task Manager in Vista

You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.

This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:

The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don’t want it running.

Using Process Explorer in Vista or XP

You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.

Hovering your mouse over one of the processes will show you a popup list of all the services:

Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.

Disabling Services

Open up Services from the administrative tools section of Control Panel, or typeservices.msc into the start menu search or run box.

Find the service in the list that you’d like to disable, and either double-click on it or right-click and choose Properties.

Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.

You could also use the command prompt to disable the service if you choose. In this command “trkwks” is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you’ll notice you can find it there as well.

sc config trkwks start= disabled

Hopefully this helps somebody!

ChaituSingams