Strange Happenings

Two Win 7 Pro PCs.

No problems on PC2.

PC1 has problems and has same widgets as PC2.
Neither Windows updated in several months.

Two days or so ago PC1 did this:
(1) Widgets all died and disappeared off the desktop.
These are NOT MS widgets except for the one Windows Media Player widget
which died also.

(2) Windows Media Player keeps telling me to download TV program info
and I do but it keeps asking. I let it do whatever it was to do for two
days and still asks to download TV program info.

Process Explorer shows Windows Media Player app running taking 25% CPU
when running.

It seems to only download a day or two TV programming schedule then quits.

No other Internet anomalies as I have downloaded many files including
multi-megabye files with no problem

PC2 does not have a tuner so can not check TV programming downloads.

PC2 views PC1 recorded TV programs just fine over LAN or WiFi.

PC2 has same widgets working just fine.

Both PC2 on line, on LAN and talking to Internet.

Have booted PC1 but no help.

Win7User wrote:
Two Win 7 Pro PCs.

No problems on PC2.

PC1 has problems and has same widgets as PC2.
Neither Windows updated in several months.

Two days or so ago PC1 did this:
(1) Widgets all died and disappeared off the desktop.
These are NOT MS widgets except for the one Windows Media Player widget
which died also.

(2) Windows Media Player keeps telling me to download TV program info
and I do but it keeps asking. I let it do whatever it was to do for two
days and still asks to download TV program info.

Process Explorer shows Windows Media Player app running taking 25% CPU
when running.

It seems to only download a day or two TV programming schedule then quits.

No other Internet anomalies as I have downloaded many files including
multi-megabye files with no problem

PC2 does not have a tuner so can not check TV programming downloads.

PC2 views PC1 recorded TV programs just fine over LAN or WiFi.

PC2 has same widgets working just fine.

Both PC2 on line, on LAN and talking to Internet.

Have booted PC1 but no help.

Widgets are a security risk. These are the gadgets sitting
in the sidebar. As I understand it, they may be HTML/JS, but
without sufficient security precautions.

If a widget is "self-updating", and the original developer
gives control to a black hat, just about anything could happen.
Maybe a widget could download new HTML/JS code or something.

This is why widgets are deprecated.

https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets

"Citing security, Microsoft has released a Fixit tool
to disable Desktop Gadgets on all operating systems."

*******

"WMP drawing 25% CPU", means you have a quad core computer
(or a dual core with Hyperthreading), and it is actually
"railed on one core". While WMP might be scanning some folder
with media in it, I have to wonder.

Go to Sysinternals.com (a Microsoft site) and download Process Monitor.
The procmon.exe utility, will display ETW events. What you'd want to
filter on, is discover the executable name of WMP (that's probably
in your Task Manager right now), then look in the Procmon window
for events from it. For example, there might be WMP "CreateFile",
"ReadFile", or "WriteFile" entries. Based on those, you could
see if WMP is scanning some media folder or whatever. The tick
box in the File menu, if you remove the tick, it stops collecting
events. Then you can review them at your leisure, apply filters
to the display and so on.

It sounds like the machine has been "media serving" to the
other computer. But again, I don't know the significance of
such an observation.

If I was there, I'd have to do some additional observation,
to get some hint as to what is going on.

Windows Media Player is not the same thing as Media Center.
Media Center, if you have a TV Tuner and make regular
TV recordings, it needs Guide Data. And it would be Media
Center which is failing during the download of Guide Data.
Sometimes, it would be the Guide Data provider which is the
source of the problem. The two problems may not be related,
except by some system compromise yet to be discovered.

I'm not recommending AV scans yet, until you've had a look
to gather details. If the computer will not allow ProcMon,
ProcExp, TaskManager, or anything of that sort to run,
then you're compromised, and need to do an offline scan.

In terms of things railing, a SVCHOST containing wuauserv can
also rail. You can use Process Explorer from Sysinternals.com
to list the contents of a SVCHOST, and see which one is involved.
If you run Process Explorer as Administrator (right click, Run
As Administrator), it will also allow you to look at Threads
and Stack. Threads is good, because you can see wuauserv
sucking up all the cycles in there :-) I don't see an advantage
to using Process Explorer right away for your WMP symptoms
(railed), as WMP is "visible" in Task Manager, and we already
know it has a problem. Process Explorer helps with SVCHOST
issues, and shines a little more light on those.

Process Explorer also has a menu item, to send an executable
it is observing, to Virustotal.com for a scan. I've not used
this (yet). I use Virustotal.com (a Google company) standalone,
but I can imagine some day, on a compromised machine, perhaps
needing that.

