XP slow to shutdown after a router change

[videobruce]

Running XP pro w/sp3, after a changed my router one of my three active partitions (3 HDD's) the one I use all the time is slow to shutdown.
I changed out a old Verizon DSL route for a Linksys wireless router (using the wired connection) and by doing so the system is slow to shutdown. I remember reading something about network conflicts connected to the O/S, but don't remember the terms which makes searching impossible.

I use static IP addresses for my three PC's and two TiVo DVR's which are on the network. No firewalls. This happened right after I swapped routers.

 

[tvanduzee]

The biggest problem I have found in XP shutdowns is that XP is trying to close a driver and is having issues doing so.
Try to install the router drivers directly from the router manufacturer rather than depending on XP's driver.

If you feel that it may be IP related, then you may want to check your router's dhcp and set a reserve for each of the 3 machines' ips
HTH

Terry

 

[videobruce]

You lost me on drivers for a router. :hmm: Are you referring to drivers for the NIC?
When you say setting a reserve for the machines IP's, are you referring to static IP's for each PC or device?

 

[Comblues]

Routers don't typically slow down a PC, XP or otherwise.

So...

C:/netstat -an or C:/netstat -ano

Try and see what network connections are established and which ports are open by what programs.

Once you've got this information, combine it with a few key fields in task manager and you are well on your way to solving the mystery.

I also open up my favorite sniffer and see what the packets are doing.

Nice to have full disclosure on what is coming in or going out of my workstation, and yours too.

Don't rule out checking out your registry for errant programs...

Use autoruns for example to take a quick peek.

Use google to find the program.

Comblues

 

[videobruce]

Any of this suspicious? I don't know what to look for.

C: \>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1092
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 127.0.0.1:12080 0.0.0.0:0 LISTENING 1468
TCP 127.0.0.1:27275 0.0.0.0:0 LISTENING 1468
TCP 192.168.1.138:139 0.0.0.0:0 LISTENING 4
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 848
UDP 0.0.0.0:1025 *:* 1256
UDP 0.0.0.0:1029 *:* 1256
UDP 0.0.0.0:1030 *:* 1256
UDP 0.0.0.0:4500 *:* 848
UDP 127.0.0.1:123 *:* 1212
UDP 127.0.0.1:1900 *:* 1384
UDP 192.168.1.138:123 *:* 1212
UDP 192.168.1.138:137 *:* 4
UDP 192.168.1.138:138 *:* 4
UDP 192.168.1.138:1900 *:* 1384

Is there any function to clean out connection history with a router? I'm using WRT firmware in my Linksys router.

.

 

[JackMDS]

Disconnect he wire from the Network catd and see if it does the same.

 

[videobruce]

After I ran those commands I shut down the PC, then powered back up. On shut down, it did not hang the first two power cycles. After that it did.


Would disabling the NIC do the same?

 

[Comblues]

Google each port, one by one.

Example: Port 135 is RPC. - You need this one.

But you show a couple of high ports that are immediately suspicious, google them and then check those Process ID aka pid values to see what executable file
Started each one.

Then use the search function in windows to check these out, one by one.

Google is a hacker's best friend, use it wisely.

Comblues

 

[videobruce]

I found some other 'quirks' in the O/S and decided to revert back to a older image and build back from there. Thanks for the info, it appears there was more than one problem. It wasn't worth the time to go on a wild goose hunt.

 

[Comblues]

No router issue? Correct.

Comblues

 

[videobruce]

I really don't know where it was as other issues cropped up. With the image I used from a couple of years ago, all seems to be Ok so far.