Tarq57 Posted June 18, 2008 Share Posted June 18, 2008 I'm here thanks to a suggestion (thanks to those involved) received from a member at another forum, where this problem was also posted. I use WMP11. For a time, now, maybe 2 or 3 weeks ago I first noticed it, when closing it, the GUI and any outward manifestation of its' running (eg: sound, if it was playing an audio file) disappears promptly, but the service continues for about 10 or 11 seconds in taskmanager. First realised this was happening when I closed it, then immediately commanded it to open another file, by selecting that file, and having WMP utterly fail to respond. Wait 10 seconds and try again, good as gold. There is a debug report log available if required.. one of the early entries in the log concerns something about an NT variable not correctly set, so it seems some things that could perhaps have been examined, were not. I'm hoping to pick up on the help received where it was left off, if that's OK. Just let me know what information is needed. Thanks, Tarq. Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 18, 2008 Administrator Share Posted June 18, 2008 Hey Tarq, let's try to resolve this problem. Here's the code to run, since I know you've followed the wiki to get a dump of the process. cscript adplus.vbs -hang -pn wmplayer.exe -quiet -o c:\adplus Link to comment Share on other sites More sharing options...
Tarq57 Posted June 19, 2008 Author Share Posted June 19, 2008 Hi there. Ran the cmd propt as directed, on the first attempt it came back with "Error, the following requested processes are not executing: WMPLAYER.EXE, and that was the end of the report. Tried it again, but this time opened the media player before activating the prompt. The command prompt appears to have finisished doing what it was doing, but isn't closing. In the "ADPlus" folder for this current attempt are several documents: adplus report.txt PID_3484_WMPLAYER.EXE (date/time) text document Process List.txt PID_3484_WMPLAYER.EXE DMP (76,884kb) (!) and a sub folder titled CBD scripts, containing a WMPLAYER.EXE CFG. Which of these would you like? Does it matter the cmd hasn't closed, or that I had to open WMP to get the thing to work? (Uncertainly wondering if I've done something wrong...) Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 19, 2008 Administrator Share Posted June 19, 2008 Would need the *.dmp file. If the file is above the attachment limit, you can upload it to a free file hosting website such as My Free File Hosting. You can zip, rar, or even better, 7z the dump to compress it. IZArc can compress to 7z quite well. :) Link to comment Share on other sites More sharing options...
Tarq57 Posted June 19, 2008 Author Share Posted June 19, 2008 Right. Let's see if it will upload here. Darn. Seems it might not.. [EDIT] Uploading to file hosting as I type. Unless I'm decimally mistaken, the file size is 76Megs. Surely that aint right? [Edit2] well, here it is75.08mB Link to comment Share on other sites More sharing options...
cluberti Posted June 19, 2008 Share Posted June 19, 2008 Right. Let's see if it will upload here. Darn. Seems it might not.. [EDIT] Uploading to file hosting as I type. Unless I'm decimally mistaken, the file size is 76Megs. Surely that aint right? [Edit2] well, here it is75.08mB //Looks like Windows Media Player made an RPC call to something outside of the process via ole32: 0:012> kb ChildEBP RetAddr Args to Child 0286ed68 7c90dacc 77e7cac1 000000c0 000cbee8 ntdll!KiFastSystemCallRet 0286ed6c 77e7cac1 000000c0 000cbee8 000cbee8 ntdll!ZwRequestWaitReplyPort+0xc 0286edb8 77e7a33e 0237f8f0 0286ede0 776016bb rpcrt4!LRPC_CCALL::SendReceive+0x228 0286edc4 776016bb 02353388 000feabc 0286eec4 rpcrt4!I_RpcSendReceive+0x24 0286ede0 