7

From what I have understood after researching on Google, there are two ways of how a program can start on Windows:

  1. Manual (The user doubled clicked on the executable or shortcut file of the program)
  2. Automatic:
  3. Started by another program

Automatic startup can be due to 4 reasons:

  • A service, that should be installed
  • the windows registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
  • a shortcut to it to the startup folder of start menu
  • task scheduler

However, I found an invisible window called: UNCServer.exe running on my computer.

I want to stop it but I couldn't find the reason why it is running. I checked everywhere on all the bullets points mentioned above but there is no luck.

Assuming that the task is running right now on my computer, is there a way to know how a program has started on Windows?

Improve this question
0

4 Answers 4

Reset to default
5

If you would use ProcessExplorer, you can find how program started:
From menu: go to View->Select column then switch to tab:Process Image
and check box Autostart location.

This way you can reveal what mechanism program used to autostart.
Make sure to run ProcessExplorer as administrator.

Improve this answer
1
  • 1
    Even the Command lineoption is great
    – Dorian Grv
    Nov 21, 2022 at 18:31
2

I found it. Here is what I did:

I decided that I am going to rename the file to bak-uncserver.exe because if it is a program that starts it, I will cause a error. I restarted my PC and indeed, the error popup appeared saying that the file uncserver.exe was not found. Then looking at the task manager, the popup was shown by a program called tvsu.exe which was located in the same directory as uncserver.exe. The conclusion is it is that tvsu file that started uncserver.

Then I checked both services and autostart. tvsu was an automatic servic. I disabled it. Then restarted. However, the windows popup still appeared.

Finally, after digging, I checked task scheduler under 'Task Scheduler Library'. I found TVT>TVSUUPdate task: enter image description here

I disabled it. It is finally gone. It was a task scheduled

Improve this answer
1

you can use Autoruns tool of Windows Sysinternals for this purpose.

On executing this tool, it will list everything which is automatically executed on your system. You can use search and filter to find what is causing UNCServer.exe to run on your system.

enter image description here

Improve this answer
3
  • unfortunately, uncserver.exe is not listed
    – TSR
    Aug 17, 2018 at 15:02
  • @TSR This executable is part of Lenovo System Update. Main executable is tvsu.exe; These executable can be found in C:\Program Files\lenovo\system update folder. If you do not want to run system updates from manufacturer, you may disable or uninstall it completely.
    – Sandeep
    Aug 17, 2018 at 15:15
  • are you saying that uncserver.exe is launched by tvsu.exe ? If so, what is launching tvsu.exe
    – TSR
    Aug 19, 2018 at 6:44
1

However, I found an invisible window called: UNCServer.exe running on my computer.

I want to stop it but I couldn't find the reason why it is running. I checked everywhere on all the bullets points mentioned above but there is no luck.

It's located in the following directory:

C:\Program Files\Lenovo\System Update\

In order to remove it, you should remove ThinkVantage System Update, and reboot your system. UNCserver.exe is system update(Universal Naming Convention) server module. It runs as a separate windows task while ThinkVantage System Update is running. Since the software is only installed, if you installed the Lenovo software, you can safely remove it.

Considering Lenovo has been known to break the internet by installing insecure self-signed certificates, and running a Man In the Middle attack on all secure traffic, you should remove ALL Lenovo software from your machine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .