Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 5.23%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.12%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.29%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.06%
6.2.9200.16384 (win8_rtm.120725-1247) 15.97%
6.2.9200.16384 (win8_rtm.120725-1247) 2.47%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.12%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.06%
6.2.8102.0 (winmain_win8m3.110823-1455) 0.12%
6.1.7600.16385 (win7_rtm.090713-1255) 22.96%
6.1.7600.16385 (win7_rtm.090713-1255) 45.04%
6.1.7600.16385 (win7_rtm.090713-1255) 0.06%
6.0.6001.18000 (longhorn_rtm.080118-1840) 6.17%
6.0.6001.18000 (longhorn_rtm.080118-1840) 1.35%

Relationships

Parent process
Related files

PE structurePE file structure

Show functions
Import table
advapi32.dll
TraceMessage, OpenProcessToken, RegEnumKeyExW, EventWrite, RegDeleteKeyW, RegCloseKey, RegQueryInfoKeyW, RegOpenKeyExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, AdjustTokenPrivileges, LookupPrivilegeValueW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, InitiateShutdownW, RegQueryValueExW, RegSetValueExW, RegCreateKeyExW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, EventUnregister, EventRegister, RegEnumValueW
gdi32.dll
DeleteObject, SetAbortProc, SetMapMode, GetDeviceCaps, CreateFontIndirectW, SelectObject, StartDocW, StartPage, EndPage, EndDoc, AbortDoc, DeleteDC
kernel32.dll
GlobalFree, MulDiv, HeapFree, HeapAlloc, WriteFile, CreateFileW, GetCurrentProcess, GetCurrentThreadId, CreateMutexW, CreateEventW, GetVersionExW, FormatMessageW, GetProcessHeap, RegisterApplicationRestart, HeapSetInformation, GetSystemTime, SystemTimeToFileTime, CloseHandle, LoadLibraryA, OutputDebugStringA, GetModuleFileNameW, SetLastError, GetLastError, GetVersion, GetFileAttributesW, GetProcAddress, GetModuleHandleW, LoadLibraryW, GetModuleHandleA, OpenMutexW, InterlockedExchange, Sleep, InterlockedCompareExchange, GetStartupInfoA, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetVolumePathNamesForVolumeNameW, DeviceIoControl, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, LocalFree
msvcrt.dll
DllMain
ntdll.dll
WinSqmAddToStream, WinSqmSetDWORD, WinSqmEndSession, NtQuerySystemTime, WinSqmStartSession
ole32.dll
CoInitializeEx, CoCreateInstance, CoInitialize, CoUninitialize, CoCreateGuid, StringFromGUID2
setupapi.dll
SetupDiDestroyDeviceInfoList, SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW
user32.dll
DialogBoxParamW, EndDialog, DefWindowProcW, SetWindowLongW, DestroyWindow, SetDlgItemTextW, LoadStringW, MessageBoxW, SetCursor, SendMessageW, DrawTextW, EnumThreadWindows, GetWindowLongW, SetWindowPos, LoadIconW, CreateWindowExW, MsgWaitForMultipleObjects, DispatchMessageW, PeekMessageW, LoadCursorW, PostMessageW, GetParent, ShowWindow, GetDlgItem, IsDialogMessageW, SetFocus, EnableWindow, CreateDialogParamW, TranslateMessage
userenv.dll
GetUserProfileDirectoryW

dfdwiz.exe

Windows Disk Diagnostic User Resolver by Microsoft

Remove dfdwiz.exe
Version:   6.1.7600.16385 (win7_rtm.090713-1255)
MD5:   0facc053baff107027cbd1f48885fd4a
SHA1:   5c302518efc58ae706d052f4f860893439551419
SHA256:   867b8cbe2831f1782e1a77a6b5c71bdbcaee69e363d15691df3f9006abbd2f99
This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

dfdwiz.exe executes as a process with the local user's privileges typically within the context of its parent services.exe (Services and Controller app by Microsoft). It is an auto-starting process that used the Windows Task Scheduler service to load when the user logs into Windows (sometimes this is required to bypass the UAC protection). This version is designed to run on Windows 7 and is compiled as a 32 bit program.

DetailsDetails

File name:dfdwiz.exe
Publisher:Microsoft Corporation
Product name:Windows Disk Diagnostic User Resolver
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\dfdwiz.exe
Original name:DFDWiz.exe.mui
File version:6.1.7600.16385 (win7_rtm.090713-1255)
Product version:6.1.7600.16385
Size:67 KB (68,608 bytes)
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

BehaviorsBehaviors

Scheduled tasks startups
Set to load on user login (bypasses Windows UAC if enabled)
  • Login entry path '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver'
Scheduled tasks
  • The job 'Microsoft-Windows-DiskDiagnosticResolver' runs on logon in the path '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver'
  • Entry path '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver'

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.01301412%
0.028634%
Kernel CPU:0.00833893%
0.013761%
User CPU:0.00467519%
0.014873%
Kernel CPU time:4,742 ms/min
100,923,805ms/min
Memory
Private memory:8.66 MB
21.59 MB
Private (maximum):3.57 MB
Private (minimum):200 KB
Non-paged memory:8.66 MB
21.59 MB
Virtual memory:129.45 MB
140.96 MB
Virtual memory (peak):225.63 MB
169.69 MB
Working set:520 KB
18.61 MB
Working set (peak):24.71 MB
37.95 MB
Resource allocations
Threads:4
12
Handles:306
600
GUI GDI count:86
103
GUI GDI peak:256
142
GUI USER count:20
49
GUI USER peak:148
71

BehaviorsProcess properties

Integrety level:High
Platform:32-bit
Command line:C:\Windows\System32\dfdwiz.exe
Owner:User
Parent process:services.exe (Services and Controller app by Microsoft)

ResourcesThreads

Averages
 
DFDWiz.exe (main module)
Total CPU:0.11009143%
0.272967%
Kernel CPU:0.05277399%
0.107585%
User CPU:0.05731744%
0.165382%
CPU cycles:2,153,683/sec
5,741,424/sec
Memory:80 KB
1.16 MB
SHLWAPI.dll
Total CPU:0.00915954%
Kernel CPU:0.00534306%
User CPU:0.00381647%
CPU cycles:149,393/sec
Memory:348 KB

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 29.50%
Windows 8.1 18.50%
Windows 7 Ultimate 15.00%
Windows 8.1 Pro 8.00%
Windows 7 Professional 6.50%
Windows 8 4.50%
Windows 8.1 Single Language 3.50%
Windows 8 Pro 3.00%
Windows 8.1 Pro with Media Center 2.50%
Windows 8 Single Language 2.50%
Windows 7 Home Basic 2.00%
Windows Vista Home Premium 1.50%
Windows 8 Enterprise N 1.00%
Windows 8.1 N 0.50%
Windows Seven Black Edition 0.50%
Windows 8.1 Enterprise Evaluation 0.50%
Windows 8 Enterprise 0.50%

Distribution by countryDistribution by country

United States installs about 44.72% of Windows Disk Diagnostic User Resolver.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 20.16%
ASUS 18.60%
Hewlett-Packard 17.05%
Acer 11.24%
Lenovo 10.08%
Toshiba 9.30%
Sony 5.43%
Intel 2.33%
GIGABYTE 1.94%
Alienware 1.55%
Samsung 1.55%
Medion 0.78%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE