WastedJoker
Apr 19 2008, 23:23
Hello,
I've suffered a few nasty experiences when trying to remove the Bonjour Service which is installed by Adobe/Apple products. Unlike a lot of services, the Bonjour Service has many nasty tentacles buried into critical system/registry settings and removing it without following the below instructions can do a few things like:
1. Disabling your network connection fatally (can only be resolved with a WinSock fix and only under certain circumstances)
2. Prevent the start-up of many important Windows Services like Event Viewer or System Event Notification. This has a drastic impact on your start-up/shut-down times.
Basically, removing the Bonjour Service can be an utter nightmare and the below instructions are the only ones that work 100% for me.
To remove the Bonjour Service:
- Stop Bonjour Service by opening a command prompt (remember to open the command prompt with Administrator privileges in Vista) and type:
sc stop “bonjour service”
- Once that is done, in the same command prompt type:
sc delete “bonjour service”
- Now we need to disable the Bonjour socket driver.
- Start regedit.exe (with Administrator privileges in Vista) and go to the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004
(please note: the final digit in this key may vary depending on your circumstances - look through all the entries under Catalog_Entries - the key you're dealing with should contain LibraryPath = C:\Program Files\Bonjour\mdnsNSP.dll)
- Within that key find the entry:
Enabled=REG_DWORD:00000001 - change it from 1 to 0.
- Exit out of the command prompt and reboot your PC.
- Once you have logged back in, delete the C:\Program Files\Bonjour (with the files mDNSResponder.exe and mdnsNSP.dll).
There you have it - these instructions will work for Windows XP and Vista.
Neo003
Apr 19 2008, 23:32
Thanks it worked great, you're right the catalog entry mine was in 0x007.
Worked like a charm! Mine was also in 0x007.
Thanks dude
sTIMPZ
Apr 20 2008, 20:11
What exactly does the bonjour service do? And since you're removing it I'm assuming that it is not necessary in order for Adobe/Apple software to run correctly?
Cosmin
Apr 20 2008, 20:14
useful indeed .
Quote - (sTIMPZ @ Apr 20 2008, 15:11)
What exactly does the bonjour service do? And since you're removing it I'm assuming that it is not necessary in order for Adobe/Apple software to run correctly?
Quote -
Adobe newest Creative Suite 3 installs Apple’s Bonjour service even if you don’t install Version Cue. Its main goal is to provide zero-configuration connectivity between Version Cue server and the suite’s applications.
When installed by Creative Suite 3 applications, the name used by Bonjour for Windows in the services control panel is:
##Id_String2.6844F930_1628_4223_B5CC_5BB94B879762##
http://www.ajuaonline.com/2007/10/02/how-t...onjour-service/
gahbahj
Apr 22 2008, 19:29
i recently installed adobe dreamweaver cs3 and found this was installed too. apparantly all cs3 products install this without asking, whether u need/want it or not. after reading a bit i found some interesting discussion & the source of the removal script here
http://blogs.adobe.com/jnack/2007/01/cs3_doesnt_inst.htmli guess the thing even talks to 2o7.net (a data collector) thru a deceptive IP looking site name
192.168.112.2o7.net.
i dont use cue servers, so i removed it. here's the script if u dont want to wander the net looking - save as a .bat file
CODE
echo Bounjour service killer...(cmd-bat file)
"%ProgramFiles%\Bonjour\mDNSResponder.exe" -remove
sc stop "Bonjour Service"
sc delete "Bonjour Service"
sc stop "B"
sc delete "B"
regsvr32 /u/s "%ProgramFiles%\Bonjour\mdnsNSP.dll"
reg delete "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\864614E012A08774EB1646AA5AEB0193" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\413EF6387A735094090FFA2EF513C53A" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
ren "%ProgramFiles%\Bonjour\mdnsNSP.dll" "%ProgramFiles%\Bonjour\virus.vir"
del /q/f "%ProgramFiles%\Bonjour\*.*"
rd /q "%ProgramFiles%\Bonjour"
echo ...
echo please, reboot your computer and
echo then you can delete the folder:
echo "%ProgramFiles%\Bonjour"
pause
WastedJoker
Apr 22 2008, 19:51
Quote - (gahbahj @ Apr 22 2008, 20:29)
i recently installed adobe dreamweaver cs3 and found this was installed too. apparantly all cs3 products install this without asking, whether u need/want it or not. after reading a bit i found some interesting discussion & the source of the removal script here
http://blogs.adobe.com/jnack/2007/01/cs3_doesnt_inst.htmli guess the thing even talks to 2o7.net (a data collector) thru a deceptive IP looking site name
192.168.112.2o7.net.
