svchost.exe keeps polling the router

[Richard34]

Hi Folks, I’m hoping that someone may be able to point me in the right direction on this one.

Details are:
Windows XP, Service pack 3
Comodo firewall
Netgear DG934G router
A desktop PC that is connected directly to the router and all other PC's are laptops connected via wireless to the same router.

On the desk PC, svchost.exe (PID1500) is continuously communicating with the router from 192.168.02.01 (port number used is cyclic and moves up by a count of six each time it communicates) to 192.168.02.01: 5000 (www.routerlogin.com). The laptops which are connected via the same router do not exhibit the same problem. A screenshot showing the problem is attached.

Other actions carried out:
a. Checked for viruses - ok
b. Powered down / up router and PC.
c. Checked local services. All seem to be ok - note: if the DHCP client is stopped the problem goes away, but connection to the internet is lost.

Thanks for any help received.

[joss]

Hi Richard
Can you get to a command prompt, then type in:

tasklist /svc

This should show you which services are running under each instance of svchost.exe (and it will show PID as well); This way, you should be able to determine what is running under svchost.exe 1500

[Richard34]

Hi Joss, thanks for following up the problem.

With regards to the services running under svchost.exe, I've inhibited the majority and narrowed the services running to the following:

a. DHCP: DHCP client. My instinct is that it may be this that is causing the problem.
b. RasMan: Remote access control manager - could not stop or disable this service.
c. srservice: System restore service - did not want to disable this service
d. TapiSrv: Telephony - could not stop or inhibit this service, due to the inability to stop RasMan.
e. winmgmt: windows management instrumentation. Did not want to inhibit this service.

As previously mentioned the constant communications is only between the desk top PC and the router. Disconnecting the cable from the wall telephone point does not affect the problem.

Some additional information is attached.
a. A list of the services running under svchost.exe PID 1500
b. A screenshot from 'tcpview' which shows svchost.exe PID 1500 sending a SYN (sync?) signal, when the firewall is blocked.

Hope the additional information can prove useful.

Thanks, Richard

[Donaldson2121]

mite ba silly question but you're not using and router stats tools or bandwidth monitoring tools are you??

[Richard34]

Hi Donaldson2121,

I'm not using any network monitoring tools. I've checked 3rd party programs that were running and shut them down (killed in ProcExp) to see if it would make a difference - unfortunately nothin. I've attached a list of what was left running, basically XP processes, virus checker & firewall.

Thanks.

[Richard34]

Update to the problem:

I unticked the turn UPnP on box on the router PNP page. This stopped the constant comm's between the PC and the router. By default the UpnP box is ticked, so I do not know why it has only been recently that the traffic has been showing up on the Comodo Firewall icon on the system tray.

I had a quick look at the Windows PNP service, but it appears that this cannot be stopped - maybe due to the several dependencies it has.

So, unless anyone comes back stating that I should not untick the UPnP box on the router I will leave it unticked.

Many thanks.

[UKCougar]

Originally Posted by Richard34

I had a quick look at the Windows PNP service, but it appears that this cannot be stopped - maybe due to the several dependencies it has.
Many thanks.

Try disabling the SSDP Discovery Service instead - this is the part of uPnP which is most likely to be doing the chatting.