I'm wondering how you set up svchost.exe. I have DNS client disabled in services and i'm using DNS lookup on a per application basis - locking down scvhost for just bootps and bootpc (DHCP and Remote Address) with TCP in/out and UDP completely blocked. Are you using something similar or what?