Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lately I've been having trouble browsing the internet on my computer, where it seems to take a really long time to connect to websites, or it just seems that the internet is just not responding at all. I opened up the Win 7 Resource monitor and notice that there was a lot of network activity to locations I didn't recognize, and what look like personal ISP accounts. For example here are a few of the hosts I was connected too.

I narrowed down those connections as being associated with svchost.exe (netsvcs), and specifically the "IP Helper" (iphlpsvc) service. I found if I stop this services the connections go away, but if I start it again they come back. I also notice that when I start this service svchost.exe (netsvcs) opens a listening UDP port.

I use AVG Virus scanner, but it didn't find anything. I also tried creating a Hijackthis log and using various analyzers but nothing came up.

share|improve this question
If you disable the IP Helper service, does delay in accessing web sites do away? What browser are you using? – HeatfanJohn Sep 2 '12 at 0:25
All I can add is I can confirm this problem, when this service is on it listens on UDP : iphlpsvc and suspicious UDP traffic is exchanged (not just received). After restarting this service the problem is gone ?!? – too May 19 '13 at 19:42

According to iphlpsvc.dll is for:

Windows service that provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer.

On my Windows 7 system the DLL had these properties:

enter image description here

The file description says Service that offers IPv6 connectivity over an IPv4 network.

If you don't need any IPv6 connectivity, I'd say to just disable that service.

share|improve this answer
+1 My guess here would be that something is causing problems with IPv6 Internet connection and the computer is waiting for connection attempts to timeout before trying to use IPv4. – AndrejaKo Sep 1 '12 at 23:20
Sure I can leave it disabled. But my issue is more that if it's enabled my computer starts trying to connect to other computers in Brazil, china, Russia etc.. Also it seems that IP Helper is required for a Home Group network which I use. – aireq Sep 2 '12 at 3:32
What file version is your iphlpsvc.dll? Also what is its MD5 hash? – HeatfanJohn Sep 2 '12 at 12:50
MD5: 4d65a07b795d6674312f879d09aa7663, Version: 6.1.7601.17514 – aireq Sep 4 '12 at 2:16
4D65A07B795D6674312F879D09AA7663 iphlpsvc.dll is the same on my Windows 7 SP1 machine – HeatfanJohn Sep 15 '12 at 18:08

If you're still having issues, I'd also recommend downloading TDSSKiller. It's specifically designed to scan for rootkits that most more general purpose anti-malware software misses.

I would also recommend switching to a different main security program as I used AVG up until August when I got a bad infection and AVG did nothing for me. Kapersky, and Norton are both good options, and I'd also recommend Malwarebytes as well. I use the paid for Premium version which also comes with Anti-Exploit which has combined with Norton to do wonders for keeping my computer safe.

This is critical to me as I work in web development and that can put me on front of any risks if a site I'm working on gets infected/hacked. That's what led to my own infection problems was a client's website getting hacked and infecting my own computer.

share|improve this answer

avg is not enough. since you are seeing traffic to user isp accounts its most likely to be a virus/malware that virus programs cant/wont pick up. use spybotSD and malwarebytes to scan your system for an infection. I would be suprised if neither pick something up. both are free.

Turning ipv6 off can help with this kind of issue some what but that would not explain the connections to other isp users. I have seen though if youtube videos take for ever to load turning ipv6 off usually solves that so it may be a combination.

share|improve this answer
Spybot found nothing serious. Malwarebytes found Rouge.FakeMSE, Stolen.Data, Trojan.Downloader, and Malware.Trace .. I removed these and restarted. However, when I start IP Helper I still see the connections to user isp accounts. – aireq Sep 4 '12 at 7:56
in cases like that I would reimage the pc. There are viruses that eat up to much time and being good enough to evade that much I would be worried more about my data being leaked then the time spent trying to reinstall/configure software. I do have to note though I have no adversion to reimaging my pc's and don't expect a windows install to last a year. – Kendrick Sep 5 '12 at 0:50
if you make a recovery cd that has several known good antivirus programs on it that are up to date you may be able to catch whats causing the issue by booting from another source. – Kendrick Sep 5 '12 at 0:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .