[Tarq57]

I'm here thanks to a suggestion (thanks to those involved) received from a member at another forum, where this problem was also posted.
I use WMP11. For a time, now, maybe 2 or 3 weeks ago I first noticed it, when closing it, the GUI and any outward manifestation of its' running (eg: sound, if it was playing an audio file) disappears promptly, but the service continues for about 10 or 11 seconds in taskmanager.
First realised this was happening when I closed it, then immediately commanded it to open another file, by selecting that file, and having WMP utterly fail to respond. Wait 10 seconds and try again, good as gold.
There is a debug report log available if required.. one of the early entries in the log concerns something about an NT variable not correctly set, so it seems some things that could perhaps have been examined, were not.
I'm hoping to pick up on the help received where it was left off, if that's OK.
Just let me know what information is needed.
Thanks,
Tarq.

[Tarun]

Hey Tarq, let's try to resolve this problem.

Here's the code to run, since I know you've followed the wiki to get a dump of the process.

cscript adplus.vbs -hang -pn wmplayer.exe -quiet -o c:\adplus

[Tarq57]

Hi there. Ran the cmd propt as directed, on the first attempt it came back with "Error, the following requested processes are not executing: WMPLAYER.EXE, and that was the end of the report.
Tried it again, but this time opened the media player before activating the prompt.
The command prompt appears to have finisished doing what it was doing, but isn't closing.
In the "ADPlus" folder for this current attempt are several documents:
adplus report.txt
PID_3484_WMPLAYER.EXE (date/time) text document
Process List.txt
PID_3484_WMPLAYER.EXE DMP (76,884kb) (!)
and a sub folder titled CBD scripts, containing a WMPLAYER.EXE CFG.
Which of these would you like?
Does it matter the cmd hasn't closed, or that I had to open WMP to get the thing to work? (Uncertainly wondering if I've done something wrong...)

[Tarun]

Would need the *.dmp file.

If the file is above the attachment limit, you can upload it to a free file hosting website such as My Free File Hosting. You can zip, rar, or even better, 7z the dump to compress it. IZArc can compress to 7z quite well.

[Tarq57]

Right. Let's see if it will upload here.
Darn. Seems it might not..
[EDIT] Uploading to file hosting as I type. Unless I'm decimally mistaken, the file size is 76Megs. Surely that aint right?
[Edit2] well, here it is75.08mB

[cluberti]

Tarq57, on Jun 19 2008, 03:28 PM, said:

Right. Let's see if it will upload here.
Darn. Seems it might not..
[EDIT] Uploading to file hosting as I type. Unless I'm decimally mistaken, the file size is 76Megs. Surely that aint right?
[Edit2] well, here it is75.08mB

//Looks like Windows Media Player made an RPC call to something outside of the process via ole32:
0:012> kb
ChildEBP RetAddr  Args to Child			  
0286ed68 7c90dacc 77e7cac1 000000c0 000cbee8 ntdll!KiFastSystemCallRet
0286ed6c 77e7cac1 000000c0 000cbee8 000cbee8 ntdll!ZwRequestWaitReplyPort+0xc
0286edb8 77e7a33e 0237f8f0 0286ede0 776016bb rpcrt4!LRPC_CCALL::SendReceive+0x228
0286edc4 776016bb 02353388 000feabc 0286eec4 rpcrt4!I_RpcSendReceive+0x24
0286ede0 776011a6 00000000 00000000 00000000 ole32!ThreadSendReceive+0xf5
0286edfc 7760108a 0286eec4 0286efd4 000feabc ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x13d
0286eedc 7752ce1a 000feabc 0286efd4 0286efc4 ole32!CRpcChannelBuffer::SendReceive2+0xc8
0286ef48 7752cdb2 000feabc 0286efd4 0286efc4 ole32!CAptRpcChnl::SendReceive+0xab
0286ef9c 77ef4db5 000feabc 0286efd4 0286efc4 ole32!CCtxComChnl::SendReceive+0x113
0286efb8 77ef4ead 0012f7bc 0286f000 0600015b rpcrt4!NdrProxySendReceive+0x43
0286f394 77ef4e42 774e6228 774e94fc 0286f3cc rpcrt4!NdrClientCall2+0x1fa
0286f3b4 77e8a83b 00000014 00000004 0286f428 rpcrt4!ObjectStublessClient+0x8b
0286f3c4 7751eaed 0012f7bc 00000000 0286f86c rpcrt4!ObjectStubless+0xf
0286f428 7751ebba 0286f86c 0286fdb8 002d0032 ole32!CRpcResolver::CreateInstance+0x13d
0286f674 775110b3 77607114 00000000 00000000 ole32!CClientContextActivator::CreateInstance+0xfa
0286f6b4 77510ef8 0286f86c 00000000 0286fdb8 ole32!ActivationPropertiesIn::DelegateCreateInstance+0xf7
0286fe64 77500575 12aa121c 00000000 00000017 ole32!ICoCreateInstanceEx+0x3c9
0286fe8c 77500544 12aa121c 00000000 00000017 ole32!CComActivator::DoCreateInstance+0x28
0286feb0 775005b2 12aa121c 00000000 00000017 ole32!CoCreateInstanceEx+0x1e
0286fee0 12aa10c5 12aa121c 00000000 00000017 ole32!CoCreateInstance+0x37
0286ff34 12ac73f7 00000002 012b69e0 012b69e0 wmp!CRenderer::RegisterDevice+0x28
0286ffa8 12ac7315 0000006a 0286ffec 7c80b713 wmp!CWMStoreThreadManager::ThreadMain+0x90
0286ffb4 7c80b713 012b69e0 00000002 0000006a wmp!CWMStoreThreadManager::_ThreadMain+0x27
0286ffec 00000000 12ac72ef 012b69e0 00000000 kernel32!BaseThreadStart+0x37

