svchost.exe/Tane Question

I noticed something that strikes me as really odd. I was goofing on the web, when all of the sudden my computer started lagging hard. Deep investigation revealed that svchost.exe(LocalSystemNetworkRestricted) was bogging down my HDD with multiple, random instances af TANE related data reads. At this time all I have done was turn on the computer, clear emails, and poked around Youtube and FB. Never touched the TANE program yet. The real Q here is: Is this normal, or is there something hinky going on?

This oddity lasted 2ish minutes, then purged the Resource monitor of all tane related info. No record of TANE on the CPU, Internet, or RAM sections.

Ran TANE, all works as "normal".

Build 88364 (SP2 HF0)

maruffijd said:

I noticed something that strikes me as really odd. I was goofing on the web, when all of the sudden my computer started lagging hard. Deep investigation revealed that svchost.exe(LocalSystemNetworkRestricted) was bogging down my HDD with multiple, random instances af TANE related data reads. At this time all I have done was turn on the computer, clear emails, and poked around Youtube and FB. Never touched the TANE program yet. The real Q here is: Is this normal, or is there something hinky going on?

This oddity lasted 2ish minutes, then purged the Resource monitor of all tane related info. No record of TANE on the CPU, Internet, or RAM sections.

Ran TANE, all works as "normal".

Build 88364 (SP2 HF0)

Click to expand...

I would suspect something hinky going on with an errant script or something worse.

I recommend running a malware scan using your antivirus as well as running something which is aimed at network junk such as Super AntiSpyware

Once you've run these, I recommend running SFC from an administrator-enabled command prompt.

The exact syntax for this is SFC/ SCANNOW . (Press enter after entering this in).

This is Windows' built-in O/S file-checking which will sort out any errors with the files. I have noticed after running this, things run better sometimes.

If there is something found by your antimalware scanner, I recommend running DISM, which is also run from an admin-enabled command prompt.

There are many options for this rather obtuse utility, which is used to restore files from Windows' O/S file repository, or sometimes from specific windows install archives and sources.

But these two are the ones you need to run:

DISM.exe /Online /Cleanup-image /Scanhealth
DISM.exe /Online /Cleanup-image /Restorehealth

Remember to press enter after running each one separately.

LONG POST DUE TO LOG DATA.

I have ran all recommended programs and here is what I got.

Malware had 1 bad file that I killed. However CMD prompt gives the following results:

Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc/scannow

Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 14% complete.

Windows Resource Protection could not perform the requested operation
.
C:\WINDOWS\system32>sfc/scannow

Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 14% complete.

Windows Resource Protection could not perform the requested operation.

C:\WINDOWS\system32>DISM.exe/online/cleanup-image/scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.10586.0


Error: 87

The online/cleanup-image/scanhealth option is unknown.
For more information, refer to the help by running DISM.exe /?.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

C:\WINDOWS\system32>DISM.exe/online/cleanup-image/restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.10586.0


Error: 87

The online/cleanup-image/restorehealth option is unknown.
For more information, refer to the help by running DISM.exe /?.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log


The above log gives the following long list info, minus all before todays date(8/03):


2017-08-05 00:54:11, Info DISM PID=3316 TID=6500 Scratch directory set to 'C:\Users\MARUFF~1\AppData\Local\Temp\'. - CDISMManager:ut_ScratchDir
2017-08-05 00:54:11, Info DISM PID=3316 TID=6500 DismCore.dll version: 10.0.10586.0 - CDISMManager::FinalConstruct
2017-08-05 00:54:11, Info DISM PID=3316 TID=6500 Successfully loaded the ImageSession at "C:\WINDOWS\System32\Dism" - CDISMManager::LoadLocalImageSession
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Failed to get and initialize the PE Provider. Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has previously been initialized. Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has previously been initialized. Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Manager: PID=3316 TID=6500 Successfully created the local image session and provider store. - CDISMManager::CreateLocalImageSession
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has previously been initialized. Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM.EXE:
2017-08-05 00:54:11, Info DISM DISM.EXE: <----- Starting Dism.exe session ----->
2017-08-05 00:54:11, Info DISM DISM.EXE:
2017-08-05 00:54:11, Info DISM DISM.EXE: Host machine information: OS Version=10.0.10586, Running architecture=amd64, Number of processors=4

Continued as character limit reached. Plaease excuse the double post please.

2017-08-05 00:54:11, Info DISM DISM.EXE: Dism.exe version: 10.0.10586.0
2017-08-05 00:54:11, Info DISM DISM.EXE: Executing command line: dism.exe /online/cleanup-image/scanhealth
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Getting the collection of providers from a local provider store type. - CDISMProviderStore::GetProviderCollection
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\FolderProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\FolderProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\WimProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\WimProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\VHDProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\VHDProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\ImagingProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\ImagingProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\CompatProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\CompatProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Loading Provider from location C:\WINDOWS\System32\Dism\FfuProvider.dll - CDISMProviderStore::Internal_GetProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Connecting to the provider located at C:\WINDOWS\System32\Dism\FfuProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2017-08-05 00:54:11, Info DISM DISM.EXE: Got the collection of providers. Now enumerating them to build the command table.
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: DISM Log Provider
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: FolderManager
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: WimManager
2017-08-05 00:54:11, Info DISM DISM.EXE: Succesfully registered commands for the provider: WimManager.
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: VHDManager
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: GenericImagingManager
2017-08-05 00:54:11, Info DISM DISM.EXE: Succesfully registered commands for the provider: GenericImagingManager.
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: Compatibility Manager
2017-08-05 00:54:11, Info DISM DISM.EXE: Succesfully registered commands for the provider: Compatibility Manager.
2017-08-05 00:54:11, Info DISM DISM.EXE: Attempting to add the commands from provider: FfuManager
2017-08-05 00:54:11, Error DISM DISM.EXE: No providers were found that support the command(online/cleanup-image/scanhealth). HRESULT=80070057
2017-08-05 00:54:11, Info DISM DISM.EXE: Image session has been closed. Reboot required=no.
2017-08-05 00:54:11, Info DISM DISM.EXE:
2017-08-05 00:54:11, Info DISM DISM.EXE: <----- Ending Dism.exe session ----->
2017-08-05 00:54:11, Info DISM DISM.EXE:
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Found the OSServices. Waiting to finalize it until all other providers are unloaded. - CDISMProviderStore::Final_OnDisconnect
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: FolderManager - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: WimManager - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: VHDManager - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: GenericImagingManager - CDISMProviderStore::Internal_DisconnectProvider

Continued 1 more time. limit again.2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: Compatibility Manager - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Disconnecting Provider: FfuManager - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:54:11, Info DISM DISM Provider Store: PID=3316 TID=6500 Releasing the local reference to DISMLogger. Stop logging. - CDISMProviderStore::Internal_DisconnectProvider
2017-08-05 00:55:02, Info DISM PID=6076 TID=1720 Scratch directory set to 'C:\Users\MARUFF~1\AppData\Local\Temp\'. - CDISMManager:ut_ScratchDir
2017-08-05 00:55:02, Info DISM PID=6076 TID=1720 DismCore.dll version: 10.0.10586.0 - CDISMManager::FinalConstruct
2017-08-05 00:55:02, Info DISM PID=6076 TID=1720 Successfully loaded the ImageSession at "C:\WINDOWS\System32\Dism" - CDISMManager::LoadLocalImageSession
2017-08-05 00:55:02, Info DISM DISM Provider Store: PID=6076 TID=1720 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2017-08-05 00:55:02, Info DISM DISM Provider Store: PID=6076 TID=1720 Failed to get and initialize the PE Provider. Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect
2017-08-05 00:55:02, Info DISM DISM Provider Store: PID=6076 TID=1720 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect

maruffijd said:

I noticed something that strikes me as really odd. I was goofing on the web, when all of the sudden my computer started lagging hard. Deep investigation revealed that svchost.exe(LocalSystemNetworkRestricted) was bogging down my HDD with multiple, random instances af TANE related data reads.

Click to expand...

svchost.exe is the application used by Windows services. It was likely doing some file cleanups - perhaps files not properly closed or updated into the system file index, but more likely something like purging recently-used file lists or the recycle bin, or updating application usage statistics. You will often see this sort of housework soon after startup.

SailorDan said:

svchost.exe is the application used by Windows services. It was likely doing some file cleanups - perhaps files not properly closed or updated into the system file index, but more likely something like purging recently-used file lists or the recycle bin, or updating application usage statistics. You will often see this sort of housework soon after startup.

Click to expand...

Now I feel silly. I completely forgot OS's do this at times. Oh well live and relearn.