It looks like thread 27 is indeed where we're hung, but from the explorer dump we can't tell for certain exactly why - we're talking to a COM object that is out-of-process in a service host process:
CODE
0:027> kb
ChildEBP RetAddr Args to Child
08b4e048 762dafb9 752413ff 08b4e0cc 00000000 ntdll!KiFastSystemCallRet
08b4e04c 752413ff 08b4e0cc 00000000 000003e0 user32!NtUserRealInternalGetMessage+0xc
08b4e088 752416f6 08b4e0cc 00000000 000003e0 duser!CoreSC::xwProcessNL+0xf5
08b4e0ac 762daff1 08b4e0cc 00000000 000003e0 duser!MphProcessMessage+0x33
08b4e0f4 77980e6e 08b4e10c 00000014 08b4e1b8 user32!__ClientGetMessageMPH+0x30
08b4e11c 762dc5b4 762dc573 08b4e1ec 00000000 ntdll!KiUserCallbackDispatcher+0x2e
08b4e120 762dc573 08b4e1ec 00000000 000003e0 user32!NtUserPeekMessage+0xc
08b4e148 762dc5cd 08b4e1ec 00000000 000003e0 user32!_PeekMessage+0x74
08b4e174 76a16449 08b4e1ec 00000000 000003e0 user32!PeekMessageW+0xfa
08b4e1c8 76a163fe 08b4e1ec 00000000 000003e0 ole32!CCliModalLoop::MyPeekMessage+0x30
08b4e208 76a167be 08b4e3ac 0230c328 00000000 ole32!CCliModalLoop::PeekRPCAndDDEMessage+0x30
08b4e21c 76a2d001 08b4e23c 000003e8 08b4e24c ole32!CCliModalLoop::BlockFn+0x62
08b4e244 76b1802c ffffffff 0230c328 08b4e350 ole32!ModalLoop+0x5b
08b4e260 76b19984 00000000 08b4e364 00000000 ole32!ThreadSendReceive+0x12c
08b4e288 76b197f0 08b4e350 01ad0e20 08b4e3ac ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x194
08b4e368 76a2d0a7 01ad0e20 08b4e524 08b4e474 ole32!CRpcChannelBuffer::SendReceive2+0xe7
08b4e384 76a2d059 08b4e524 08b4e474 01ad0e20 ole32!CCliModalLoop::SendReceive+0x1e
08b4e3fc 76a44bdb 01ad0e20 08b4e524 08b4e474 ole32!CAptRpcChnl::SendReceive+0x73
08b4e450 76471dd0 01ad0e20 08b4e524 08b4e474 ole32!CCtxComChnl::SendReceive+0x1c5
08b4e468 76471d87 0038070c 08b4e57c 76471f58 rpcrt4!NdrProxySendReceive+0x43
08b4e474 76471f58 e01a6075 08b4e998 070001f3 rpcrt4!NdrpProxySendReceive+0xc
08b4e95c 76471d64 76a382f0 76a3f09e 08b4e998 rpcrt4!NdrClientCall2+0xbde
08b4e980 763f3763 08b4e998 00000004 08b4ea00 rpcrt4!ObjectStublessClient+0x6f
08b4e990 76a13820 0038070c 00000000 08b4ee54 rpcrt4!ObjectStubless+0xf
08b4ea00 76a138f5 08b4ee54 08b4f3c4 00000000 ole32!CRpcResolver::CreateInstance+0x195
08b4ec5c 76a37021 76b1e4bc 00000000 08b4ee54 ole32!CClientContextActivator::CreateInstance+0x11f
08b4ec9c 76a36f49 08b4ee54 00000000 08b4f3c4 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108
08b4f478 76a4dbc7 6a92e7c4 00000000 00000004 ole32!ICoCreateInstanceEx+0x403
08b4f4d8 76a4de0a 6a92e7c4 00000000 00000004 ole32!CComActivator::DoCreateInstance+0xd9
08b4f4fc 76a4ddc3 6a92e7c4 00000000 00000004 ole32!CoCreateInstanceEx+0x38
08b4f52c 6a9785ca 6a92e7c4 00000000 00000004 ole32!CoCreateInstance+0x37
08b4f57c 6a979354 08b4f59c 08b4f598 08b4f5a0 netcenter!MiniMap::_GetNetworkStatus+0x4d
08b4f5a4 6a92fdb4 00000001 0303dab0 6a9393ff netcenter!MiniMap::UpdateStatus+0x1d
08b4f5b0 6a9393ff 08a6eeeb 0303db34 0303dab0 netcenter!CSNOCplCore::NotifyMiniMap+0x29
08b4f5f0 6a939b09 6a9127ec 6a97e000 0303dab0 netcenter!CSNOCplCore::HandleConnectivityChange+0x311
08b4f60c 6a93c157 08b4f6bc 000708ce 00000000 netcenter!CSNOCplCore::Refresh+0x109
08b4f620 6a93c93d 000708ce 00008001 00000000 netcenter!CMessageWindow::v_WndProc+0x337
08b4f640 762e1a10 000708ce 00008001 00000000 netcenter!CMessageWindow::s_WndProc+0x28
