SVCHOST disconnects Modem

[Chris Bullivant]

Hello All,

I'm running XP PRO using an internal dial-up modem.

A bit before Xmas I got a new flatmate who was into Net Chat.
2 things happened together:
1. I started getting popups when I never had before
2. The modem kept dropping out after only 5 or 10 minutes

#1 I fixed by removing MSN messenger
But #2 has just been an on-going drama. My ISP provider support has
been great. They have suggested things which gave a short-term
improvement but then it started dropping out again.

I've been doing some tests and I noticed that there is an SVCHOST
session that goes up in CPU just as the modem drops-out. Using
tasklist I got this output:
svchost.exe 996 RpcSs
svchost.exe 1040 AudioSrv, BITS, Browser, CryptSvc,
Dhcp,
dmserver, ERSvc, EventSystem,
FastUserSwitchingCompatibility,
helpsvc,
lanmanserver, lanmanworkstation,
Netman,
Nla, RasMan, Schedule, seclogon,
SENS,
SharedAccess, ShellHWDetection,
srservice,
TapiSrv, TermService, Themes, TrkWks,
uploadmgr, W32Time, winmgmt,
wuauserv, WZCSVC
svchost.exe 1136 Dnscache
svchost.exe 1160 LmHosts, RemoteRegistry, SSDPSRV,
WebClient

The one with PID 1040 is the one that's causing the drop-out. I tried
to reset the lanmanserver parameter but this has had no effect.

If I connect and then do nothing It drops out after 1:06 minutes (did
this 3 times tonight). If I use a browser or e-mail it stays longer
but still drops-out if I walk away for a few minutes. Something is
telling it to disconnect after a short period of inactivity.

Any suggestions?

Thanks in advance,
Chris Bullivant

 

[José Gallardo]

Have you ruled out the virus? Read this:
http://windowsxp.mvps.org/svchost.htm

 

[Gerry Cornell]

Chris

How far have gone down the line of checking with anti-virus and
anti-spyware software?

What is the start setting in Services for uploadmgr?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Gerry Cornell]

Chris

I would try HiJackThis and post the log to a forum for advice.

http://www.merijn.org/downloads.html

http://aumha.net/

However, they do expect you to take steps to clean your computer
beforehand. You have gone someway towards this but you could:

Run Disk Cleanup to remove Temporary Internet Files.

Run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Some free stand-alone AV tools:

http://vil.nai.com/vil/stinger/
http://www.emsisoft.com/en/
http://free.grisoft.com/doc/8/lng/us/tpl/v5/nid/3001#3001
http://www.f-secure.com/download-purchase/tools.shtml

Spybot Search & Destroy
http://www.safer-networking.org/en/download/index.html

All these programmes, except Disk CleanUp are best run in safe mode. Do
it in stages and remove System Restore Points using the option in Disk
CleanUp, More Options after each occasion you remove a nasty.

These are time consuming procedures. Unfortunately no anti-virus or
anti-spyware programme detects every problem so you need to run a number
to get to a clean computer. Also you will mostly likely think you have
got run of a nasty only for it to reappear.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~