Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

Lately I've been having trouble browsing the internet on my computer, where it seems to take a really long time to connect to websites, or it just seems that the internet is just not responding at all. I opened up the Win 7 Resource monitor and notice that there was a lot of network activity to locations I didn't recognize, and what look like personal ISP accounts. For example here are a few of the hosts I was connected too.

187-6-116-186.bsaco701.dsl.brasiltelecom.net.br
static-71-168-65-6.cncdnh.fast04.myfairpoint.net
juv34-4-82-238-88-63.fbx.proxad.net
d173-180-118-189.bchsia.telus.net

I narrowed down those connections as being associated with svchost.exe (netsvcs), and specifically the "IP Helper" (iphlpsvc) service. I found if I stop this services the connections go away, but if I start it again they come back. I also notice that when I start this service svchost.exe (netsvcs) opens a listening UDP port.

I use AVG Virus scanner, but it didn't find anything. I also tried creating a Hijackthis log and using various analyzers but nothing came up.

share|improve this question
If you disable the IP Helper service, does delay in accessing web sites do away? What browser are you using? – HeatfanJohn Sep 2 '12 at 0:25
All I can add is I can confirm this problem, when this service is on it listens on UDP 10.1.1.7:55137 : iphlpsvc and suspicious UDP traffic is exchanged (not just received). After restarting this service the problem is gone ?!? – too 13 hours ago

2 Answers

up vote 1 down vote

According to BleepingComputer.com iphlpsvc.dll is for:

Windows service that provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer.

On my Windows 7 system the DLL had these properties:

enter image description here

The file description says Service that offers IPv6 connectivity over an IPv4 network.

If you don't need any IPv6 connectivity, I'd say to just disable that service.

share|improve this answer
1  
+1 My guess here would be that something is causing problems with IPv6 Internet connection and the computer is waiting for connection attempts to timeout before trying to use IPv4. – AndrejaKo Sep 1 '12 at 23:20
Sure I can leave it disabled. But my issue is more that if it's enabled my computer starts trying to connect to other computers in Brazil, china, Russia etc.. Also it seems that IP Helper is required for a Home Group network which I use. – aireq Sep 2 '12 at 3:32
What file version is your iphlpsvc.dll? Also what is its MD5 hash? – HeatfanJohn Sep 2 '12 at 12:50
MD5: 4d65a07b795d6674312f879d09aa7663, Version: 6.1.7601.17514 – aireq Sep 4 '12 at 2:16
4D65A07B795D6674312F879D09AA7663 iphlpsvc.dll is the same on my Windows 7 SP1 machine – HeatfanJohn Sep 15 '12 at 18:08
up vote 0 down vote

avg is not enough. since you are seeing traffic to user isp accounts its most likely to be a virus/malware that virus programs cant/wont pick up. use spybotSD and malwarebytes to scan your system for an infection. I would be suprised if neither pick something up. both are free.

Turning ipv6 off can help with this kind of issue some what but that would not explain the connections to other isp users. I have seen though if youtube videos take for ever to load turning ipv6 off usually solves that so it may be a combination.

share|improve this answer
Spybot found nothing serious. Malwarebytes found Rouge.FakeMSE, Stolen.Data, Trojan.Downloader, and Malware.Trace .. I removed these and restarted. However, when I start IP Helper I still see the connections to user isp accounts. – aireq Sep 4 '12 at 7:56
in cases like that I would reimage the pc. There are viruses that eat up to much time and being good enough to evade that much I would be worried more about my data being leaked then the time spent trying to reinstall/configure software. I do have to note though I have no adversion to reimaging my pc's and don't expect a windows install to last a year. – Kendrick Sep 5 '12 at 0:50
if you make a recovery cd that has several known good antivirus programs on it that are up to date you may be able to catch whats causing the issue by booting from another source. – Kendrick Sep 5 '12 at 0:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.