[nerrad]

Hello Again,

First of all I want to say I am very thankful for all your help, and I do apologise if my last post seemed a little sarcastic or moody! (Put it down to frustration of not finding the root of the problem and a moody partner!)

Anyway,

Having more than one AV installed on your computer can cause conflicts. I recommend removing AVG.

I know of course I didn’t install them all simultaneously!! All uninstall / install (I made the mistake of doing something like that when I first began to use computers (aged about 12!) thinking it would be more secure and then wondered why my system was lagging and giving me all types of errors!)

I can't find any info on Spycop, and I'm not familiar with it. Spywaredetector used to be rogue, it would find false positives. If this is a newer version, then it is okay. See Spyware warrior's rogue anti-spyware list for more info.

I did actually download Spycop some time ago and may be some what outdated (I don’t remember or couldn’t? update the definitions either), Spywaredetector was a freshly downloaded copy from their site. I also did another check with "Webroot Spy Sweeper 4.5" http://www.webroot.com, because you have me very paranoid now! But thankfully no infections

But as for isafe.exe, it was NOT installed on my computer when I installed ZoneAlarm. In fact, you said that isafe.exe is part of eTrust Antivirus. And yet it is in a ZoneLabs folder in System32! You did not say that you had eTrust, so I remain suspicious about this file.

I understand your concerns completely because isafe.exe is apparently not installed with the basic Zonealarm firewall. Now remember Zonelabs is a company that specialises (or at least did originally) in specifically firewalls.

Zonelabs uses Antivirus components manufactured by Computer Associates who also happen to manufacture that component for eTrust AV (explaining why their name is being used in the description of the file) even though, this still seemed a little strange to me. It is not much harder to re-brand it do Zone Alarm AV. So I have sent a copy of the file to Zonelabs to confirm its authenticity, I will post and inform you of the results when / if I hear back. A quick search of their forums will inform you of the link between isafe.exe and ZA: here and here

Once again I thank you greatly for all your help, and will make a post in the networking forum to see if they can get to the bottom of this! I will post the link here when I have done it so you can follow its progress.

Thanks again it has been a pleasure talking to you. Good luck with the training, I am sure you will be promoted to staff in no time at all!

All the best

[Advertisements]

I also did another check with "Webroot Spy Sweeper 4.5" http://www.webroot.com, because you have me very paranoid now! But thankfully no infections

Sorry about getting you paranoid . Looking at the size of Spy Sweeper's database, I'd say it is a good one, but I've had a bad experience with it recently...it could have been because it was expired , but it didn't detect the infections that I knew for a fact were on a computer I was working on. If you want the best malware detector, it is Ewido. The last time I checked, it had over 220,000 signitures in it's database, compared to Spy Sweeper's 170,000.

A quick search of their forums will inform you of the link between isafe.exe and ZA: here and here

Ah yes, I see.

Once again I thank you greatly for all your help, and will make a post in the networking forum to see if they can get to the bottom of this! I will post the link here when I have done it so you can follow its progress.

Thanks again it has been a pleasure talking to you. Good luck with the training, I am sure you will be promoted to staff in no time at all!

Thank you. I'd like to see how an expert handles it. It would teach me something new. . Nice meeting you and I hope all goes well for ya!

[computerwiz12890]

I also did another check with "Webroot Spy Sweeper 4.5" http://www.webroot.com, because you have me very paranoid now! But thankfully no infections

Sorry about getting you paranoid . Looking at the size of Spy Sweeper's database, I'd say it is a good one, but I've had a bad experience with it recently...it could have been because it was expired , but it didn't detect the infections that I knew for a fact were on a computer I was working on. If you want the best malware detector, it is Ewido. The last time I checked, it had over 220,000 signitures in it's database, compared to Spy Sweeper's 170,000.

A quick search of their forums will inform you of the link between isafe.exe and ZA: here and here

Ah yes, I see.

Once again I thank you greatly for all your help, and will make a post in the networking forum to see if they can get to the bottom of this! I will post the link here when I have done it so you can follow its progress.

Thanks again it has been a pleasure talking to you. Good luck with the training, I am sure you will be promoted to staff in no time at all!

Thank you. I'd like to see how an expert handles it. It would teach me something new. . Nice meeting you and I hope all goes well for ya!

[marcolopes]

Nope still no luck

I followed all you suggestions and the Buffer Overflow still exists and so does the disappearing RAM… Bummer

At least now my computer is running far nippier then usual.

I have noticed two things:

• When I disable the network status icon appearing in the system tray all is fine no more buffer overflow issues or memory loss.
• The connection is using Netmon Packet Capture driver and I can not disable or uninstall it as it simply freezes and hogs the CPU when I try. Maybe this has something to do with it?

Anyway at least I have found a work around to this very annoying issue! But if you have more ideas then please let me know! Because I hate leaving something unsolved!!

Meanwhile I will look around the net to see if I can find another way to remove the Packet Capture Driver and see if this is contributing to the problem.

- Has anyone found a solution for the SECOND line problem? ("The connection is using Netmon Packet Capture driver and I can not disable or uninstall it as it simply freezes and hogs the CPU when I try"). I am having the same problem. Thanks.

[SecMan]

in Reply to

Has anyone found a solution for the SECOND line problem? ("The connection is using Netmon Packet Capture driver and I can not disable or uninstall it as it simply freezes and hogs the CPU when I try"). I am having the same problem. Thanks.


Looks like you installed Netmon to capture packets.?.?

"Netmon can be installed from the SMS 2.0 CD (this version allows promiscuous mode capture) or as a component install under 2000 or XP. To install as a built-in component, navigate to the Control Panel, open Add/Remove Programs, click Add/Remove Windows Components, click Management and Monitoring Tools, then click Details - you will see the option for Network Monitor Tools."

Found it here ( It's a Google cache):
NetMon

Let me know if it helps