Internet Connection Sharing (ICS) service hung on starting - 2 minute delay

[Tim Godfrey]

Whenever my XP-Prof SP1 system boots, there is a 2 minute delay before
network activity can begin.

Reviewing the event log shows the message: "The Internet Connection
Firewall (ICF) / Internet Connection Sharing (ICS) service hung on
starting."

At this point networking is disabled, and the network icon does not
appear in the tray.

About 2 minutes later, there is a burst of hard disk activity, the
network icon appears and the message "The Internet Connection Firewall
(ICF) / Internet Connection Sharing (ICS) service entered the running
state." appears in the event log.

The other events that appear in the event log between the two ICF/ICS
messages (in sequential order) are:

"The Terminal Services service was successfully sent a start control."
"The NaiAvFilter1 service was successfully sent a start control."
"The Windows Management Instrumentation service was successfully sent
a start control."
"The Terminal Services service entered the running state."
"The Windows Management Instrumentation service entered the running
state."

I have found other threads in the past that address this exact
problem, but nobody has ever posted a diagnosis or solution.

 

[Ken Wickes [MSFT]]

2 minute hangs means there is a service deadlock. Any idea what the
"NaiAvFilter1" service is?

 

[Tim Godfrey]

NaiAvFilter1 is part of McAfee Virusscan Enterprise 7.1. It appears to
be running normally.

For what it's worth, I used to use Norton Antivirus 2003 and had this
problem. I uninstalled NAV and still had the problem. I installed
McAfee and still have the problem. However, I have found that NAV does
a very poor job uninstalling, so there may be a virus-scanner related
issue.

I have been looking for the cause of a deadlock, but have not found
anything missing or unexpected in the dependencies.

The ICF/ICS service dependiencies look like this:

Application Layer Gateway
Network Connections
+-Remote Procedure Call (RPC)
Network Location Awareness
+-AFD Networking Support Environment
+-TCP/IP Protocol Driver
+- IPSEC Driver
Remote Access Connection Manager
+-Telephony
+-Plug and Play
+-Remote Procedure Call (RPC)

2 minute hangs means there is a service deadlock. Any idea what the
"NaiAvFilter1" service is?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Whenever my XP-Prof SP1 system boots, there is a 2 minute delay before
network activity can begin.

Reviewing the event log shows the message: "The Internet Connection
Firewall (ICF) / Internet Connection Sharing (ICS) service hung on
starting."

At this point networking is disabled, and the network icon does not
appear in the tray.

About 2 minutes later, there is a burst of hard disk activity, the
network icon appears and the message "The Internet Connection Firewall
(ICF) / Internet Connection Sharing (ICS) service entered the running
state." appears in the event log.

The other events that appear in the event log between the two ICF/ICS
messages (in sequential order) are:

"The Terminal Services service was successfully sent a start control."
"The NaiAvFilter1 service was successfully sent a start control."
"The Windows Management Instrumentation service was successfully sent
a start control."
"The Terminal Services service entered the running state."
"The Windows Management Instrumentation service entered the running
state."

I have found other threads in the past that address this exact
problem, but nobody has ever posted a diagnosis or solution.

 

[Ken Wickes [MSFT]]

During that 2 minutes delay, run a command prompt and type "sc queryex
sharedaccess" and post the results.

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

NaiAvFilter1 is part of McAfee Virusscan Enterprise 7.1. It appears to
be running normally.

For what it's worth, I used to use Norton Antivirus 2003 and had this
problem. I uninstalled NAV and still had the problem. I installed
McAfee and still have the problem. However, I have found that NAV does
a very poor job uninstalling, so there may be a virus-scanner related
issue.

I have been looking for the cause of a deadlock, but have not found
anything missing or unexpected in the dependencies.

The ICF/ICS service dependiencies look like this:

Application Layer Gateway
Network Connections
+-Remote Procedure Call (RPC)
Network Location Awareness
+-AFD Networking Support Environment
+-TCP/IP Protocol Driver
+- IPSEC Driver
Remote Access Connection Manager
+-Telephony
+-Plug and Play
+-Remote Procedure Call (RPC)





"Ken Wickes [MSFT]" <[email protected]> wrote in message

2 minute hangs means there is a service deadlock. Any idea what the
"NaiAvFilter1" service is?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Whenever my XP-Prof SP1 system boots, there is a 2 minute delay before
network activity can begin.

Reviewing the event log shows the message: "The Internet Connection
Firewall (ICF) / Internet Connection Sharing (ICS) service hung on
starting."

At this point networking is disabled, and the network icon does not
appear in the tray.

About 2 minutes later, there is a burst of hard disk activity, the
network icon appears and the message "The Internet Connection Firewall
(ICF) / Internet Connection Sharing (ICS) service entered the running
state." appears in the event log.

The other events that appear in the event log between the two ICF/ICS
messages (in sequential order) are:

"The Terminal Services service was successfully sent a start control."
"The NaiAvFilter1 service was successfully sent a start control."
"The Windows Management Instrumentation service was successfully sent
a start control."
"The Terminal Services service entered the running state."
"The Windows Management Instrumentation service entered the running
state."

I have found other threads in the past that address this exact
problem, but nobody has ever posted a diagnosis or solution.

 

[Tim Godfrey]

During that 2 minutes delay, run a command prompt and type "sc queryex
sharedaccess" and post the results.

C:\>sc queryex sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x2
WAIT_HINT : 0x7530
PID : 1584
FLAGS :

 

[Ken Wickes [MSFT]]

This is the first hang I have seen at checkpoint 2. Unfortunately I don't
work in the Windows division anymore so I can't look at the code to find out
what this is.

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Ken Wickes [MSFT]" <[email protected]> wrote in message

During that 2 minutes delay, run a command prompt and type "sc queryex
sharedaccess" and post the results.

C:\>sc queryex sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x2
WAIT_HINT : 0x7530
PID : 1584
FLAGS :

 

[Tim Godfrey]

Ken,

Thanks for your help so far. It doesn't look like anybody else is
jumping in with suggestions. Googling "checkpoint: 0x2" finds only
this thread.

I hope there is another way to resolve this problem without having to
consult the Windows source code! :-0

What do you recommend as a next step for me to solve this?

Thanks,

Tim.

This is the first hang I have seen at checkpoint 2. Unfortunately I don't
work in the Windows division anymore so I can't look at the code to find out
what this is.

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Ken Wickes [MSFT]" <[email protected]> wrote in message

During that 2 minutes delay, run a command prompt and type "sc queryex
sharedaccess" and post the results.

C:\>sc queryex sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x2
WAIT_HINT : 0x7530
PID : 1584
FLAGS :

 

[Ken Wickes [MSFT]]

Looks like it is trying to load the nat driver at this point. During the 2
min delay type the following commands at a command prompt and post the
results.

sc queryex ipnat
sc qc ipnat


--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Ken,

Thanks for your help so far. It doesn't look like anybody else is
jumping in with suggestions. Googling "checkpoint: 0x2" finds only
this thread.

I hope there is another way to resolve this problem without having to
consult the Windows source code! :-0

What do you recommend as a next step for me to solve this?

Thanks,

Tim.


"Ken Wickes [MSFT]" <[email protected]> wrote in message

This is the first hang I have seen at checkpoint 2. Unfortunately I don't
work in the Windows division anymore so I can't look at the code to find out
what this is.

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Ken Wickes [MSFT]" <[email protected]> wrote in message

During that 2 minutes delay, run a command prompt and type "sc queryex
sharedaccess" and post the results.



C:\>sc queryex sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x2
WAIT_HINT : 0x7530
PID : 1584
FLAGS :

 

[Tim Godfrey]

C:\>sc queryex ipnat

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING

(STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\>sc qc ipnat
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : System32\DRIVERS\ipnat.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IP Network Address Translator
DEPENDENCIES : Tcpip
SERVICE_START_NAME :

C:\>


Ken,

If you would like to see the services that are running during the
delay, look here: http://www.chromaticsound.com/tim/private/services1.gif
and here: http://www.chromaticsound.com/tim/private/services2.gif

Maybe you'll notice something unexpected.

Thanks again for your help!

 

[Ken Wickes [MSFT]]

Those look normal. The only thing I see from your screenshots is that you
have the Kerio firewall, McAffee something, and Network Associates
something. I've haven't seen these products cause the startup problem, but
temporarily uninstalling them might be worth a shot, especially since I have
no other suggestions.

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

C:\>sc queryex ipnat

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING

(STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\>sc qc ipnat
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : System32\DRIVERS\ipnat.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IP Network Address Translator
DEPENDENCIES : Tcpip
SERVICE_START_NAME :

C:\>


Ken,

If you would like to see the services that are running during the
delay, look here: http://www.chromaticsound.com/tim/private/services1.gif
and here: http://www.chromaticsound.com/tim/private/services2.gif

Maybe you'll notice something unexpected.

Thanks again for your help!


"Ken Wickes [MSFT]" <[email protected]> wrote in message

Looks like it is trying to load the nat driver at this point. During the 2
min delay type the following commands at a command prompt and post the
results.

sc queryex ipnat
sc qc ipnat