Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Why does Win7 frequently try to access Akamai servers through svchost?

28 Jan 2017   #21
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

Results of Microsoft Message Analyzer monitoring NlaSvc attempting to contact Akamai servers via svchost
Code:
MessageNumber          Timestamp			    TimeElapsed 	 Source 				    Destination 			       Module   		     Summary    																																																			   ProcessId          Message

30      	       2017-01-26T12:40:30.1664213          --  		 --     				    --  				       Windows_Kernel_Trace          Process_TypeGroup1{UniqueProcessKey=EtwPointer{pointerValue=18446738026544641808},ProcessId=1424,ParentId=528,SessionId=0,ExitStatus=259,DirectoryTableBase=EtwPointer{pointerValue=7147724800},UserSID_blob=binary[16,19,34,4,160,248,255,255,0,0,0,0,128,248,255,255],UserSID=S-1-5-20 NetworkService -- Network Service account.,ImageFileName=svchost.exe,CommandLine=C:\Windows\System32\svchost.exe -k NetworkService}          1424 	      .7...................*.......".*.................svchost.exe.C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.s.v.c.h.o.s.t...e.x.e. .-.k. .N.e.t.w.o.r.k.S.e.r.v.i.c.e...
30      	       2017-01-26T12:40:30.1664213          --  		 --     				    --  				       Etw      		     {3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}, EventID: 0, ProcessID: 2156, ThreadID: 2160, Size: 204     																																								   2156 	      ...@...p...l....n.x.Шo=....O׺|................c............................7...................*.......".*.................svchost.exe.C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.s.v.c.h.o.s.t...e.x.e. .-.k. .N.e.t.w.o.r.k.S.e.r.v.i.c.e...

255     	       2017-01-26T12:41:25.8530608          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       TCP      		     Flags: ......S., SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411726965 - 2411726966, Ack: 0, Win: 8192(negotiating scale factor: 8)  																																		   1424 	      ..P..u...... ...............
255     	       2017-01-26T12:41:25.8530608          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       IPv4     		     Next Protocol: TCP, Packet ID: 66, Total Length: 52																																														   1424 	      E..4.B@......hc...P..u...... ...............
255     	       2017-01-26T12:41:25.8530608          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		     Type: Internet IP (IPv4)   																																																	   1424 	      T*P .0gv3..E..4.B@......hc...P..u...... ...............
255     	       2017-01-26T12:41:25.8530608          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 66       																																													   1424 	      ........B...T*P .0gv3..E..4.B@......hc...P..u...... ...............
255     	       2017-01-26T12:41:25.8530608          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1068, Size: 158  																																								   1424 	      ....@...,.......0...x..[...|F.G0.v............................................N.........B...T*P .0gv3..E..4.B@......hc...P..u...... ...............

258     	       2017-01-26T12:41:25.8881029          0.0415502   	 192.168.0.123  			    www.msftncsi.com    		       HTTP     		     Operation, Status: OK (200), GET /ncsi.txt, Version: HTTP/1.1      																																												   1424 	      --
258     	       2017-01-26T12:41:25.8881029          0.0406232   	 192.168.0.123  			    www.msftncsi.com    		       HTTP     		     Request, GET /ncsi.txt, Version: HTTP/1.1  																																															   1424 	      GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258     	       2017-01-26T12:41:25.8881029          0.0000059   	 192.168.0.123  			    a1961.g2.akamai.net 		       TCP      		     Flags: ...AP..., SrcPort: 49158, DstPort: HTTP(80), Length: 97, Seq Range: 2411726966 - 2411727063, Ack: 3559500323, Win: 65536(scale factor: 8)   																																		   1424 	      ..P..v)#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258     	       2017-01-26T12:41:25.8881029          0.0000059   	 192.168.0.123  			    a1961.g2.akamai.net 		       IPv4     		     Next Protocol: TCP, Packet ID: 68, Total Length: 137       																																													   1424 	      E....D@......hc...P..v)#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258     	       2017-01-26T12:41:25.8881029          0.0000059   	 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		     Type: Internet IP (IPv4)   																																																	   1424 	      T*P .0gv3..E....D@......hc...P..v)#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258     	       2017-01-26T12:41:25.8881029          0.0000059   	 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 151      																																													   1424 	      ............T*P .0gv3..E....D@......hc...P..v)#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258     	       2017-01-26T12:41:25.8881029          0.0000059   	 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1068, Size: 187  																																								   1424 	      ditto
258     	       2017-01-26T12:41:25.8881029          --  		 --     				    --  				       EtwEvent 		     EventId: 1001, GroupId: 5590624, Length: 12																																															   1424 	      .`NU.................
258     	       2017-01-26T12:41:25.8881029          --  		 --     				    --  				       Etw      		     [Fragment: Start] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 102																																						   1424 	      f...@...,............x..[...|F.G0.v..........@.....................................`NU.................
259     	       2017-01-26T12:41:25.8881063          --  		 --     				    --  				       EtwEvent 		     EventId: 1001, GroupId: 5590624, Length: 54																																															   1424 	      .`NU.6...T*P .0gv3..E....D@......hc...P..v)#P....P..
259     	       2017-01-26T12:41:25.8881063          --  		 --     				    --  				       Etw      		     [Fragment: Middle] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 144       																																					   1424 	      ....@...,.......'....x..[...|F.G0.v.............................................@..`NU.6...T*P .0gv3..E....D@......hc...P..v)#P....P..
260     	       2017-01-26T12:41:25.8881088          --  		 --     				    --  				       EtwEvent 		     EventId: 1001, GroupId: 5590624, Length: 97																																															   1424 	      .`NU.a...GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
260     	       2017-01-26T12:41:25.8881088          --  		 --     				    --  				       Etw      		     [Fragment: End] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 187  																																						   1424 	      ...@...,.......@....x..[...|F.G0.v.............................................k..`NU.a...GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....