776011a6 00000000 00000000 00000000 ole32!ThreadSendReceive+0xf5 0286edfc 7760108a 0286eec4 0286efd4 000feabc ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x13d 0286eedc 7752ce1a 000feabc 0286efd4 0286efc4 ole32!CRpcChannelBuffer::SendReceive2+0xc8 0286ef48 7752cdb2 000feabc 0286efd4 0286efc4 ole32!CAptRpcChnl::SendReceive+0xab 0286ef9c 77ef4db5 000feabc 0286efd4 0286efc4 ole32!CCtxComChnl::SendReceive+0x113 0286efb8 77ef4ead 0012f7bc 0286f000 0600015b rpcrt4!NdrProxySendReceive+0x43 0286f394 77ef4e42 774e6228 774e94fc 0286f3cc rpcrt4!NdrClientCall2+0x1fa 0286f3b4 77e8a83b 00000014 00000004 0286f428 rpcrt4!ObjectStublessClient+0x8b 0286f3c4 7751eaed 0012f7bc 00000000 0286f86c rpcrt4!ObjectStubless+0xf 0286f428 7751ebba 0286f86c 0286fdb8 002d0032 ole32!CRpcResolver::CreateInstance+0x13d 0286f674 775110b3 77607114 00000000 00000000 ole32!CClientContextActivator::CreateInstance+0xfa 0286f6b4 77510ef8 0286f86c 00000000 0286fdb8 ole32!ActivationPropertiesIn::DelegateCreateInstance+0xf7 0286fe64 77500575 12aa121c 00000000 00000017 ole32!ICoCreateInstanceEx+0x3c9 0286fe8c 77500544 12aa121c 00000000 00000017 ole32!CComActivator::DoCreateInstance+0x28 0286feb0 775005b2 12aa121c 00000000 00000017 ole32!CoCreateInstanceEx+0x1e 0286fee0 12aa10c5 12aa121c 00000000 00000017 ole32!CoCreateInstance+0x37 0286ff34 12ac73f7 00000002 012b69e0 012b69e0 wmp!CRenderer::RegisterDevice+0x28 0286ffa8 12ac7315 0000006a 0286ffec 7c80b713 wmp!CWMStoreThreadManager::ThreadMain+0x90 0286ffb4 7c80b713 012b69e0 00000002 0000006a wmp!CWMStoreThreadManager::_ThreadMain+0x27 0286ffec 00000000 12ac72ef 012b69e0 00000000 kernel32!BaseThreadStart+0x37 // looking deeper, it looks like it's actually going outside of the whole machine and onto the network: 0:012> .frame 12 12 0286feb0 775005b2 ole32!CoCreateInstanceEx+0x1e 0:012> dd 12aa121c 12aa121c 204810b9 11d473b2 b00042bf 568b11d0 12aa122c 8b55ff8b 0875ffec 5050c033 68505050 12aa123c 1295271c aa125068 5522e812 c25dffec 12aa124c 90900004 00500055 0050006e 00440049 12aa125c ff8b0000 83ec8b55 8b5610ec 0d7e80f1 12aa126c 840f5700 0009d0e7 46c6ce8b abe8010d 12aa127c 8bfff959 7cff85f8 08768b3b 7d8dc033 12aa128c 8dababf0 ab51f04d 0468006a ab060000 // The above equates to the CLSID for UPnP: {204810b9-73b2-11d4-bf42-00b0d0118b56} Since this is only a wmp dump, I can't tell you what uPnP device it thinks it's talking to (well, actually, I can tell you it was talking to process ID 0x00000424, but I have no idea what that was - wmp was process ID 0x00000d9c), but disabling the uPnP service might be helpful if you aren't using it. Otherwise, you'll have to get a network trace to see the uPnP packets, and to where they are destined. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 19, 2008 Author Share Posted June 19, 2008 I'm guessing that is a tiny little extract from the dump? Still amazed it's 75Mb. What side effects would disabling UPnP have? Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 19, 2008 Administrator Share Posted June 19, 2008 It's hard to say, since we can't really say what you have that relies on UPnP. Some software like uTorrent, Shareaza, AIM, Windows Live Messenger, Pidgin, etc will use the UPnP service to configure router ports. Many of these make use of the UPnP service. I know that my router has UPnP support (Linksys WRT54GL with Tomato Firmware) and here's a snippit from it. External Internal Internal Address Protocol Description 5190 5190 [Snip] TCP PURPLE_UPNP_PORT_FORWARD 5190 is an AOL Instant Messenger (Oscar) protocol port for file transfers and other items. (Read More) I hope this helps explain some of what UPnP handles. If you would like to learn more, Wikipedia always has a good read. :) Link to comment Share on other sites More sharing options...
