Networking services blocking internet, eating 50% CPU

[a.k.a.]

Hello everyone,

Your help will be very valuable right now. I'm running Windows Server 2008
x64 as a laptop/client OS on a Lenovo ThinkPad T61p -- yet I'm certain that
the same issue applies to Vista x64, so I would appreciate your assistance in
this forum. I'm still very much a learner, so please break the
troubleshooting down into simple walkthroughs if you can.

As soon as I flip on the physical WiFi / BT radio switch, a svchost process
loads that eats 50% of the CPU, and blocks IE8 from connecting to the
internet, even after I've connected to a WiFi router. I have to kill the
svchost process in Task Manager for IE to connect (and it does so instantly).
Usually, after killing it, the svchost vanishes after that, although it may
pop up again later, and sometimes goes away by itself then.

The services running under this svchost are:
Windows Remote Management (WinRM)
Terminal Services (TermService)
Network Locatoin Awareness (NlaSvc)
KtmRm for Distributed Transaction Coordinator )(KtmRm)
DNS Client (Dnscache)
Cryptographic Services (SryptSvc)

I hesitate to mention anything in particular that might be associated with
this, as I have no idea what is going on, and would rather not prejudice your
diagnoses. Still, here are some other details, which may or may not be red
herrings -- mainly I'm curious whether something needs re-setting.

1. I recently tried to establish an Ad Hoc wi-fi connection with a friend's
laptop, which didn't work. (Just curious if there's a reset I haven't done.)

2. I succeeded in connecting via Ethernet. Sharing is now off, although
could it be that the user's login is still active on this machine?

3. I wonder whether the ThinkPad WiFi networking utility (Access
Connections) is in conflict with Windows Networking or the Intel networking
drivers.

4. I have two "Unknown devices" that appear as soon as I flip on the
wireless switch, and I'm at a loss as to what they may be, and whether
Windows is querying the MS domain about them. This shouldn't be a problm, as
I had no problem getting internet access some while before.

5. I have uninstalled some 3rd party programs I thought might be
contributing to the problem, but the problem remains.

6. I have Symantec Antivirus Corporate Edition x64 installed, and the
LiveUpdate appears to be keeping the definitions up to date, though I am
unsure what process / service it is running under. This morning, however,
when I manually asked LiveUpdate to run (launched it to see what showed up
under Task Manager, but couldn't figure it out), I got a weird warning about
my HOSTS file, telling me that "one or more entries for Symantec LiveUpdate
servers exist in your Windows hosts files. Generally, Symantec LiveUpdate
server entries should not appear in your Windows hosts files." (It named
om.symantec.com and oms.symantec.com.) I do have Hostsman installed, which
has a huge HOSTS file, but have never manually launched LiveUpdate, or seen
this notice before. Again, this could be a red herring.

Thanks for your help.

a.k.a.

 

[a.k.a.]

Well, on the Symantec HOSTS warning, it appears to be a false positive by
Symantec. Those are entries that should be blocked. Not sure why Symantec
chose that particular moment to warn me, but whatever.

On another forum, I was told that turning off Microsoft Update might do the
trick. (They suggest going to Windows Update through IE, and changing the
settings to turn off MU, and downloading the latest version.)
http://forums.devshed.com/windows-help-34/svchost-exe-occupying-more-memory-598023.html

So far, I have seen no return of the svchost after doing so about 15 minutes
ago. I'll reboot and see if it happens again. I'm not convinced this is the
solution, so any advice still VERY much appreciated.

 

[a.k.a.]

I rebooted, and the svchost problem returned. All of the above services are
running under PID 1276. (For the life of me, I can't get Process Monitor to
sort by PID, so I'm having trouble tracking down specifics. I saw one entry
related to a HOSTS file, so perhaps there is a conflict of some kind. Still
shooting in the dark.)

 

[a.k.a.]

I also discovered, BTW, that file sharing seems to be set automatically to
ON when connecting to a WiFi network. (I checked the current network status
and found it was set to on, though I had no intention of doing so.) How can I
undo that setting?

Even after turning off file sharing manually for my current WiFi network, it
doesn't stop the svchost from running.

 

[Gordon]

I also discovered,

PLEASE do NOT keep changing the subject line.