// looking deeper, it looks like it's actually going outside of the whole machine and onto the network:
0:012> .frame 12
12 0286feb0 775005b2 ole32!CoCreateInstanceEx+0x1e

0:012> dd 12aa121c 
12aa121c  204810b9 11d473b2 b00042bf 568b11d0
12aa122c  8b55ff8b 0875ffec 5050c033 68505050
12aa123c  1295271c aa125068 5522e812 c25dffec
12aa124c  90900004 00500055 0050006e 00440049
12aa125c  ff8b0000 83ec8b55 8b5610ec 0d7e80f1
12aa126c  840f5700 0009d0e7 46c6ce8b abe8010d
12aa127c  8bfff959 7cff85f8 08768b3b 7d8dc033
12aa128c  8dababf0 ab51f04d 0468006a ab060000

// The above equates to the CLSID for UPnP:
{204810b9-73b2-11d4-bf42-00b0d0118b56}

Since this is only a wmp dump, I can't tell you what uPnP device it thinks it's talking to (well, actually, I can tell you it was talking to process ID 0x00000424, but I have no idea what that was - wmp was process ID 0x00000d9c), but disabling the uPnP service might be helpful if you aren't using it. Otherwise, you'll have to get a network trace to see the uPnP packets, and to where they are destined.

[Tarq57]

I'm guessing that is a tiny little extract from the dump?
Still amazed it's 75Mb.
What side effects would disabling UPnP have?

[Tarun]

It's hard to say, since we can't really say what you have that relies on UPnP. Some software like uTorrent, Shareaza, AIM, Windows Live Messenger, Pidgin, etc will use the UPnP service to configure router ports. Many of these make use of the UPnP service. I know that my router has UPnP support (Linksys WRT54GL with Tomato Firmware) and here's a snippit from it.

External	Internal	Internal Address	Protocol	Description
5190	5190	[Snip]	TCP	PURPLE_UPNP_PORT_FORWARD

5190 is an AOL Instant Messenger (Oscar) protocol port for file transfers and other items. (Read More)

I hope this helps explain some of what UPnP handles. If you would like to learn more, Wikipedia always has a good read.

[Tarq57]

I've just disabled the UPnP service, and also the Windows Media Network sharing service (since it was a dependency of UPnP) and the issue appears to have been resolved!
Awesome.

[Tarun]

It might be worth checking this out. Try to reset UPnP to Automatic and see if the issue still exists, while you leave Windows Media Network service Disabled.

If the issue does not exist, then you'll know the problem was stemming form the Windows Media Network service. If it comes back, then your WMP is trying to access a device or application through UPnP.

[Tarq57]

Tarun, on Jun 20 2008, 11:07 AM, said:

It might be worth checking this out. Try to reset UPnP to Automatic and see if the issue still exists, while you leave Windows Media Network service Disabled.

