IE Caution = eBay Toolbar + Ssdpsrv

Just a note with a caution about eBay toolbar.

I find that blocking Ssdpsrv service to eBay often puts my winME 1.1
GHZ Athlon (Sempron?) into a kernel processing loop which is a real
drag on the system.

The Process Viewer Application that came ages ago with MS VC 4 will
easily kill this eBay service and fix the problem until the next
Internet Explorer session is started. I use ie6.0.

How can I control what services IE launches?

Mike
Tue Dec 18 16:51:10 PST 2007

Bob <SierraBrother@gmail.com> wrote:

> Just a note with a caution about eBay toolbar.
>
> I find that blocking Ssdpsrv service to eBay often puts my winME 1.1
> GHZ Athlon (Sempron?) into a kernel processing loop which is a real
> drag on the system.
>
> The Process Viewer Application that came ages ago with MS VC 4 will
> easily kill this eBay service and fix the problem until the next
> Internet Explorer session is started. I use ie6.0.
>
> How can I control what services IE launches?

By removing unnecessary toolbars, BHOs (browser help objects), etc. BTW
Win Me doesn't as such have "services", they're an NT/XP/Vista concept,
however ssdpsrv.exe is launched each time you boot your system from a
value in the HKLM Registry RunServices key
(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices)

ssdpsrv is part of Win Me's implementation of uPnP (Universal Plug and
Play) and if not required can be uninstalled via Add/Remove Programs |
Windows Setup | Select Communications and click Details | Uncheck
"Universal Plug n Play", click OK, Apply and preferably reboot. I'm
unclear how uPnP is related to use of the eBay toolbar however I have
never installed or used that toolbar, and am unlikely to do so, so I can't
help there.

uPnP is used to communicate with other devices on your network, for
example it might be used by a Bit Torrent client or other uPnP aware
application to open ports and set up paths in a router.
--
Mike Maltby
mike.maltby@gmail.com

llanalott
Tue Dec 18 21:50:12 PST 2007



Bob wrote:
> Just a note with a caution about eBay toolbar.
>
> I find that blocking Ssdpsrv service to eBay often puts my winME 1.1
> GHZ Athlon (Sempron?) into a kernel processing loop which is a real
> drag on the system.
>
> The Process Viewer Application that came ages ago with MS VC 4 will
> easily kill this eBay service and fix the problem until the next
> Internet Explorer session is started. I use ie6.0.
>
> How can I control what services IE launches?

Could it be found in add remove programs?

Maybe in start> run> msconfig and look for references to the toolbar
then uncheck if found.

Bob
Wed Dec 19 16:10:23 PST 2007

On Dec 18, 4:51 pm, "Mike M" <No_Spam@Corned_Beef.Only> wrote:
> Bob <SierraBrot...@gmail.com> wrote:
> > Just a note with a caution about eBay toolbar.
>
> > I find that blocking Ssdpsrv service to eBay often puts my winME 1.1
> > GHZ Athlon (Sempron?) into a kernel processing loop which is a real
> > drag on the system.
>
> > The Process Viewer Application that came ages ago with MS VC 4 will
> > easily kill this eBay service and fix the problem until the next
> > Internet Explorer session is started. I use ie6.0.
>
> > How can I control what services IE launches?
>
> By removing unnecessary toolbars, BHOs (browser help objects), etc. BTW
> Win Me doesn't as such have "services", they're an NT/XP/Vista concept,
> however ssdpsrv.exe is launched each time you boot your system from a
> value in the HKLM Registry RunServices key
> (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices)
>
> ssdpsrv is part of Win Me's implementation of uPnP (Universal Plug and
> Play) and if not required can be uninstalled via Add/Remove Programs |
> Windows Setup | Select Communications and click Details | Uncheck
> "Universal Plug n Play", click OK, Apply and preferably reboot. I'm
> unclear how uPnP is related to use of the eBay toolbar however I have
> never installed or used that toolbar, and am unlikely to do so, so I can't
> help there.
>
> uPnP is used to communicate with other devices on your network, for
> example it might be used by a Bit Torrent client or other uPnP aware
> application to open ports and set up paths in a router.
> --
> Mike Maltby
> mike.mal...@gmail.com


Hi Mike & Llanal
First let me say you guys and gals in this group are wonderful. And
second let me say I do not know if this is serious or not, I did see
how it led to putting the processor in a fairly tight loop - like
running an AV test.