Tarq57 Posted June 19, 2008 Author Share Posted June 19, 2008 I've just disabled the UPnP service, and also the Windows Media Network sharing service (since it was a dependency of UPnP) and the issue appears to have been resolved! Awesome. Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 19, 2008 Administrator Share Posted June 19, 2008 It might be worth checking this out. Try to reset UPnP to Automatic and see if the issue still exists, while you leave Windows Media Network service Disabled. If the issue does not exist, then you'll know the problem was stemming form the Windows Media Network service. If it comes back, then your WMP is trying to access a device or application through UPnP. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 20, 2008 Author Share Posted June 20, 2008 It might be worth checking this out. Try to reset UPnP to Automatic and see if the issue still exists, while you leave Windows Media Network service Disabled. If the issue does not exist, then you'll know the problem was stemming form the Windows Media Network service. If it comes back, then your WMP is trying to access a device or application through UPnP. So, did that. The problem definitely stems from WMP/ UPnP. Interestingly, the UPnP service doesn't start when WMP is opened. Attempting to start it manually produces the message that it started, but stopped again due no work for it to do. Yet when it's set to auto, WMP hangs on closing. When disabled, WMP closes immediately. The only UPnP device listed in WMP as associated with it is the Nero burning application. Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 20, 2008 Administrator Share Posted June 20, 2008 Under Library > Configure Sharing > Uncheck Share my media. I'm looking through WMP now to see if there are any UPnP settings that might be having an effect. Doing a bit of research it sounds like the above is about all there is relating to UPnP. But if it isn't checked I really don't know what else it could be. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 20, 2008 Author Share Posted June 20, 2008 "Share my media" was already unchecked. I'm thinking I might not need the UPnP service. Any other popular applications it's used for? Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 20, 2008 Administrator Share Posted June 20, 2008 I did find a list of manufacturers/developers: http://www.upnp.org/membership/members.asp If you like, you can use CCleaner to export a list of installed applications. Just post the list on here and some members can look through to identify if an application uses UPnP. :) Link to comment Share on other sites More sharing options...
Tarq57 Posted June 20, 2008 Author Share Posted June 20, 2008 Well, you're a helpful guy. Just browsing the list linked to a few names leapt out, some of whose products are installed...Realtek, Samsung, Seagate, Sun to name a few. But do I need UPnP for these apps? Here's the list from Ccleaner.7-Zip 4.57 Active Ports Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Shockwave Player 11 Advanced WindowsCare Personal Apple Software Update ArcSoft Camera Suite 1.3 a-squared Free 3.0 a-squared HiJackFree 2.1 Athlon 64 Processor Driver ATI - Software Uninstall Utility ATI Display Driver avast! Antivirus AVG Anti-Spyware 7.5 Canon Camera Support Core Library Canon Camera Window DS for ZoomBrowser EX Canon Camera Window DVC for ZoomBrowser EX Canon Camera Window for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon ZoomBrowser EX CCleaner (remove only) COMODO Memory Firewall Compatibility Pack for the 2007 Office system Debugging Tools for Windows (x86) Doc Convertor 1.0 (Beta) DropMyRights Eraser 5.82 ERUNT 1.1j EULAlyzer v1.2 ExtractNow FireTune FLV Player 2.0, build 24 Foxit Reader FW LiveUpdate GdiplusUpgrade Google Earth Google SketchUp 6 HD Tach version 3 HijackThis 2.0.2 HostsMan 3.0 Beta1 HP Driver Diagnostics HP Photosmart Essential HP Product Detection HP Update Index.dat Suite IrfanView (remove only) Java(tm) 6 Update 5 Karen's Alarm Clock Karen's Replicator Kruptos 2 LimeWire 4.16.7 Malwarebytes' Anti-Malware Malwarebytes' RogueRemover Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Baseline Security Analyzer 2.0.1 Microsoft Bootvis Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Excel Viewer 2003 Microsoft Office PowerPoint Viewer 2003 Microsoft Office Word Viewer 2003 Microsoft User-Mode Driver Framework Feature Pack 1.0 MIKSOFT Mobile 3GP converter MozBackup 1.4.7 Mozilla Firefox (2.0.0.14) Mozilla Thunderbird (2.0.0.14) MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 6.0 Parser (KB933579) Muiltmedia keyboard utility 1.3 Nero OEM neroxml nLite 1.4.5 NVIDIA Drivers PeerGuardian 2.0 QuickTime Real Alternative 1.52 Realtek AC'97 Audio Recuva (remove only) Revo Uninstaller 1.60 Sarbyx TrayClock v1.1 Secunia PSI (RC2) Sophos Anti-Rootkit 1.3.1 Spell Checker For OE 2.1 Spybot - Search & Destroy SpywareBlaster 4.1 SUPERAntiSpyware Free Edition ThreatFire 3.0 TuneXP 1.5 Tweak UI TweakNow RegCleaner Standard Unlocker 1.8.7 User Profile Hive Cleanup Service Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage Validation Tool (KB892130) Windows Installer Clean Up Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows Rights Management Client Backwards Compatibility SP2 Windows Rights Management Client with Service Pack 2 XnView 1.93.4 Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 20, 2008 Administrator Share Posted June 20, 2008 I can see Canon needing the UPnP service (assuming), Limewire probably needs it as well, being a P2P application. I can also see some items needing updating. Revo is 1.71, Firefox 3, .NET Framework 3.5, Sun Java is at Update 6. I almost wonder if Comodo Memory Firewall could have been interfering. Is that the Comodo Firewall you were using, I had assumed it was Comodo Firewall Pro 2.4 and you had some problems updating to 3.0. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 21, 2008 Author Share Posted June 21, 2008 I've decided I don't want Firefox3 at this point, read a few user opinions about the "Awesome Bar", and until Mozilla makes it fully optionable (is that a word?) I ain't gonna go there. (Might possibly look at Opera 9.5.) The functions we use in the Canon application seem to function OK, likewise Limewire. It would seem that disabling UPnP Device Host (Plug n Play is still set to auto) doesn't have adverse effects (touch wood, or whatever the modern carbon neutral equivalent is.) Updated to Net framework 3, then 3.5. Decided to install Silverlight and updated root certificates at the same time. Updated Revo. Updated Java. (What a palaver that is. Why can't they include an uninstaller with the update?) Updated Secunia PSI. (For some reason it failed to alert that the Java was out of date. Do you know how long 1.6.06 has been out?) Did a bit of uninstalling/re-installing of applications in an attempt to pinpoint broken codecs. (Got the list from 4 down to 2, as reported by Sherlock.exe, a codec detective.) (I might ask you a bit about this, later, if that's ok.) How's this list look, now? 7-Zip 4.57 Active Ports Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Shockwave Player 11 Advanced WindowsCare Personal Apple Software Update ArcSoft Camera Suite 1.3 a-squared Free 3.0 a-squared HiJackFree 2.1 Athlon 64 Processor Driver ATI - Software Uninstall Utility ATI Display Driver avast! Antivirus AVG Anti-Spyware 7.5 Canon Camera Support Core Library Canon Camera Window DS for ZoomBrowser EX Canon Camera Window DVC for ZoomBrowser EX Canon Camera Window for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon ZoomBrowser EX CCleaner (remove only) COMODO Memory Firewall Compatibility Pack for the 2007 Office system Debugging Tools for Windows (x86) DivX Doc Convertor 1.0 (Beta) DropMyRights Eraser 5.82 ERUNT 1.1j EULAlyzer v1.2 ExtractNow FireTune FLV Player 2.0, build 24 Foxit Reader FW LiveUpdate GdiplusUpgrade Google Earth Google SketchUp 6 HD Tach version 3 HijackThis 2.0.2 HostsMan 3.0 Beta1 HP Driver Diagnostics HP Photosmart Essential HP Product Detection HP Update Index.dat Suite IrfanView (remove only) Java(tm) 6 Update 6 Karen's Alarm Clock Karen's Replicator Kruptos 