What is all this stuff doing on my computer?
Update: autoruns has gotten even better — check out my latest post about it.
The first time I ran task manager on my Tablet PC, I was faintly horrified at the long list of Windows background processes. What were they doing? And how could I make them stop?
The easiest way to find out was using autoruns.exe and procexp.exe, two tools from those excellent folks at sysinternals.com. Autoruns lists all the executables called at startup, but gives no indication of where they're from or what they do. Procexp lets you dig deeper for vendor name and program information. Note that autoruns can also delete startup items, but that's a little extreme — if you delete something important, you're going to have a fun time with regedit putting it back into SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
It's safer to first try XP's built-in System Configuration Utility, from Start->Help and Support->Tools (or c:\windows\pchealth\helpctr\binaries\msconfig.exe). Switch to its startup tab to turn off startup processes without deleting their entries. Once you've confirmed that everything you want to work still works, you can then use autoruns to delete the entries for good.
Of course, with 15 or so optional components that's still a pretty large search space, so to save other Toshiba Portege 3500 owners the trouble, here are my findings of what you can disable. I've also turned off the speech recognition module sapisvr.exe, via Control Panel->Regional/Language Options->Languages->Details->Installed Services.
Process | Description | OK to disable? |
---|---|---|
000stthk.exe | Toshiba function-key component | Yes |
00thotkey.exe | Toshiba hotkey component | No |
apoint.exe | Alps touchpad enhancements | Yes |
ndstray.exe | Toshiba network device hotkey | Yes |
tabbtnu.exe | Microsoft Tablet PC component | No |
tabtip.exe | Microsoft Tablet PC component | No |
tfnf5.exe | Toshiba LCD/CRT hotkey | Yes |
thkem.exe | Toshiba hotkey emulation | Yes |
toshkcw.exe | Toshiba wireless hotkey | Yes |
touched.exe | Toshiba touchpad hotkey | Yes |
tpa.exe | Microsoft Tablet PC component | No |
tpwrtray.exe | Toshiba power tray component | No |
trirot.exe | Trident video driver | No |
trot.exe | Toshiba rotation hotkey | Yes |
wisptis.exe | Microsoft Tablet PC component | No |
Note that I'm not saying that you should disable everything marked "Yes", since that would leave you with a pretty barebones laptop configuration. For example, I leave the LCD/CRT and rotation hotkey components enabled. As ever, your milage may vary.
Updates: Rick Lobrecht has compiled a similar list for his Acer Tablet PC, and Willy Wortel has found that 000stthk.exe manages hot key functionality for the Toshiba's function keys. You can find more useful information at:
- The kephyr database of Windows files (volunteer effort)
- The reger24 database of Windows processes (volunteer effort)
- The WinTasks process library (free library, commercial tool)
Finally, the referrer logs for this page make an interesting case study in why executables names are important.