Constant activity on Local Area Connection

[Bud H]

I performed a clean install of Windows XP Professional SP2 performed on Dell
Dimension 4700 desktop computer, attached to a Linksys WRT54GS
router/gateway (only wired computer in Workgroup). The Linksys router is
attached to a cable modem.

First, all drivers were installed except NIC ethernet port, then Webroot
Spysweeper and Zone Alarm Pro were installed, then finally ethernet driver
installed to enable internet connection. Windows, Spysweeper, and Zone
Alarm Pro all updated with critical updates..

PROBLEM -- I am now noticing constant activity showing in the Local Area
Connection and the Zone Alarm icon.

I also have the Internet Connection icon showing (Internet Gateway).
Checking the status of Internet Gateway, it shows constant sent and received
information in the Local Area Connection, but little or nothing in the
Internet Gateway sent or received numbers. (And after unplugging the
ethernet cable between the cable modem and router, this unexplained constant
activity continued at the Local Area Connection.)

By stopping a specific svchost.exe, this problem goes away. The process in
question seems to be from

C:\\WINDOWS\System32\svchost.exe -k netsvcs

but I know no details about this process.

Any idea what started causing this? And how to stop it?

Thanks in advance,

Bud H

 

[Bud H]

I performed a clean install of Windows XP Professional SP2 performed on
Dell Dimension 4700 desktop computer, attached to a Linksys WRT54GS
router/gateway (only wired computer in Workgroup). The Linksys router is
attached to a cable modem.

First, all drivers were installed except NIC ethernet port, then Webroot
Spysweeper and Zone Alarm Pro were installed, then finally ethernet driver
installed to enable internet connection. Windows, Spysweeper, and Zone
Alarm Pro all updated with critical updates..

PROBLEM -- I am now noticing constant activity showing in the Local Area
Connection and the Zone Alarm icon.

I also have the Internet Connection icon showing (Internet Gateway).
Checking the status of Internet Gateway, it shows constant sent and
received information in the Local Area Connection, but little or nothing
in the Internet Gateway sent or received numbers. (And after unplugging
the ethernet cable between the cable modem and router, this unexplained
constant activity continued at the Local Area Connection.)

By stopping a specific svchost.exe, this problem goes away. The process
in question seems to be from

C:\\WINDOWS\System32\svchost.exe -k netsvcs

but I know no details about this process.

Any idea what started causing this? And how to stop it?

Thanks in advance,

Bud H

One additional piece of information.....

When I disabled the "internet connection" at its icon, and left the "local
area connection" icon alone (and enabled), the high activity at the local
area connection (and Zone Alarm) stopped.

Puzzling..... since when I previously had unplugged an ethernet cable at the
cable modem, the constant activity at the Local Area Connection and Zone
Alarm icon had continued!

Bud H

 

[Wesley Vogel]

C:\WINDOWS\System32\svchost.exe -k netsvcs starts half of the services in
XP.

See this...
A description of Svchost.exe in Windows XP
http://support.microsoft.com/kb/314056

....and use tasklist /svc

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Bud H]

Forgot to mention....

After completing all of the Windows XP updates, I disabled Windows/Microsoft
Update to ensure that wasn't the culprit. It wasn't. Sorry, I meant to
mention that in the original post.

I also selectively stopped several administrative services that were
stoppable to see if I could stop the activity running through Local Area
Connection, but no smoking gun found.

 

[Bud H]

I don't know if I found THE solution, but I found A solution.

I disabled the uPnP function on the WRT54GS router/gateway. That stopped
the constant activity (sent and received packets) on the Local Area
Connection.

Bud H