it runs cryptographis services, dns client, network location awareness, and workstation. i have process monitor but have no clue what i'm doing. on process monitor i find service host with same pid is constantly running and checked to make sure it was in the system 32 and not an outsider version.

and something i found in the process monitor that seemed odd...any ideas is a huge help.

Date & Time: 7/27/2014 4:05:39 PM Event Class: Registry Operation: RegOpenKey Result: NAME NOT FOUND Path: HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces{3ced0421-69f8-4b8e-ac8b-8ac75d8d6bb3} TID: 3900 Duration: 0.0000118 Desired Access: Query Value