Need help with funky MS networking services behavior

[a.k.a.]

Dear all,

I have run this question by several forums so far, with darn near no response. I would like to think that SNB users have a good bead on these issues, and can at least help clarify the issue I'm experiencing, even if a conclusive diagnosis is elusive.

I have run a full spectrum of anti-malware scans and have come up negative. It doesn't mean nothing's there, but I'm wondering if anyone can hypothesize alternate explanations. This started after trying to establish an adhoc network with a friend's laptop. His machine could be infected, but it might be a residual glitch in networking settings. I originally tried to use WiFi, and then gave up and used Ethernet. My OS (WS2008 x64) was considered the server in the adhoc arrangement.

I have a svchost shell kicking into action on boot that eats 50% of a dual-core CPU. It is blocking internet access. When I use Task Manager to kill it, IE8 immediately returns results. Like many such processes, it kicks into gear again after a moderate delay -- three times -- before it seems to give up. It seems to run at boot, but will also try to run as soon as I turn the WiFi radio on after it's been off, and as soon as I launch IE8.

According to Task Manager, the services running under this svchost shell all appear to be MS networking services:
1. Windows Remote Management (WinRM)
2. Terminal Services (TermService)
3. Network Location Awareness (NlaSvc)
4. KtmRm for Distributed Transaction Coordinator (KtmRm)
5. DNS Client (Dnscache)
6. Cryptographic Services (CryptSvc)

Any leads?

Incidentally, this is a basic question: Has anyone seen a newbie-friendly tutorial on the net for making use of network & drive I/O monitoring tools in this situation? I need to start very basic for now. The tutorials I've come across so far are for utilities that tell me registry info being accessed, when really the most useful utility for me right now would be one that starts off by telling me what apps / services are accessing the net and my drive.

Many thanks for your guesses and insights.

Regards,

a.k.a.

 

[joesuffceren]

two things to try

Try temporarily disabling your wireless card and any associated services (restarting after doing so) to see if the problem goes away. Also (separately) try stopping the "server" service (Start>Run>Services.msc or net stop server from an elevated command prompt) to see if the issue stops. Neither of those is a solution per se, but just troubleshooting steps to help you identify the problem.

Also check out Process Explorer. This utility is invaluable for tracking down performance issues.

Joe

 

[kot1rc5]

Try a packet sniffer http://www.wireshark.org to see whats going on. At boot Windows does a lot of broadcasts to locate/catalog all nodes on the network (UPnP??) for ip6 and ip4.

As for IE8... there is a lot of automation happening in the background, pre-caching, checking the page for safety (phone home to MS approved safe site list), search suggestions from ( MS live search or your list of providers).

Do you have itoons installed? I had problems with their bonjure (spelling) and their dns redirector service, once I disabled those services ie8 got much faster.

I also was running my own dns server so I could redirect bad domains to 127.0.0.0.1

ymmv

k

 

[a.k.a.]

Joe and K,

Joe, great idea. I disabled both the Server and the file server services, and neither of those, I'm dismayed to say, dispensed with the Svchost issue. The source isn't obvious.

I have not yet started it in safe mode without networking, but as I mentioned, the Svchost starts up when the WiFi card is physically turned from off to on. It is definitely up and running even before I connect to any WiFi network, which currently is a separate step. If I kill it, it also starts up the first time I launch IE8. So, it seems to be networking sensitive, but not a part of the driver or the browser.

Incidentally, there are two "unknown devices" on my laptop that are also associated with WiFi networking -- whenever I flip on the physical WiFi networking switch, I get the Windows notices for them. MS' database can't identify them, but there's a chance it could be related to that IDing process. I'm at a loss as to how to identify these things -- as you know it's often hard to figure out.

ProcessExplorer is really a bit beyond me for troubleshooting. That's why you heard me ask about tutorials.

K,

Negative on iTunes and Bonjour. I avoid bloatware / use FLAC. (Kantaris Media Player, Exact Audio Copy and MediaCoder are good enough for me.)

Now I'm going to sound like a broken record. WireShark is a bit beyond me for troubleshooting. That's why you heard me ask about tutorials. When I get a break in my week, I'll read the WireShark directions and see what I can figure out.

* * *

For admins, know that you would be doing potentially thousands of users a huge favor if you decided to publish a "For Dummies" tutorial on system / networking diagnostics using ProcessExplorer and WireShark!

Thanks a lot guys for the initial hunches, and if any further advice occurs to you, I'm still following this thread -- just am really busy in the real world, so it's taking me a little time.

Cheers,

a.k.a.