261     	       2017-01-26T12:41:25.9287261          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       TCP      		     Flags: ...A...., SrcPort: HTTP(80), DstPort: 49158, Length: 0, Seq Range: 3559500323 - 3559500323, Ack: 2411727063, Win: 29216(scale factor: 5)    																																		   0    	      .P.)#..P...3..
261     	       2017-01-26T12:41:25.9287261          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       IPv4     		     Next Protocol: TCP, Packet ID: 23132, Total Length: 40     																																													   0    	      E..(Z\@.7..hc...P.)#..P...3....lv
261     	       2017-01-26T12:41:25.9287261          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		     Type: Internet IP (IPv4)   																																																	   0    	      .0gv3T*P ..E..(Z\@.7..hc...P.)#..P...3....lv
261     	       2017-01-26T12:41:25.9287261          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 60       																																													   0    	      ........<....0gv3T*P ..E..(Z\@.7..hc...P.)#..P...3....lv
261     	       2017-01-26T12:41:25.9287261          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 152																																									   0    	      ....@...........>...x..[...|F.G0.v...........................................H.........<....0gv3T*P ..E..(Z\@.7..hc...P.)#..P...3....lv

262     	       2017-01-26T12:41:25.9296531          --  		 www.msftncsi.com       		    192.168.0.123       		       HTTP     		     Response, Status: OK (200), Version: HTTP/1.1      																																														   0    	      HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262     	       2017-01-26T12:41:25.9296531          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       TCP      		     Flags: ...AP..., SrcPort: HTTP(80), DstPort: 49158, Length: 179, Seq Range: 3559500323 - 3559500502, Ack: 2411727063, Win: 29216(scale factor: 5)  																																		   0    	      .P.)#..P.....HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262     	       2017-01-26T12:41:25.9296531          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       IPv4     		     Next Protocol: TCP, Packet ID: 23133, Total Length: 219    																																													   0    	      E..Z]@.7.hc...P.)#..P.....HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262     	       2017-01-26T12:41:25.9296531          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		     Type: Internet IP (IPv4)   																																																	   0    	      .0gv3T*P ..E..Z]@.7.hc...P.)#..P.....HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262     	       2017-01-26T12:41:25.9296531          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 233      																																													   0    	      ............0gv3T*P ..E..Z]@.7.hc...P.)#..P.....HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262     	       2017-01-26T12:41:25.9296531          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 325																																									   0    	      E...@............c...x..[...|F.G0.v........................................................0gv3T*P ..E..Z]@.7.hc...P.)#..P.....HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI

263     	       2017-01-26T12:41:25.9298951          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       TCP      		     Flags: ...A...F, SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411727063 - 2411727064, Ack: 3559500502, Win: 65280(scale factor: 8)    																																		   1424 	      ..P..)P.....
263     	       2017-01-26T12:41:25.9298951          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       IPv4     		     Next Protocol: TCP, Packet ID: 69, Total Length: 40																																														   1424 	      E..(.E@......hc...P..)P.....
263     	       2017-01-26T12:41:25.9298951          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		     Type: Internet IP (IPv4)   																																																	   1424 	      T*P .0gv3..E..(.E@......hc...P..)P.....
263     	       2017-01-26T12:41:25.9298951          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 54       																																													   1424 	      ........6...T*P .0gv3..E..(.E@......hc...P..)P.....
263     	       2017-01-26T12:41:25.9298951          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 146  																																								   1424 	      ....@............l...x..[...|F.G0.v............................................B.........6...T*P .0gv3..E..(.E@......hc...P..)P.....