i dont use cue servers, so i removed it. here's the script if u dont want to wander the net looking - save as a .bat file
CODE
echo Bounjour service killer...(cmd-bat file)
"%ProgramFiles%\Bonjour\mDNSResponder.exe" -remove
sc stop "Bonjour Service"
sc delete "Bonjour Service"
sc stop "B"
sc delete "B"
regsvr32 /u/s "%ProgramFiles%\Bonjour\mdnsNSP.dll"
reg delete "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\864614E012A08774EB1646AA5AEB0193" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\413EF6387A735094090FFA2EF513C53A" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Bonjour Service" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "D:\\Program Files\\Bonjour\\mDNSResponder.exe" /f
ren "%ProgramFiles%\Bonjour\mdnsNSP.dll" "%ProgramFiles%\Bonjour\virus.vir"
del /q/f "%ProgramFiles%\Bonjour\*.*"
rd /q "%ProgramFiles%\Bonjour"
echo ...
echo please, reboot your computer and
echo then you can delete the folder:
echo "%ProgramFiles%\Bonjour"
pause
That guide relies on the Name Catalog in your registry being 4. As posters above have said, theirs has been 7.
The_Decryptor
Apr 22 2008, 20:28
Quote - (gahbahj @ Apr 23 2008, 05:29)
...
i guess the thing even talks to 2o7.net (a data collector) thru a deceptive IP looking site name 192.168.112.2o7.net.
...
That's something else entirely.
Unless configured otherwise, Bonjour only works over your local network.
I've been wondering what this Bonjour thing was, but never actually cared enough to look into it.
But I do care enough to get rid of it now, thanks to your easy instructions.
funkycop
Apr 23 2008, 15:25
Thanks , I was trying to erase this service with no end, great !!
Digital Monster
May 30 2008, 19:02
Thanks for posting this. I had actually reformated my system because Bonjour had killed my net connection. It wasn't until the second time around I had learned to refresh WinSock...sigh. At least this will fix that problem from happening again.
SakuraKira
May 31 2008, 01:43
Did you ever try just preventing the service from starting in the first place, in the Services.msc control panel? It gets installed with iTunes now, and I just disable it.
I actually removed the whole entry at first which was for me Catalog_Entries\000000000005.
I rebooted and I was like WTF, I had no internet, no sound, no visual styles. I go back and there's Num_Catalog_Entries which I reduced by one at NameSpace_Catalog5
fiew!
I have this service too, but it does not bother me. Don't fix it if it ain't broke.
FunkPhenomena
Jun 22 2008, 11:43
Quote - (revvo @ May 31 2008, 16:20)
I actually removed the whole entry at first which was for me Catalog_Entries\000000000005.
I rebooted and I was like WTF, I had no internet, no sound, no visual styles. I go back and there's Num_Catalog_Entries which I reduced by one at NameSpace_Catalog5
fiew!
I have the same problems and somewhat did the same thing. I didn't realize this was a part of adobe photoshop cs3 and thought it was some leftover from apple. I searched regedit and deleted all bonjour references without realizing how effed up things were going to get. Complacency meant no registry backup...
So I am curious, how did you resolve your issue?
way2quik
Jul 4 2008, 16:22
Odd.
I've always went to Add/Remove Programs, and I've always had successful uninstalls.
_dandy_
Jul 4 2008, 19:12
Quote - (pS- @ Jun 4 2008, 00:28)
I have this service too, but it does not bother me. Don't fix it if it ain't broke.
With behavior such as this, it
is broken. Developers writing software this nasty should be taken out and shot. And I'm saying this as a developer.
Starbuck84
Jul 4 2008, 19:19
Quote - (SakuraKira @ May 31 2008, 03:43)
Did you ever try just preventing the service from starting in the first place, in the Services.msc control panel? It gets installed with iTunes now, and I just disable it.
Same here, just disabled the services so it wouldn't start up anymore. But I do thank the OP, cause it helped me remove it completely, thanks!
Quote - (way2quik @ Jul 4 2008, 17:22)
Odd.
I've always went to Add/Remove Programs, and I've always had successful uninstalls.
Yea, I know. It gets install by default with itunes but I just uninstall from there, just like Mobile support. Bonjour is not in services .msc any more.