If the issue does not exist, then you'll know the problem was stemming form the Windows Media Network service. If it comes back, then your WMP is trying to access a device or application through UPnP.

So, did that. The problem definitely stems from WMP/ UPnP. Interestingly, the UPnP service doesn't start when WMP is opened. Attempting to start it manually produces the message that it started, but stopped again due no work for it to do. Yet when it's set to auto, WMP hangs on closing. When disabled, WMP closes immediately.
The only UPnP device listed in WMP as associated with it is the Nero burning application.

[Tarun]

Under Library > Configure Sharing > Uncheck Share my media.

I'm looking through WMP now to see if there are any UPnP settings that might be having an effect. Doing a bit of research it sounds like the above is about all there is relating to UPnP. But if it isn't checked I really don't know what else it could be.

[Tarq57]

"Share my media" was already unchecked.
I'm thinking I might not need the UPnP service. Any other popular applications it's used for?

[Tarun]

I did find a list of manufacturers/developers:

http://www.upnp.org/...hip/members.asp

If you like, you can use CCleaner to export a list of installed applications. Just post the list on here and some members can look through to identify if an application uses UPnP.

[Tarq57]

Well, you're a helpful guy. Just browsing the list linked to a few names leapt out, some of whose products are installed...Realtek, Samsung, Seagate, Sun to name a few. But do I need UPnP for these apps?
Here's the list from Ccleaner.

7-Zip 4.57
Active Ports
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Shockwave Player 11
Advanced WindowsCare Personal
Apple Software Update
ArcSoft Camera Suite 1.3
a-squared Free 3.0
a-squared HiJackFree 2.1
Athlon 64 Processor Driver
ATI - Software Uninstall Utility
ATI Display Driver
avast! Antivirus
AVG Anti-Spyware 7.5
Canon Camera Support Core Library
Canon Camera Window DS for ZoomBrowser EX
Canon Camera Window DVC for ZoomBrowser EX
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX
CCleaner (remove only)
COMODO Memory Firewall
Compatibility Pack for the 2007 Office system
Debugging Tools for Windows (x86)
Doc Convertor 1.0 (Beta)
DropMyRights
Eraser 5.82
ERUNT 1.1j
EULAlyzer v1.2
ExtractNow
FireTune
FLV Player 2.0, build 24
Foxit Reader
FW LiveUpdate
GdiplusUpgrade
Google Earth
Google SketchUp 6
HD Tach version 3
HijackThis 2.0.2
HostsMan 3.0 Beta1
HP Driver Diagnostics
HP Photosmart Essential
HP Product Detection
HP Update
Index.dat Suite
IrfanView (remove only)
Java™ 6 Update 5
Karen's Alarm Clock
Karen's Replicator
Kruptos 2
LimeWire 4.16.7
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Baseline Security Analyzer 2.0.1
Microsoft Bootvis
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Excel Viewer 2003
Microsoft Office PowerPoint Viewer 2003
Microsoft Office Word Viewer 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
MIKSOFT Mobile 3GP converter
MozBackup 1.4.7
Mozilla Firefox (2.0.0.14)
Mozilla Thunderbird (2.0.0.14)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
Muiltmedia keyboard utility 1.3
Nero OEM
neroxml
nLite 1.4.5
NVIDIA Drivers
PeerGuardian 2.0
QuickTime
Real Alternative 1.52
Realtek AC'97 Audio
Recuva (remove only)
Revo Uninstaller 1.60
Sarbyx TrayClock v1.1
Secunia PSI (RC2)
Sophos Anti-Rootkit 1.3.1
Spell Checker For OE 2.1
Spybot - Search & Destroy
SpywareBlaster 4.1
SUPERAntiSpyware Free Edition
ThreatFire 3.0
TuneXP 1.5
Tweak UI
TweakNow RegCleaner Standard
Unlocker 1.8.7
User Profile Hive Cleanup Service
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
XnView 1.93.4

[Tarun]

I can see Canon needing the UPnP service (assuming), Limewire probably needs it as well, being a P2P application.

I can also see some items needing updating. Revo is 1.71, Firefox 3, .NET Framework 3.5, Sun Java is at Update 6. I almost wonder if Comodo Memory Firewall could have been interfering. Is that the Comodo Firewall you were using, I had assumed it was Comodo Firewall Pro 2.4 and you had some problems updating to 3.0.

