DNS issue causing delay in opening jpeg on desktop?

[ZeroOne]

This is really starting to drive me crazy... and I'm hoping someone on here has seen it. I've also been getting tech support calls left and right for similar behavior. It's happening on a number of XP pc's, especially those on larger (but simple) networks. Each computer has a different trigger but all seem to do the same thing. Most of the complaints all mention this starting a couple of months ago.

The action:

• double clicking a file (on mine, a jpeg) that resides on the desktop (or desktop folder in user account)
• clicking a link in an outlook email
• double clicking an MS office document

Result...

• lag...
• explorer appears to hang...
• the desktop wallpaper starts to "paint" with the echo effect when dragging windows.

Processor is idle, memory has at least half free, hard drive is calm / low activity. You are basically stuck... staring and waiting.

30sec to 5 MINUTES later (depending on the workstation / network), explorer goes back to normal, and the file opens, or link in an email finally triggers IE, as well as everything you've clicked on while waiting comes back to life.


Here is where it gets weird.....
If you disconnect the ethernet cable or turn off wifi... it goes away completely and files open lightning fast.

Opening ProcXP and tcpview, then clicking on the file, you can watch the "system" process try to connect to 208.69.32.132 (hit-nxdomain.opendns.com) on remote port 445 with a SYN_SENT.

ONLY after the SYN_SENT times out, will the file, residing on the desktop, open.


...and yet, even more bizarre

At home I have a WRT54GL with DD-WRT on it. There 2 wifi networks set up, encrypted, and on different subnets / 2 different dhcp servers. No sharing between. When I connect to my main branch that houses my file server and other computers... files open instantly. No issue. If I connect to the other branch of the network that cannot see my server, I get lag opening the files. The lag I get on this branch shows this time "svchost" connecting to the same IP as above, but using port 80, and the delay in the file opening is much shorter. 10 sec compared to 30. Using ProcXP, it shows "webclient" as being the only service running under that instance of svchost.

I don't get why so many computers (my laptop, and computers at 3 separate businesses) all are having this issue. The one common denominator is that they all have a server sharing files on the network they are usually connected to.

For reference, there are no dead mapped drives, and in my case, no printers whatsoever. The other places do have network printers but all are working and configured correctly.

I felt sorry for one guy... he clicked on a youtube link in an email and his computer was down for about 10 minutes. That was the worst one I'd seen. Most topped out at 5min of hang time.


Thank you for ANY advice you may have!!! And if you made it this far... thanks for reading!!!

[ZeroOne]

Additional info:

Just noticed... while I have no lag when opening files on my branch of the network, the computer does open a file sharing (port 139) connection to my server, instantly upon clicking the file, even though it's just a jpeg on my desktop that I've opened.

Raising my firewall settings while on my servers network to block local services, then opening the desktop jpeg, result in 2 entries in TCPview showing a 139 and 445 SYN_SENT from SYSTEM process to the lan IP of my file server... those time out, then it attempts the 208.69.32.132 on port 80 using SVCHOST (with webclient service running under it). That connects quickly, closes, then the file opens.

I understand that its probably using DNS to look for my server while on another network, not finding it, and then opening the file... but WHY does it need to see the server for a totally unrelated task, and then hunt for it, hanging the computer when I'm not on the home network? The other people who do have this issue have desktops that do not roam. They are ON their "home" network, so to speak.