How Do I Determine What WUDFHost.exe is Doing and What It's Associ

[osRe]

Even Process Explorer still doesn't show in a simple way what's the function served by each WUDFHost.

 

Regarding drivers for USB, I didn't mean in a general sense, but WUDFHost specifically. I thought it'd odd that you have it running when your USB HDD is connected, but I just tried a UFD and indeed also here WUDFHost loads. That's news to me.

[NoelC]

I had thought that it didn't used to show up, but I did a search of the process list logs I've been accumulating daily, and sure enough one WUDFHost process has been running since the day I installed Windows 8.1 (I did so as a clean install after having been running Windows 7).  That the second one showed up is why I started this thread, and now I have verified by my logs that it happened when I installed VS 2013 back in March.

 

Jaclaz, does the media transfer protocol even apply with just a USB disk drive?  I've deconfigured many of the media sharing features.  That being said, Windows Media Player still DOES seem to want to scan my backup drives for media content from time to time.

 

-Noel

[NoelC]

Let's see whether this turns up any answers:

 

http://social.technet.microsoft.com/Forums/en-US/fd890ca3-6bb8-4806-9638-8b583d6eb9a3/why-is-wudfhostexe-running-for-my-two-external-usb-wd-mybook-drives?forum=w8itproperf

 

-Noel

[MagicAndre1981]

btw, you can also use Windg to find the cause. Attach to the Process and run those 2 commands: .load wudfext !umdevstacks
 

0:009>  .load wudfext 0:009> !umdevstacks Number of device stacks: 1  Device Stack: 0x0000008aee69f380    Pdo Name: \Device\0000001a    Active: Yes    Number of UM devices: 1    Device 0      Driver Config Registry Path: SensorsSimulatorDriver      UMDriver Image Path: C:\Windows\system32\DRIVERS\UMDF\SensorsSimulatorDriver.dll      Fx Driver: IWDFDriver 0x8aee8e8688      Fx Device: IWDFDevice 0x8aee8e8968*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\Drivers\UMDF\SensorsSimulatorDriver.dll - Error: Symbol SensorsSimulatorDriver!DllGetClassObject is not in the format "module!type::`vftable'".        IDriverEntry: (unknown type) 0x0000008aee6b86f0      Open UM files (use !umfile <addr> for details): <None>      Device XFerMode: CopyImmediately RW: Buffered CTL: Buffered      Object Tracker Address: 0x0000000000000000        Object   Tracking OFF        Refcount Tracking OFF    DevStack XFerMode: CopyImmediately RW: Buffered CTL: Buffered

[MagicAndre1981]

I sent a feature request to Mark. Maybe he implements and easy show of the attached device in an update to Process Explorer.

[NoelC]

Good idea. I had alluded to that on the discussion board for ProcExp already, but coming from you and with more specific goals, I'm sure he'll see the merit.

-Noel

[NoelC]

In investigating something else I finally figured out why WUDFHost was running for my external backup drives.

 

Turns out among other things these drives are considered "Portable Devices" in the Device Manager.

 

This doesn't seem unreasonable at first, but a "Portable Device" turns out to be the term for something like a smart phone or music player that can be plugged-into a USB port.

 

WUDFHost is NOT started when the devices are disabled in Device Manager in the Portable Devices category.  Yet I do not lose the ability to access the files on the drives.

 

I noticed that media player would look all through these backup drives occasionally, and that plus some warning messages in the System Event Log that I finally was able to find some info on lit the bulb over my head.

 

One less service running, no loss of functionality. 

 

-Noel

Edited March 13, 2015 by NoelC

[MagicAndre1981]

dmex coded a plugin for ProcessHacker to show which driver is used by WUDFHost.exe in the tooltip:

 

 

http://processhacker.sourceforge.net/forums/viewtopic.php?t=1590&p=5334#p5334

[NoelC]

Thanks for the follow-up, Andre.  And thank you also for requesting the feature.

 

I don't have any more instances of WUDFHost running on my Win 8.1 workstation,  but I do have some running in my Win 10 test system that I haven't investigated yet, and this plug-in has identified three drivers:

 

 

-Noel

Edited April 15, 2015 by NoelC

[MagicAndre1981]

it was now merged directly into the program. Get the code from Subversion (svn://svn.code.sf.net/p/processhacker/code/) and compile your own version.

[NoelC]

FYI the plug-in didn't work in identifying that WUDFHost was running because of a USB drive being considered a "Portable Device" on a Win 10 Enterprise test system I just put together.  The "Drivers:" section was just empty.

 

-Noel

[MagicAndre1981]

report it into the ProcessHacker forum. Have you tried the code from SVN?

[NoelC]

No, I haven't had time yet.

 

-Noel

[dmex]

FYI the plug-in didn't work in identifying that WUDFHost was running because of a USB drive being considered a "Portable Device" on a Win 10 Enterprise test system I just put together.  The "Drivers:" section was just empty.

 

-Noel

 

That bug should be fixed in the last stable release? 

Edited May 18, 2015 by dmex

[NoelC]

I hope so, but unfortunately I'm not in a condition to check.  Once I found out the Portable Device category was causing the extra software to run I just removed the entries.  I'll check when I set up another new system.

 

Edit:  I was wrong, I have one system where I disabled the "Portable Devices" entries.  When I re-enable them I do see the indication that the external drive's driver is the one using WUDFHost.  Thanks for the fix.

 

I had to manually remove the UMDFHostPlugin.dll plug-in that was put in place before.

 

-Noel

Edited May 18, 2015 by NoelC