264     	       2017-01-26T12:41:25.9299762          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       TCP      		     Flags: ...A...F, SrcPort: HTTP(80), DstPort: 49158, Length: 0, Seq Range: 3559500502 - 3559500503, Ack: 2411727063, Win: 29216(scale factor: 5)    																																		   1424 	      .P.)..P......
264     	       2017-01-26T12:41:25.9299762          --  		 a1961.g2.akamai.net    		    192.168.0.123       		       IPv4     		     Next Protocol: TCP, Packet ID: 23134, Total Length: 40     																																													   1424 	      E..(Z^@.7..hc...P.)..P........D. ]
264     	       2017-01-26T12:41:25.9299762          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		     Type: Internet IP (IPv4)   																																																	   1424 	      .0gv3T*P ..E..(Z^@.7..hc...P.)..P........D. ]
264     	       2017-01-26T12:41:25.9299762          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 60       																																													   1424 	      ........<....0gv3T*P ..E..(Z^@.7..hc...P.)..P........D. ]
264     	       2017-01-26T12:41:25.9299762          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 152  																																								   1424 	      ....@...........o...x..[...|F.G0.v............................................H.........<....0gv3T*P ..E..(Z^@.7..hc...P.)..P........D. ]

265     	       2017-01-26T12:41:25.9300266          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       TCP      		     Flags: ...A...., SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411727064 - 2411727064, Ack: 3559500503, Win: 255       																																				   1424 	      ..P..)P.....
265     	       2017-01-26T12:41:25.9300266          --  		 192.168.0.123  			    a1961.g2.akamai.net 		       IPv4     		     Next Protocol: TCP, Packet ID: 70, Total Length: 40																																														   1424 	      E..(.F@......hc...P..)P.....
265     	       2017-01-26T12:41:25.9300266          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		     Type: Internet IP (IPv4)   																																																	   1424 	      T*P .0gv3..E..(.F@......hc...P..)P.....
265     	       2017-01-26T12:41:25.9300266          --  		 --     				    --  				       PefNdisProvider  	     MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 54       																																													   1424 	      ........6...T*P .0gv3..E..(.F@......hc...P..)P.....
265     	       2017-01-26T12:41:25.9300266          --  		 --     				    --  				       Etw      		     {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 146  																																								   1424 	      ....@...........q...x..[...|F.G0.v............................................B.........6...T*P .0gv3..E..(.F@......hc...P..)P.....



My System SpecsSystem Spec
.
Reply

 Why does Win7 frequently try to access Akamai servers through svchost?




Thread Tools




Similar help and support threads
Thread Forum
svchost (netsvcs) download from Akamai - What is initiating?
Platform: Windows 7 Home Premium 64 bit, ASUS K52F laptop Note: I have posted this on 2 other forums & did not receive a solution so I am posting it here. Hope that is okay. I have observed extensive downloads (using the NetMeter gadget) averaging 400-600kbps for up to 10 minutes from Akamai....
Network & Sharing
svchost.exe using almost all available random access memory after boot
Hello, I will start by describing the problem: Whenever I start up this laptop, usually after opening Firefox I find that it keeps freezing by even hovering the mouse cursor over links, or UI elements. It turns out that the problem is an "svchost.exe" process that takes up to 800MB of my ram (out...
General Discussion
Digital River Win7 ISO servers taken down again
I heard about this just now in Clean Reinstall Windows 7 thread: As Jann from Heidoc reports in Windows 7 Direct Download Links as of now only English and Spanish are still up, links being replaced by a new MS Recovery Center that provides ISO's for a retail Product Key. I'd also...
General Discussion
Problem - Network Access - Can't map drives, can't see any servers
I've got a ThinkPad x220 here and randomly started having issues accessing the network (mapped drives and printers). The computer can still access our Intranet (Sharepoint) and Exchange Server (Outlook says connected and we can send/receive) I tried disconnecting the drives and reconnecting,...
Network & Sharing
2 COD 4 Servers for those with Win7 64
I have 2 COD4 Server located @ 208.43.15.45:28930(-=IT=-) and the other at 208.43.23.172:28930(ROC-Realm Of Chaos) These are Linux (cent OS) servers, low ping :cool: I modified the pb_sv_Restriction to read like this: pb_sv_Restrictions 0 So that Win7 64 bit users can get on with...
Gaming


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 12:53.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App