Surprised people are having problems.
I wish Apple would stop stuffing so much extra crap and services with each itunes release. Programs that aren't antiviruses which add new processes can feck off. It's so pointless.
FunkPhenomena
Jul 13 2008, 17:47
I don't think it's the apple flavor, rather the photoshop cs3 one. With the apple one, I was able to add/remove like anything else... and perhaps if I'd installed photoshop and then did the add/remove, maybe there wouldn't have been an issue. Instead, I see bonjour running knowing full well I had uninstalled that sucker some time ago and so went to the registry to force the issue. Major screwup on my part, especially with no registry backup. Removing all bonjour entries in the registry killed my internet, sound and desktop effects. And it killed the internet hard... after many hours I came upon a winsockfix utility that saved my hide... yeesh. Not even a repair install fixed things before that. And that was an ugly repair install with no internet and it kept asking for drivers...
Anyhow, tread lightly with this photoshop cs3 bonjour... indeed, the tentacles run deep.
Quote - (_dandy_ @ Jul 4 2008, 15:12)
With behavior such as this, it is broken. Developers writing software this nasty should be taken out and shot. And I'm saying this as a developer.
Indeed. A proper installer/setup will ask for what the user needs and install accordingly. I guess that's too complicated for the average OSX user, seeing how many of them use Apple because they fled away from Windows.
AgEnTsMiTh
Jul 13 2008, 22:24
Quote - (revvo @ Jul 13 2008, 11:30)
Indeed. A proper installer/setup will ask for what the user needs and install accordingly. I guess that's too complicated for the average OSX user, seeing how many of them use Apple because they fled away from Windows.
Yes that is why OSX users fled windows.
Impact
Jul 13 2008, 22:43
The best guide I have found has been here:
http://www.x64bit.net/site/board/index.php...ost&p=40719It has a couple more steps, but this guide isn't bad either.
gigapixels
Jul 13 2008, 22:58
Just a note, for those thinking of doing this: you need Bonjour installed and running in order for the Remote app to work on the iPhone/iPod Touch 2.0 firmware.
BrokenAI
Jul 13 2008, 23:00
I was amazed when I realized it was actually the Bonjour service that was making my Windows Vista experience as painful as it was. Who would write such a "malware" I thought...
Then I started with all those conspiracy theories in my head as why there are so extreme amounts of security flaws caused by Axxxx and Axxxx software on Windows and could this possibly be made on purpose... I don't mean for you to take that part seriously, it was just a thought I had.
Anyway after removing this piece of "malware" I started enjoying Vista again and decided not to downgrade to XP.
I'm not saying this service is entirely bad, it just had bad conflict with my machine and I had no idea what was causing my machine to act so sluggish! And I wonder how many people have experienced it as well but just believed in all the anti-Vista rants and thought it was normal.
The_Decryptor
Jul 14 2008, 12:57
Are you sure it wasn't something else, or a bad install?
Bonjour by itself is very light weight (It's a small DNS server)
BrokenAI
Jul 14 2008, 17:30
I don't know what it was, but my PC started to act fast again when I disabled the service.
It was definitely not working the way it was intended or perhaps it had been altered by something else entirely, at least I find it scary.
Baleno_E
Jul 15 2008, 07:34
I don't even know what it's for....
Now I can delete it without any worry...
Thanks....
jpmad4it
Aug 4 2008, 09:05
Hi everyone,
I read a guide similar to this, but they did not point out that I had to look for the specific dll in the registry. It merely said delete the registry entry with number 00000000005 (see below for registry location). So being a total fool, and believing everything I read on the net, away I went and did that.
I also did the same for the same entry, but it was for the 64 bit entry in the registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000005
So then I find my internet dies, critical services are not starting, and my PC is more or less dead.
So I have obviously deleted the incorrect registry entry, one that was very important.
Is a windowsr re-install the only way to correct this? Any help would be amazing.
I tried an LSP fix, but it didn't seem to work.
kind regards
jonathan
You can even remove this service from the command line:
cd C:\Program Files\Bonjour
mDNSResponder.exe -remove
Umbrello
Sep 5 2008, 19:45
It's using a whopping 548K. I really can't be bothered.
Randolph
Sep 5 2008, 19:47
Quote - (Umbrello @ Sep 5 2008, 15:45)
It's using a whopping 548K. I really can't be bothered.
But you're bothered to post that you aren't bothered?
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.