08b4f66c 762e1ae8 6a93c915 000708ce 00008001 user32!InternalCallWinProc+0x23
08b4f6e4 762e2a47 00000000 6a93c915 000708ce user32!UserCallWinProcCheckWow+0x14b
08b4f748 762e2a98 6a93c915 00000000 08b4f794 user32!DispatchMessageWorker+0x322
08b4f758 7268b8fa 08b4f770 00000003 00000000 user32!DispatchMessageW+0xf
08b4f794 7268cb0b 00000000 00000000 02f0e268 browseui!CBrowserFrame::FrameMessagePump+0x14f
08b4f7a8 7268cc90 02f47b78 00000000 00000000 browseui!BrowserThreadProc+0x5e
08b4f7c0 76223833 02f47b78 08b4f80c 7795a9bd browseui!BrowserNewThreadProc+0x43
08b4f7cc 7795a9bd 02f47b78 08b43eb9 00000000 kernel32!BaseThreadInitThunk+0xe
08b4f80c 00000000 7268cc4d 02f47b78 00000000 ntdll!_RtlUserThreadStart+0x23
Knowing that the class ID for the COM object is netman from looking at the CComActivator function, and that the netcenter GetNetworkStatus function is talking to dll netprofm.dll, we're talking to the service host that contains the Network List Service service:
CODE
0:000> u netprofm!CImplINetworkListManager::EnumNetworks
netprofm!CImplINetworkListManager::EnumNetworks:
6dc826fd 8bff mov edi,edi
6dc826ff 55 push ebp
6dc82700 8bec mov ebp,esp
6dc82702 51 push ecx
6dc82703 53 push ebx
6dc82704 56 push esi
6dc82705 57 push edi
6dc82706 a10030cb6d mov eax,dword ptr [netprofm!WPP_GLOBAL_Control (6dcb3000)]
At this point, the problem is outside of the netcenter window, and likely in COM (or the Network List Service isn't running at all, however I do doubt that).
@lukenuske - Can you get a complete dump of your Vista box the next time you are able to make this happen? You can configure your machine to dump via the keyboard if you have a PS/2 keyboard attached to the box, by following these instructions:
1. Create or set the following registry value:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
Value: CrashOnCtrlScroll
Type: REG_DWORD
Data: 1
2. Right-Click on the "My Computer" icon on the desktop and select "Properties", then click the "Advanced System Settings" link. On the "Advanced" tab, click "Settings" under the "Performance" header. Click the "Advanced" tab, then click "Change" under "Virtual Memory". Set the pagefile to be located on the partition where the OS is installed, and set it to be equal to Physical RAM + 50 MB.
3. Also in the "System Properties" window on the "Advanced" tab, click the "Settings" buttun under the "Startup and Recovery" header. Make sure "Complete Memory Dump" is selected (see 3a if this is not in the list). You can change the location of the memory dump file to a different local partition if you do not have enough room on the partition where the OS is installed.
3a. If the "Complete Memory Dump" option in step 3 is not available, you will need to manually set this registry value:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
Value: CrashDumpEnabled
Type: REG_DWORD
Value: 1
4. You will need to reboot for these changes to take effect.
5. The next time that your Network and Sharing center hangs, wait about 10 seconds and then hold down the RIGHT CTRL key and press the SCROLL LOCK key twice to cause the machine to bugcheck and create a memory dump. After the box comes back up, you'll find the resulting memory dump file in %systemroot%\memory.dmp that can be analyzed.