[Tarq57]

I've decided I don't want Firefox3 at this point, read a few user opinions about the "Awesome Bar", and until Mozilla makes it fully optionable (is that a word?) I ain't gonna go there. (Might possibly look at Opera 9.5.)
The functions we use in the Canon application seem to function OK, likewise Limewire. It would seem that disabling UPnP Device Host (Plug n Play is still set to auto) doesn't have adverse effects (touch wood, or whatever the modern carbon neutral equivalent is.)
Updated to Net framework 3, then 3.5. Decided to install Silverlight and updated root certificates at the same time.
Updated Revo.
Updated Java. (What a palaver that is. Why can't they include an uninstaller with the update?)
Updated Secunia PSI. (For some reason it failed to alert that the Java was out of date. Do you know how long 1.6.06 has been out?)
Did a bit of uninstalling/re-installing of applications in an attempt to pinpoint broken codecs. (Got the list from 4 down to 2, as reported by Sherlock.exe, a codec detective.) (I might ask you a bit about this, later, if that's ok.)
How's this list look, now?

7-Zip 4.57
Active Ports
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Shockwave Player 11
Advanced WindowsCare Personal
Apple Software Update
ArcSoft Camera Suite 1.3
a-squared Free 3.0
a-squared HiJackFree 2.1
Athlon 64 Processor Driver
ATI - Software Uninstall Utility
ATI Display Driver
avast! Antivirus
AVG Anti-Spyware 7.5
Canon Camera Support Core Library
Canon Camera Window DS for ZoomBrowser EX
Canon Camera Window DVC for ZoomBrowser EX
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX
CCleaner (remove only)
COMODO Memory Firewall
Compatibility Pack for the 2007 Office system
Debugging Tools for Windows (x86)
DivX
Doc Convertor 1.0 (Beta)
DropMyRights
Eraser 5.82
ERUNT 1.1j
EULAlyzer v1.2
ExtractNow
FireTune
FLV Player 2.0, build 24
Foxit Reader
FW LiveUpdate
GdiplusUpgrade
Google Earth
Google SketchUp 6
HD Tach version 3
HijackThis 2.0.2
HostsMan 3.0 Beta1
HP Driver Diagnostics
HP Photosmart Essential
HP Product Detection
HP Update
Index.dat Suite
IrfanView (remove only)
Java™ 6 Update 6
Karen's Alarm Clock
Karen's Replicator
Kruptos 2
LimeWire 4.16.7
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft Baseline Security Analyzer 2.0.1
Microsoft Bootvis
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Excel Viewer 2003
Microsoft Office PowerPoint Viewer 2003
Microsoft Office Word Viewer 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MIKSOFT Mobile 3GP converter
MozBackup 1.4.7
Mozilla Firefox (2.0.0.14)
Mozilla Thunderbird (2.0.0.14)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
Muiltmedia keyboard utility 1.3
Nero OEM
neroxml
nLite 1.4.5
NVIDIA Drivers
PeerGuardian 2.0
QuickTime
Real Alternative 1.52
Realtek AC'97 Audio
Recuva (remove only)
Revo Uninstaller 1.71
Sarbyx TrayClock v1.1
Secunia PSI (RC3)
Sophos Anti-Rootkit 1.3.1
Spell Checker For OE 2.1
Spybot - Search & Destroy
SpywareBlaster 4.1
SUPERAntiSpyware Free Edition
ThreatFire 3.0
TuneXP 1.5
Tweak UI
TweakNow RegCleaner Standard
Unlocker 1.8.7
User Profile Hive Cleanup Service
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
XnView 1.93.4
XP Codec Pack

[Tarun]

I did a small edit to your install list so the page won't be so long by wrapping it with codeboxes.

A fairly nice application to check for updates is by KC Software, called SUMo. I'm on Firefox 3 with no issues, have been using it since it was in the beta stages.

With Java, use JavaRa to clean out the old versions. As for when it was released... Click.

As far as codec packs, I've used K-Lite Mega Pack and the Vista Codec Pack. Only one at a time, but I used K-Lite longest.

If some others see some applications that use UPnP, please let us know.

[Tarq57]

Hmmm. Codeboxes. Nice. How do you do that?
You're up rather late.
Nothing like good Java.

[Tarun]

Just do this number:

[codebox]All of my long code here![/codebox]

I'm usually up at this hour.