Applet Mitigations - Services.

re: Applet Mitigations - Services.

mark @want.la — Mon, 22 Oct 2007 09:11:14 GMT

After having my CPU almost come to a complete stop when I connected my xbox 360 media edition extender sharing on using wmp11 the file WMPNetwk.exe hogs up to 90% of my quad core system. What gives? just google that file name and if you think that is bad, wait to you see what Vista does with WMP11 when any system sound or music file is playing > http://blogs.zdnet.com/hardware/?p=702

I rolled back to wm10 and my Xbox360 is now no longer a media extender like all the hype marketing Microsoft pitches that xbox360 is a certified Media Center extender? They fail to mention that when you are not even sharing, that wmp11 and shares almost your entire CPU power to a very horrible bug that should be registered as certified mailware.

re: Applet Mitigations - Services.

Bikedude — Sun, 02 Sep 2007 18:46:43 GMT

August wrote: "I think it was Windows Update, but I was never sure. Problem is gone now anyways."

Your suspicion is probably correct. The Register ran several articles a few months ago about Windows Update burning 100% CPU. I observed the phenomena on several computers, and it seems to be a problem of the past now.

re: Applet Mitigations - Services.

Matthew — Mon, 27 Aug 2007 04:43:23 GMT

Larry,

You are a gem - we will look into this option. You may have just removed one craplet from the world. :)

We are using .NET - I assume there is no 'pure' way to do this (ie we will be forced to use COM Interop)?

re: Applet Mitigations - Services.

Norman Diamond — Mon, 27 Aug 2007 04:13:41 GMT

Friday, August 24, 2007 12:06 PM by Hob Gadling

> A case in point is the Windows Media Player Network Sharing

> Service (WMPNetwk.exe and WMPNSCFG.exe) which is

> installed by default with WMP11. Unfortunately it keeps

> running even after turning off media sharing from the UI.

Thank you very much for this news. I hadn't had time yet to investigate why Windows Media Player suddenly started to attempt network connections when I wasn't even using Windows Media Player. And if I recall correctly they're outbound connections, just like malware logging into a botnet, so they don't get caught by Windows XP's default firewall. Nice to see that there's a UI that I can go hunting for in order to say I want to turn it off, somehow typical to see that it still won't turn off. Sigh. Thank you anyway, since the information is useful.

re: Applet Mitigations - Services.

Larry Osterman [MSFT] — Sat, 25 Aug 2007 18:16:31 GMT

Igor and Matthew: I just realized that there's a workaround.

If you register your COM object as LocalService, you can call CoCreateInstance as a limited user and as long as you have COM launch permissions for the object, the service controller will start your service.

re: Applet Mitigations - Services.

Igor — Sat, 25 Aug 2007 05:12:45 GMT

Oh about services, Apple is shoveling their Bonjour Service (aka mDNSResponder.exe) with almost every recent application they sell.

Take note that if you use dial-up and you delete it, you might not be able to use Internet because it inserts itself into the LSP stack.

re: Applet Mitigations - Services.

Igor — Sat, 25 Aug 2007 05:10:19 GMT

"Is there a way around this?"

Yes it is, it is called Run As Administrator. Either that or redesign your application so that it doesn't require admin access.

Larry, I was wondering, why Windows has MSDTC service and why it has to be started even if you don't have any NTFS volumes around?

May I give you an idea for a next bunch of posts?

I am annoyed by Recycle Bin, Recycler, and System Volume Information.

I never delete to recycle bin, I never use system restore (I disable it and the sr service too), but I still get those folders created on my disks.

There is a shell API IsBitBucketableDrive() which should check the registry and not create recycle bin folders if the drive is marked as non bit bucketable. That doesn't seem to work for some reason so I resolved it by patching the API.

What is left is that darn System Volume Information folder which has MountPointManagerRemoteDatabase (0 bytes) and tracking.log (usually also 0 bytes). My question is whether is that really neccessary to exist if I do not have a need for it?

I mean, isn't it a bad design to scatter folders and files all over _my_ drives? Many new applcations now follow suit and create folders and files I never use and there is no way to prevent them from recreating them. With drives getting bigger and bigger, the space is no longer a concern, but I still like my drives to be tidy and organized.

I would really like if Windows had some way of managing this. Heck, even a simple text file with a list of folder and file names which will not be accepted by CreateFile() and CreateDirectory() would suffice.

re: Applet Mitigations - Services.

Hob Gadling — Fri, 24 Aug 2007 19:06:17 GMT

A case in point is the Windows Media Player Network Sharing Service (WMPNetwk.exe and WMPNSCFG.exe) which is installed by default with WMP11. Unfortunately it keeps running even after turning off media sharing from the UI.

re: Applet Mitigations - Services.

Larry Osterman [MSFT] — Fri, 24 Aug 2007 08:42:38 GMT

Matthew, unfortunately no :(, unless you're willing to grant interactive users the right to start your service, which means that you need to consider the threats associated with that.

re: Applet Mitigations - Services.

Matthew — Fri, 24 Aug 2007 08:38:46 GMT

>> Does your service REALLY need to be enabled and auto-start (even auto-start-delay) on every SKU? Really?

We use services since some of our features require admin access. Unfortunately we need them to be running all the time since non-admin users need the feature too - yet they can't just start the service when they need the feature (since non-admins can't start and stop services)...

Is there a way around this?