Let me backup for a second. Last month I switched from ZA to AVG. Ten
days back, I signed on with Google for their toolbar. Years ago, I
signed up for one tied to my Epson printer. I mention because I guess
these might all involve ssdpsrv.

When I boot this winME, I get SSDP notices:
First one asks if I approve X.Y.0.Z1:1900 local comm. with
0.0.84.252:56504 remote? I deny permission (until I better understand
whats going on).
Several minutes later, I get 2nd SSDP notice in an AVG Firewall
Confirmation screen: Do I approve eBay Toolbar Daemon 0.0.0.0:1036
local comm. with X.Y.0.Z2:53 remote? No, again.

Also I have looked for these IP / IP+ports in my registry with no
luck.
I mentioned previously that starting IE6 will trigger a SSDP notice.
Today I noticed that a new IE6 sessions triggered a new firewall
notice (about eBay and sometimes not mentioning SSDP) only after I
used pView to terminate the eBayToolbarDaemon process. After
terminating that process then firing up a new IE session, an AVG
Firewall Confirmation screen pops up and says Application 'eBay
Toolbar Daemon' is trying to establish UDP connection with remote X.Y.
0.Z1 on port :53. If one looks at the 'details' a little more info is
given: local address is 0.0.0.0:1339, comms with remote (Router) port
53.
Thanks for the reminder to look thru Add/Remove Programs. I had
forgotten (if I ever knew) it was in there. Do you think
"ToolbarSetup" takes care of all of these?
Add/Remove Programs does show ToolBarSetup. Sounds like he is the
culprit.


I also checked the registry where you said (HKLM\...\Run) -- a total
of 27 items there including eBay Toolbar. Not much enlightenment there
that I could see:
I looked to see if the IP address or eBay is mentioned:
Ebay toolbar is mentioned 4 places in MyComputer\HKR:
1-MyComputer\HKR\eBayToolbarCommLib.IWebEvent,
2-" " " IWebEvent.1,
3-" " eBayToolbarRCSearchLib.IRCSearch,
4-" " " ".1
guid {B7856497-7097-424a-B03C-557ACA6477B4}
associated with Program Files\Ebay toolbar2\Ebaytoolbarcomm.dll
Typelib HKEY_CLASSES_ROOT\CLSID\{B7856497-7097-424a-
B03C-557ACA6477B4}\TypeLib
associated with {6A28870C-9ABB-48c6-82BB-64442C1925B9}
associated with My Computer\HKCR\TypeLib eBay Toolbar Notification 1.0
Type Library
associated with MyComputer\HKLM\Software\Classes\Clsid\
{B7856497-7097-424a-B03C-557ACA6477B4}
{6A28870C-9ABB-48c6-82BB-64442C1925B9}
associated with My Computer\HKLM\Software\Classes\Typelib
\{6A28870C-9ABB-48c6-82BB-64442C1925B9}

I did not see anything like an IP address with these but I'm good at
overlooking.

Mike
Wed Dec 19 17:36:23 PST 2007

Serious? Not really as the locking up isn't as such a Win Me problem and
as far as I know you alone are affected. I've already suggested one
solution, that is to dump the eBay toolbar, personally I'd dump all 3rd
party tool bars (Ask, Google, Yahoo, etc) since I feel they add nothing
other than take up space on the screen, and, if not required, uninstall
uPnP. All the more so if you aren't really sure what if any benefits it
is bringing or if you don't need it to control other devices on your LAN.

As I have previously mentioned I can think of no good reason, or even a
bad reason, why uPnP is involved in your toolbar use other than perhaps
being used by the toolbar to open ports and route traffic through your
router. If you don't want this to happen then the answer is to either
uninstall uPnP or the toolbar or both. Also if not using uPnP for other
applications you might find that you can also disable it in the router
setup.

> Do you think
> "ToolbarSetup" takes care of all of these?
> Add/Remove Programs does show ToolBarSetup. Sounds like he is the
> culprit.

I would assume so, although I would have thought it would have been
labelled as "eBay Toolbar ...". Whatever it is it is something that you
have added since it isn't anything as such to do with the operating
system.


> I did not see anything like an IP address with these but I'm good at
> overlooking.

uPnP will get the address of your router from your network configuration.
That is the only IP address that it is likely to be using together with
that of the machine on which it is running.
--
Mike Maltby
mike.maltby@gmail.com


Bob <SierraBrother@gmail.com> wrote:

> Hi Mike & Llanal
> First let me say you guys and gals in this group are wonderful. And
> second let me say I do not know if this is serious or not, I did see
> how it led to putting the processor in a fairly tight loop - like
> running an AV test.
>
> Let me backup for a second. Last month I switched from ZA to AVG. Ten
> days back, I signed on with Google for their toolbar. Years ago, I
> signed up for one tied to my Epson printer. I mention because I guess
> these might all involve ssdpsrv.
>
> When I boot this winME, I get SSDP notices:
> First one asks if I approve X.Y.0.Z1:1900 local comm. with
> 0.0.84.252:56504 remote? I deny permission (until I better understand
> whats going on).
> Several minutes later, I get 2nd SSDP notice in an AVG Firewall
> Confirmation screen: Do I approve eBay Toolbar Daemon 0.0.0.0:1036
> local comm. with X.Y.0.Z2:53 remote? No, again.
>
> Also I have looked for these IP / IP+ports in my registry with no
> luck.
> I mentioned previously that starting IE6 will trigger a SSDP notice.
> Today I noticed that a new IE6 sessions triggered a new firewall
> notice (about eBay and sometimes not mentioning SSDP) only after I
> used pView to terminate the eBayToolbarDaemon process. After
> terminating that process then firing up a new IE session, an AVG
> Firewall Confirmation screen pops up and says Application 'eBay
> Toolbar Daemon' is trying to establish UDP connection with remote X.Y.
> 0.Z1 on port :53. If one looks at the 'details' a little more info is
> given: local address is 0.0.0.0:1339, comms with remote (Router) port
> 53.
> Thanks for the reminder to look thru Add/Remove Programs. I had
> forgotten (if I ever knew) it was in there. Do you think
> "ToolbarSetup" takes care of all of these?
> Add/Remove Programs does show ToolBarSetup. Sounds like he is the
> culprit.
>
>
> I also checked the registry where you said (HKLM\...\Run) -- a total
> of 27 items there including eBay Toolbar. Not much enlightenment there
> that I could see:
> I looked to see if the IP address or eBay is mentioned:
> Ebay toolbar is mentioned 4 places in MyComputer\HKR:
> 1-MyComputer\HKR\eBayToolbarCommLib.IWebEvent,
> 2-" " " IWebEvent.1,
> 3-" " eBayToolbarRCSearchLib.IRCSearch,
> 4-" " " ".1
> guid {B7856497-7097-424a-B03C-557ACA6477B4}
> associated with Program Files\Ebay toolbar2\Ebaytoolbarcomm.dll
> Typelib HKEY_CLASSES_ROOT\CLSID\{B7856497-7097-424a-
> B03C-557ACA6477B4}\TypeLib
> associated with {6A28870C-9ABB-48c6-82BB-64442C1925B9}
> associated with My Computer\HKCR\TypeLib eBay Toolbar Notification 1.0
> Type Library
> associated with MyComputer\HKLM\Software\Classes\Clsid\
> {B7856497-7097-424a-B03C-557ACA6477B4}
> {6A28870C-9ABB-48c6-82BB-64442C1925B9}
> associated with My Computer\HKLM\Software\Classes\Typelib
> \{6A28870C-9ABB-48c6-82BB-64442C1925B9}
>
> I did not see anything like an IP address with these but I'm good at
> overlooking.