2 LimeWire 4.16.7 Malwarebytes' Anti-Malware Malwarebytes' RogueRemover Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 3.0 Service Pack 1 Microsoft .NET Framework 3.5 Microsoft Baseline Security Analyzer 2.0.1 Microsoft Bootvis Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Excel Viewer 2003 Microsoft Office PowerPoint Viewer 2003 Microsoft Office Word Viewer 2003 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 MIKSOFT Mobile 3GP converter MozBackup 1.4.7 Mozilla Firefox (2.0.0.14) Mozilla Thunderbird (2.0.0.14) MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 6.0 Parser (KB933579) Muiltmedia keyboard utility 1.3 Nero OEM neroxml nLite 1.4.5 NVIDIA Drivers PeerGuardian 2.0 QuickTime Real Alternative 1.52 Realtek AC'97 Audio Recuva (remove only) Revo Uninstaller 1.71 Sarbyx TrayClock v1.1 Secunia PSI (RC3) Sophos Anti-Rootkit 1.3.1 Spell Checker For OE 2.1 Spybot - Search & Destroy SpywareBlaster 4.1 SUPERAntiSpyware Free Edition ThreatFire 3.0 TuneXP 1.5 Tweak UI TweakNow RegCleaner Standard Unlocker 1.8.7 User Profile Hive Cleanup Service Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage Validation Tool (KB892130) Windows Installer Clean Up Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows Rights Management Client Backwards Compatibility SP2 Windows Rights Management Client with Service Pack 2 XnView 1.93.4 XP Codec Pack Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 21, 2008 Administrator Share Posted June 21, 2008 I did a small edit to your install list so the page won't be so long by wrapping it with codeboxes. A fairly nice application to check for updates is by KC Software, called SUMo. I'm on Firefox 3 with no issues, have been using it since it was in the beta stages. With Java, use JavaRa to clean out the old versions. As for when it was released... Click. As far as codec packs, I've used K-Lite Mega Pack and the Vista Codec Pack. Only one at a time, but I used K-Lite longest. If some others see some applications that use UPnP, please let us know. :) Link to comment Share on other sites More sharing options...
Tarq57 Posted June 21, 2008 Author Share Posted June 21, 2008 Hmmm. Codeboxes. Nice. How do you do that? You're up rather late. Nothing like good Java. Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 21, 2008 Administrator Share Posted June 21, 2008 Just do this number: [codebox]All of my long code here![/codebox] I'm usually up at this hour. :) Link to comment Share on other sites More sharing options...
cluberti Posted June 21, 2008 Share Posted June 21, 2008 Yeah, Tarun never sleeps. He's probably a robot Glad to see my debug was useful for something. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 21, 2008 Author Share Posted June 21, 2008 Yep. Thanks very much. I'm liking that JavaRa program, By the way. Old JRE folder found, current JRE actually is current. A keeper. Link to comment Share on other sites More sharing options...
Administrator Tarun Posted June 23, 2008 Administrator Share Posted June 23, 2008 I found that Comodo Cleanup if you want to get a copy of it. It came from their forums but I found it on my hard drive. Link to comment Share on other sites More sharing options...
Tarq57 Posted June 23, 2008 Author Share Posted June 23, 2008 Thanks Tarun, but if you're referring to the batch file created by one of the forum members to help uninstalling the firewall, I already have it. (Used it a few times, too!) Sorry, thought I'd mentioned that, but on recollection, it was at the Comodo forum I mentioned it. Everything seems to work well. WMP seems to open/close as it should. I'm thinking maybe this compromise (if it does actually represent a compromise) of having that service disabled is probably going to be good enough. Which means, in the absence of any other problems, of course, that it's perfect. Thanks all very much for assistance with debugging. Always open for any further advice/info about this, or anything I might have done incorrectly whilst running the debugger. But for now, all is great. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.