Wisptis.exe - How to get rid of another Microsoft annoyance

Originally Posted by Unregistered

Btw, if someone has not yet removed wisptis from his/her system, could you please open your registry and look up all

HKEY_CLASSES_ROOT\TpcCom.*

subkeys and post the names for .* here? I have them already removed, but would like to know the keys so that I can also include them in the .inf script.



On my XPSP1 system with Office 2003:

ClassicW
ClassicW.1
DrawAttrs
DrawAttrs.1
DrawAttrsXP
DrawAttrsXP.1
GenericRecognizer
GenericRecognizer.1
InkObject
InkObject.1
InkObjectXP
InkObjectXP.1
InkSettings.1
Lattice.1
RecoManager
RecoManager.1
TabletManager
TabletManager.1
UserDictionary
UserDictionary.1

This is what I had for TCPCOM; installed is WinOff2003, and Wacom Tablet.

RegSafe Report Header
--------------------------------

List Of Find All : "TPCCOM"
KEY: [HKEY_CLASSES_ROOT\TpcCom.ClassicW][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.ClassicW.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.DrawAttrs][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.DrawAttrs.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.DrawAttrsXP][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.DrawAttrsXP.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.GenericRecognizer][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.GenericRecognizer.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.InkObject][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.InkObject.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.InkObjectXP][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.InkObjectXP.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.InkSettings.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.Lattice][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.Lattice.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.RecoManager][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.RecoManager.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.TabletManager][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.TabletManager.1][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.UserDictionary][][]
KEY: [HKEY_CLASSES_ROOT\TpcCom.UserDictionary.1][][]

My HJT Dump:

Logfile of HijackThis v1.97.7
Scan saved at 11:54:16 PM, on 2/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\PowerDesk8\Matrox.PowerDesk.PD eskNet.exe
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Coloreal\Coloreal Visual\Coloreal4Matrox.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\imagineLAN\RegSafe\regsafe.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Kyle\My Documents\My Downloads\merijn.org\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: inetLock route - {E02E86EB-220B-4B59-A251-F849405E1D64} - H:\Program Files\PC Magazine Password Profiler\inetLockBho.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RegSafe] C:\Program Files\imagineLAN\RegSafe\ntfsclup.exe
O4 - HKLM\..\Run: [CfgRegSafe] C:\Program Files\imagineLAN\RegSafe\ntfsclup.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Coloreal Visual.lnk = ?
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/995...TunesSetup.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9143A18F-0F68-4E69-B5E2-E639B82B0945}: NameServer = 205.152.144.252,205.152.0.5

BTW: Does anyone know about a process called WhiteRabbit?

--kyle

[Alexander Turcic]

Originally Posted by Unregistered

This is what I had for TCPCOM; installed is WinOff2003, and Wacom Tablet...--kyle

If I understand correctly you couldn't completely uninstall wisptis.exe? I suggest you try the 2nd method as mentioned here.

Never heard of a process called WhiteRabbit, but it doesn't sound so friendly Do you have more info on it?

Btw, if someone has not yet removed wisptis from his/her system, could you please open your registry and look up all

HKEY_CLASSES_ROOT\TpcCom.*

subkeys and post the names for .* here? I have them already removed, but would like to know the keys so that I can also include them in the .inf script.

Here are mine:
HKEY_CLASSES_ROOT\TpcCom.ClassicW.1
HKEY_CLASSES_ROOT\TpcCom.DrawAttrs
HKEY_CLASSES_ROOT\TpcCom.DrawAttrs.1
HKEY_CLASSES_ROOT\TpcCom.DrawAttrsXP
HKEY_CLASSES_ROOT\TpcCom.DrawAttrsXP.1
HKEY_CLASSES_ROOT\TpcCom.GenericRecognizer
HKEY_CLASSES_ROOT\TpcCom.GenericRecognizer.1
HKEY_CLASSES_ROOT\TpcCom.InkObject
HKEY_CLASSES_ROOT\TpcCom.InkObject.1
HKEY_CLASSES_ROOT\TpcCom.InkObjectXP
HKEY_CLASSES_ROOT\TpcCom.InkObjectXP.1
HKEY_CLASSES_ROOT\TpcCom.InkSettings.1
HKEY_CLASSES_ROOT\TpcCom.Lattice
HKEY_CLASSES_ROOT\TpcCom.Lattice.1
HKEY_CLASSES_ROOT\TpcCom.RecoManager
HKEY_CLASSES_ROOT\TpcCom.RecoManager.1
HKEY_CLASSES_ROOT\TpcCom.TabletManager
HKEY_CLASSES_ROOT\TpcCom.TabletManager.1
HKEY_CLASSES_ROOT\TpcCom.UserDictionary
HKEY_CLASSES_ROOT\TpcCom.UserDictionary.1

I have not yet uninstalled it and here are my TpcCom entries, I have office 2003 installed btw.

ClassicW
ClassicW.1
DrawAttrs
DrawAttrs.1
DrawAttrsXP
DrawAttrsXP.1
GenericRecognizer
GenericRecognizer.1
InkObject
InkObject.1
InkObjectXP
InkObjectXP.1
InkSettings
Lattice.1
RecoManager
RecoManager.1
TabletManager
TabletManager.1
UserDictionary
UserDictionary.1


Mat128
I hope it helps :P

Hello all,

I don't know, whether this thread is still alive, but here's my two cents:

I configured wisptis.exe in my Pop-up & Spyware blocker (AdsGone v5.0.1 build 16) as a spyware. Whenever wisptis.exe runs, my blocker kills it automatically. Prolem solved!

Have a great time...

----------------------------------------
GT

Just a word of appreciation to those putting solutions to the above mentioned MS nightmare on this board.

I wish more of the Internet was filled with souls like you- especially for us tech challenged types...

[TadW]

I think Alex is including one section specifically for IT-related discussions like this one once his site update is done. Hope to see you onboard then!

There is a reason for running wisptis on a non-tablet pc. If you're running the ink api to send emails or msn messenger messages that include handwriting (or any kind of handdrawn image), you apparently need it.

Still, this isn't really "essential" functionality, so I understand those who want to get rid of it.

As an FYI, I am running Office XP and still have wisptis.exe on this Windows XP machine. I suspect this is not an Office 2003 issue, rather Windows XP.

FYI

WISPTIS.EXE is a parasitic program that can bring your browsing to a screeching halt.

Get rid of it! Visit Microsoft.com for info.

tr

Ouf!!!

Simply moving to adobe 5.1

For windows 2003 Server is:

HKEY_CLASSES_ROOT\Installer\Features\9040111900063 D11C8EF10054038389C

look for the WISPFiles and WISPHidden

not:

HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPFiles
HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPHidden


Also this:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\9040111900063D11C8EF10054038389C

instead of this:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPHidden



Just a little helpful tip.

Thanks for this info!!!

Not to beat a dead horse.....
This thread is quite long and I'm sure everyone now has uninstalled/disabled wisptis.exe. But for me the quickest/easiest way was to simply locate wisptis.exe and then DENY myself read/execute priveleges. Seems to work for me.

eric

if you look up wisptis.exe on microsoft you can see that its related to microsoft journal viewer (AND NOT TO ACROBAT). uninstall journal viewer if you don't need it.

don't know how it pertains to office 2003

I followed the above instructions with success, but noticed a few changes that may affect some users...

HKEY_CLASSES_ROOT\Installer\Components\BCA32ECD550 E1F4488DBD2A1578ACF8B
HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPFiles
HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPHidden
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPHidden

Originally Posted by Alexander

January 6th, 2004

where the value is 7040110900063 D11C8EF10054038389C\WISPFiles, I found on my PC that it was 9040110900063 D11C8EF10054038389C\WISPFiles. This applies to all above listed keys where they start with 70, they appeared as 90.



(instruction also downloadable below)

The first time after I had installed Microsoft Office 2003, I noticed that whenever I run Adobe Acrobat Reader 6.0, a background process is started called wisptis.exe. Once wisptis.exe has been started, it won't stop unless you kill it or reboot your system.

In general, the ways in which wisptis.exe can get installed on your system:

• installing Journal Viewer via Windows Update
• installing Microsoft Office 2003

So what is wisptis.exe? A quote from TabletPCDeveloper.com:

Well I don't have a Tablet PC and I certainly don't want an unnecessary process eating up my memory resources.

You cannot get rid of wisptis.exe by renaming or deleting it: Windows File Protection would cause it to reinstall the next time you run Adobe Acrobat.

There is even a rumor about a bug in wisptis.exe itself whereby it keeps part of the current user registry hive locked, preventing updates and eventually resulting in a corruption of the registry hive (which as reported leads to a "Userenv event 1517" on logging off or shutting down).

Others reported GDI leaks and CPU hogging. I haven't noticed the latter but can confirm that at one point, the number of open GDI handles by wisptis.exe was above 1000, which is unacceptable.

So by and large it seems wisptis.exe can make a thorough nuisance of itself.

