CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

ZAISS - Traffic Meter Keeps Running!!!
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic       All -> FavForums -> Zone Alarm [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Fri Feb 01, 2008 11:02 am    Post subject: ZAISS - Traffic Meter Keeps Running!!!
Reply with quote

Hi Guys
This is my first visit to this forum and I should be grateful for any advice you may have.

I had ZAISS v. 7.362 running since I bought this new PC last year and I also bought the licence for my other two PCs as well. A few weeks ago I upgraded to v. 70.462 and since then there's been nothing but trouble on this one (although the other two are running fine).

I solved most of the problems connected with the download except one. After launching the new version 7.0.462.000, it immediately kept indicating traffic on the traffic meter logo in the system tray, which continually makes the HDD click away (it seems caused by the generic host [SVCHost] win32 service programme because there are 3 of those files at the top of the control centre of which 1 is always flashing and the internet activity bar is also active). Unfortunately, when I ran a process checker I found the SVC file covered a whole multitude of processes (I attach an image showing which ones).

I have been in touch with ZA and completely uninstalled ZAISS, following their full clean-up advice and ran a registry clean-up programme to be doubly sure. They then advised me to close down all programmes and services at start-up to identfy which one was causing the problem. Unfortunately the traffic meter continued clicking away and I have four (4) scanningprocess.exe running, so I think that suggests something to do with ZA. Their latest advice is to run another complete uninstall and reinstall an earlier version.

Does anyone have any ideas out there? I'm a small business and this is my primary PC and I've spent a lot of business time (and all my spare time) since Christmas trying to find a solution to this most irritating problem! I have limited/ average knowledge of pcs.

My system details are:
Operating System: XP SP2
Motherboard: ASUS TeK P58-Delux Rev1.xx
Graphic Card NVDIA GeForce 88000 GTS
Sound Card: SoundMax Integrated Digital HD Audio
Processor: Intel 2 Core Quad CPU @ 2.4Ghz
Hard Disk Drive: 253 GB
Memory: 4.096GB




SVCHostFiles.doc.jpg
 Description:
 Filesize:  45.96 KB
 Viewed:  81 Time(s)

SVCHostFiles.doc.jpg



SVCHostFiles.doc.jpg
 Description:
 Filesize:  45.96 KB
 Viewed:  69 Time(s)

SVCHostFiles.doc.jpg



_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Fri Feb 01, 2008 2:37 pm    Post subject:
Reply with quote

The traffic meter has been a huge blunder for ZA. It doesn't measure just internet traffic, or network traffic, it measures ALL TCP/IP traffic, including when your computer talks to itself using TCP/IP. There may have been absolutely nothing wrong in the beginning.

This particular machine, what is it setup to do? Are you sharing the internet connection thru this machine? Is it setup as a file server or other kind of server? This is the kind of thing That may point in the right direction.

As for the 4 scanning process entries, it is fixable. But lets figure out the traffic meter problem first.


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Fri Feb 01, 2008 3:11 pm    Post subject:
Reply with quote

Thanks, Hoov, your reply is much appreciated.

This PC is networked to the two others through a wireless network but is not set up as a server. The meter clicks away whether or not the other PCs are on or off. I attach an image of my advanced settings (with addresses, etc, blanked out), which I believe are OK.

This PC is set up general work, with an accent on video/ audio editing/ production. As I said all was working perfectly until the upgrade!

I don't know if this is enough (sorry, only limited/ average knowledge here) but ask whatever querstions to clarify.




ZAISS Settings2.jpg
 Description:
 Filesize:  152.91 KB
 Viewed:  70 Time(s)

ZAISS Settings2.jpg



_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Sat Feb 02, 2008 5:47 am    Post subject:
Reply with quote

go into the task manager in windows and tell me what (other than the system idle process) is using the most cycles of the CPU. If there is a few that are using a lot, let me know.


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Mon Feb 04, 2008 4:28 pm    Post subject:
Reply with quote

Hi Hoov
Thanks (been away for the weekend, so sorry for the delay).Following other advice, I've already turned off start-up programmes and services, so this is what is running at the moment:

Winword.exe is the highest at 51,000kb (but only when Outlook is open). Next vsmon.exe and one version of svchost are both around 46,000kb. Explorer.exe is 41,000kb and iexplorer is 31,000kb. zclient weighs in at 21,000kb.

Mantispm.exe and one scanningprocess.exe (1 of 4 as this is a quad processor) are around 11,000kb. I have a couple of other svchost.exes around 8,000kb, along with a programme called procexp.exe (process explorer). Csrss.exe, spoolsv.exe are around 6,000-7,000kb.

2 more scvhost.exes are at 4,000kb as well as ctfmon.exe. 3 more svchost.exes are around 3,000kb, along with alg.exe and taskmgr.exe. QTTask.exe and winloggon.exe are at 2,000kb and a scanningprocess.exe.

I have asmss.exe and 3 scanningprocess.exes at around 700-800kb and lastly system.exe and realsched.exe at 200kb.

Also I have a process explorer running at the moment. Activity is continually bouncing between Deferred Procedure call, SVChost.exe and vsmon.exe.

Something that may be relevant. The wireless router was accidentally turned off and immediately the traffic meter stopped. I looked at my programmes and see that ASUS has only 1 exe (Rtwlan.exe) in the zonealarms list and all columns are set to'?'. Should I put all the ASUS exes (such as DelOEM.exe, AEGISI5.exe and even RTWLan.ico) in the ZAISS list and give each column a tick?