Paul

On Mon, 6 Feb 2017 19:44:19 -0800
Win7User wrote:

Two Win 7 Pro PCs.

No problems on PC2.

PC1 has problems and has same widgets as PC2.
Neither Windows updated in several months.

Two days or so ago PC1 did this:
(1) Widgets all died and disappeared off the desktop.
These are NOT MS widgets except for the one Windows Media Player
widget which died also.

(2) Windows Media Player keeps telling me to download TV program info
and I do but it keeps asking. I let it do whatever it was to do for
two days and still asks to download TV program info.

Process Explorer shows Windows Media Player app running taking 25%
CPU when running.

It seems to only download a day or two TV programming schedule then
quits.

No other Internet anomalies as I have downloaded many files including
multi-megabye files with no problem

PC2 does not have a tuner so can not check TV programming downloads.

PC2 views PC1 recorded TV programs just fine over LAN or WiFi.

PC2 has same widgets working just fine.

Both PC2 on line, on LAN and talking to Internet.

Have booted PC1 but no help.

That happens a lot after the NSA clones your drives.

I hope they enjoy KPOP !

So sorry, I misspoke. It is Windows Media Center !
Too much stress lately.

This is a disaster for me.
It recorded some TV shows but not others and none were in conflict
time-wise.

I have many hundred gigs of HDD to record and lots of available RAM.
I checked both.

As I said I have not downloaded anything in months and it was all
working perfectly until just a few days ago.

I can understand if one widget had a problem but not several simultaneously.

Nothing else seems to be having any problems.

Is there some free general diagnostic SW I can run to check RAM and CPU
etc ?

Win7User wrote:
So sorry, I misspoke. It is Windows Media Center !
Too much stress lately.

This is a disaster for me.
It recorded some TV shows but not others and none were in conflict
time-wise.

I have many hundred gigs of HDD to record and lots of available RAM.
I checked both.

As I said I have not downloaded anything in months and it was all
working perfectly until just a few days ago.

I can understand if one widget had a problem but not several
simultaneously.

Nothing else seems to be having any problems.

Is there some free general diagnostic SW I can run to check RAM and CPU
etc ?


For RAM, there is memtest86+.
Available as an ISO, so you can burn a boot CD.

The downloads are 50% down on this long web page.

http://www.memtest.org/

Once you're prepared the bootable CD, the test can
run forever. Usually, waiting until the "Pass Count = 1",
that's enough testing. What it is good for mainly,
is stuck-at faults, where a data bit refuses to change
states. For speed faults, you want the next one.

Press the esc key, to end the test and reboot the
computer. Remove the CD from the drive, before you
press esc so that the setup can boot using the
OS and hard drive again. The reason the program must
boot from the CD, is so it can test *all* the memory.
What it lacks in stress, it makes up for by testing
all but about 1MB of RAM. You can make it test 100%
of the bytes, but that requires moving RAM sticks around,
and isn't something you contemplate for normal usage
(nobody really wants to take the side off the PC).

*******

Prime95 Torture Test is one test you can apply to a CPU.
It tests CPU and RAM. The "blended" test might test both.
If a "small FFT" is used, it stays in CPU cache (less
RAM testing).

http://www.mersenne.org/download/

When it asks to "Join GIMPS", answer "Just Testing". You
don't need to contribute CPU time to the effort to find
Mersenne Prime numbers, even if there is a cash reward.

The modern versions of that, might use AVX2 instructions, but
not everyone has a CPU with those in it. The program will test
what it can find - if it uses AVX2 the CPU just gets pretty warm :-)
My best machine, only has AVX, so it doesn't get really hot.
Even older machines, all they would have is some flavor of SSE.

https://s28.postimg.org/ve04pgfl9/prime95_test.gif

The guy who writes that code, is pretty clever. He custom-codes
some of it in assembler, for best performance. And conversely,
for "best heat". So that's a demanding application. The Torture
Test checks the answer that the math is producing, and that's
what makes it sensitive to any sort of error. Either a memory
error or a CPU error, will cause one of the running threads
status indicator to turn RED in color. The GREEN ones are OK.
If they all stay GREEN for four hours, you're done and in good shape.
You can see in my picture, they're all green at the moment.
(I was just running that, so I could take the screenshot.)

My worst result on Prime95, was a "lightly" overclocked AMD
CPU, which would report an error in only two seconds. So that
is how quickly it can figure out your CPU is crap. After four
hours, it will have done trillions of cycles.

Paul