To uninstall wisptis and Microsoft's Tablet PC Components on your PC, you must delete the following registry entries:

HKEY_CLASSES_ROOT\AppID\{7F429620-16D1-471E-A81A-114992148034}
HKEY_CLASSES_ROOT\AppID\wisptis.EXE
HKEY_CLASSES_ROOT\CLSID\{04A1E553-FE36-4FDE-865E-344194E69424}
HKEY_CLASSES_ROOT\CLSID\{13DE4A42-8D21-4C8E-BF9C-8F69CB068FCA}
HKEY_CLASSES_ROOT\CLSID\{242025BB-8546-48B6-B9B0-F4406C54ACFC}
HKEY_CLASSES_ROOT\CLSID\{3336B8BF-45AF-429F-85CB-8C435FBF21E4}
HKEY_CLASSES_ROOT\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}
HKEY_CLASSES_ROOT\CLSID\{43B07326-AAE0-4B62-A83D-5FD768B7353C}
HKEY_CLASSES_ROOT\CLSID\{43FB1553-AD74-4EE8-88E4-3E6DAAC915DB}
HKEY_CLASSES_ROOT\CLSID\{524B13ED-2E57-40B8-B801-5FA35122EB5C}
HKEY_CLASSES_ROOT\CLSID\{632A2D3D-86AF-411A-8654-7511B51B3D5F}
HKEY_CLASSES_ROOT\CLSID\{65D00646-CDE3-4A88-9163-6769F0F1A97D}
HKEY_CLASSES_ROOT\CLSID\{6E4FCB12-510A-4D40-9304-1DA10AE9147C}
HKEY_CLASSES_ROOT\CLSID\{786CDB70-1628-44A0-853C-5D340A499137}
HKEY_CLASSES_ROOT\CLSID\{836FA1B6-1190-4005-B434-7ED921BE2026}
HKEY_CLASSES_ROOT\CLSID\{8770D941-A63A-4671-A375-2855A18EBA73}
HKEY_CLASSES_ROOT\CLSID\{8854F6A0-4683-4AE7-9191-752FE64612C3}
HKEY_CLASSES_ROOT\CLSID\{937C1A34-151D-4610-9CA6-A8CC9BDB5D83}
HKEY_CLASSES_ROOT\CLSID\{9C1CC6E4-D7EB-4EEB-9091-15A7C8791ED9}
HKEY_CLASSES_ROOT\CLSID\{9DE85094-F71F-44F1-8471-15A2FA76FCF3}
HKEY_CLASSES_ROOT\CLSID\{9FD4E808-F6E6-4E65-98D3-AA39054C1255}
HKEY_CLASSES_ROOT\CLSID\{A5558507-9B96-46BA-94ED-982E684A9A6B}
HKEY_CLASSES_ROOT\CLSID\{A5B020FD-E04B-4E67-B65A-E7DEED25B2CF}
HKEY_CLASSES_ROOT\CLSID\{AAC46A37-9229-4FC0-8CCE-4497569BF4D1}
HKEY_CLASSES_ROOT\CLSID\{C52FF1FD-EB6C-42CF-9140-83DEFECA7E29}
HKEY_CLASSES_ROOT\CLSID\{D8BF32A2-05A5-44C3-B3AA-5E80AC7D2576}
HKEY_CLASSES_ROOT\CLSID\{DE815B00-9460-4F6E-9471-892ED2275EA5}
HKEY_CLASSES_ROOT\CLSID\{E3D5D93C-1663-4A78-A1A7-22375DFEBAEE}
HKEY_CLASSES_ROOT\CLSID\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4}
HKEY_CLASSES_ROOT\CLSID\{E9A6AB1B-0C9C-44AC-966E-560C2771D1E8}
HKEY_CLASSES_ROOT\CLSID\{EFB4A0CB-A01F-451C-B6B7-56F02F77D76F}
HKEY_CLASSES_ROOT\CLSID\{F0291081-E87C-4E07-97DA-A0A03761E586}

HKEY_CLASSES_ROOT\Installer\Components\BCA32ECD550 E1F4488DBD2A1578ACF8B
HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPFiles
HKEY_CLASSES_ROOT\Installer\Features\7040110900063 D11C8EF10054038389C\WISPHidden

HKEY_CLASSES_ROOT\TpcCom.* (all of them)

HKEY_CLASSES_ROOT\TypeLib\{194508A0-B8D1-473E-A9B6-851AAF726A6D}
HKEY_CLASSES_ROOT\TypeLib\{56D04F5D-964F-4DBF-8D23-B97989E53418}
HKEY_CLASSES_ROOT\TypeLib\{773F1B9A-35B9-4E95-83A0-A210F2DE3B37}
HKEY_CLASSES_ROOT\TypeLib\{7D868ACD-1A5D-4A47-A247-F39741353012}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\1125549C421D34E4DBF1036F62580BE1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\652A08B235C6DFF4C8CD41B52DE68CA4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\9B4B5940D4625D64C85532B8CDE3BF4D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\D656DA4A9E277A34D90D5E6FFA34E827
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\7040110900063D11C8EF10054038389C\Featu res\WISPHidden

Now you can also safely delete \Windows\System32\Wisptis.exe. Make sure the process is not running; otherwise kill it before deletion.

Fully tested on an up-to-date Windows XP SP1.

Cheers,
Alex