I hope this info helps you guide me in the right direction.


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Tue Feb 05, 2008 4:08 am    Post subject:
Reply with quote

You didn't give me the info I needed about the cycles, you gave me the memory usage, but it worked out OK anyway, you found out what is causing the issue. It's the router. What is the brand and model number of the router that you have. I want to download the user manual to see if there is anyway to make it less chatty. Also how is it connected to the internet? Cable, DSL, etc?

Setting the access settings in ZA to something other than what they are now, won't change the chattiness, it just removes the asking for permission aspect.


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Wed Feb 06, 2008 3:03 pm    Post subject:
Reply with quote

Hi Hoov
Thanks for your reply. First, I said router and just realised I meant wireless modem. The model is:

Philips ADSL Modem Multiservices PSTN Voice: snv6520/18

The thing is it didn't do this before the ZAISS upgrade - only the moment the upgrade was opened. Also, it is the wireless modem for the other 2 PCs and there are no problems with those two. Why would it just happen on just mine?

I'm begining to think ZAISS is out to get me. Since yesterday the ZAISS toolbar in outlook has irritatingly disappeared although it is all switched on in the ZAISS control panel!

Any help, much appreciated.


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Sun Feb 10, 2008 1:47 am    Post subject:
Reply with quote

I have been trying to get info about your modem, but there is a definite lack of it out there. That combined with the rest of your issues on this one machine, I think the shotgun approach will work best. Try uninstalling your copy of ZoneAlarm in the manner described in this post, http://forum.zonelabs.org/zonelabs/board/message?board.id=AllowAccess&message.id=103

Read them over and let me know if there is anything there that you are unfamiliar with. You can also follow the instructions without actually doing anything permanent, just to make sure you know where everything is, and how to do it. When we put that procedure together, we tried writing it so anyone could follow it.


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Mon Feb 11, 2008 9:12 am    Post subject:
Reply with quote

Thanks for your time trying, Hoov, it's much appreciated.

I'll try your advice although I have completely removed everything once already. It'll take me a few days because I've got to concentrate on a client project all this week. Once I've done it, I'll let you know the results - good or bad!

PS, It looks like whatever, I'll have to reload ZAISS because my Sonic Firewall may be corrupted now (Outlook keeps putting it into disabled add-ons with a message it caused a serious problem 'the last time it was loaded'!) Doh!!!


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Mon Feb 11, 2008 2:20 pm    Post subject:
Reply with quote

Are you using ZA and the sonic firewall on the same machine at the same time?


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Mon Feb 11, 2008 2:33 pm    Post subject:
Reply with quote

Hi Hoov
It's the Sonicwall junk/spam filter I'm talking about (sorry, I don't think I was clear), which is part of ZAISS and opens when I open Outlook. It is on the same machine.


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Tue Feb 19, 2008 8:17 am    Post subject:
Reply with quote

Have you done the reinstall yet?


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Tue Feb 19, 2008 10:08 am    Post subject:
Reply with quote

Hi Hoov

Thanks for the follow up, it's much appreciated. I'm literally about to start (the day job has kept me up to my eyes) this last week and I knew I'd need an hour or two set aside.


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
glaustin

Trooper
Trooper


Joined: Feb 01, 2008
Posts: 20
Location: UK

PostPosted: Tue Feb 19, 2008 5:13 pm    Post subject:
Reply with quote

Hi Hoov
Get me a brick wall!!!

I first ran restore to a period well before the ZAISS download problem started. The result was ZAISS was corrupted and crashed my internet connection (interestingly the traffic was not showing on the modem after I restored connectivity).

After the internet problems were solved, I cleaned out anything ZL connected but on reloading its chattering away again. I don't know what that original download did, but it's caused a conflict problem somewhere in this PC.

Just in case, I've added the range of PCs to the ZA IP firwall address list. Any other ideas on what I can set or configure so the SVCHost stops the traffic meter chattering???

I'm also approaching this problem from the modem angle, in case the upgrade triggered a wireless setting problem as well and have dropped my ISP a line to see if they have any thoughts. As you had some problems finding any info, this link may offer something: http://selfcare.belgacom.net/private-internet-configuration-modems-wireless-en.html. My modem is the Philips Red (3p).


_________________
Thanks & regards
Gra
Back to top
View users profile Send private message
Hoov

Zone Alarm Host
Zone Alarm Host
PIRT Handler

Joined: Jun 21, 2002
Posts: 4613
Location: USA
1st Responders Phishing Squad Premium RootKit Detection Hosts Rootkit Responders Team F@H

PostPosted: Wed Feb 20, 2008 3:25 am    Post subject:
Reply with quote

There is one thing we can try. Go into the firewall expert rules and create an expert rule to log all traffic originating from your router to your computer. Set it to log only, or it will drive you crazy. Let it run for a while then disable the rule. Then go to the log viewer and see what port or ports the traffic between the two is on. Let me know if you need help writing the expert rule.


_________________
For ZoneAlarm help http://www.donhoover.net
Back to top
View users profile Send private message Send email Visit posters website
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Zone Alarm All times are GMT
Goto page 1, 2, 3  Next
Page 1 of 3

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer