Zone alarm

[kfh]

Hi All,
I hav'nt had a flag since before christmas in Win ME.
Since I dual booted Xp pro I get loads.
Do I allow the following and what do they mean.

Generic host process for win32 is trying to acess the internet.
And I get a load trying to act as servers.
thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[ErnieK]

kfh
Do NOT allow this to acecess the internet. Also make sure that all servers are dis-allowed in ZA. I am like you when in XP. My total number of attempts to date is 148 in just over one hour. I have been trying to find a way of stopping this but no success yet. If you go to the following link you will find a list of what you can turn off in XP Service configuration, it also give you info on what each is for. I have reduced my background progs to about 8 XP default progs. (do have another 7-8 running but these are my AV software etc - so I have managed to reduce by about 12 default settings. XP still running nice and sweet exept for this prob)
http://www.blkviper.com/WinXP/servicecfg.htm

Ps. Remember you ca turn of the pop up window in ZA - go tot the allerts page and de-select "Show pop up window
------------------
Ernie

[This message has been edited by ErnieK (edited 02-26-2002).]

[YODA74]

Thats a pretty good link ErnieK,I like the mans attitude. http://www.PCGuide.com/ubb/biggrin.gif

------------------
Death has come to our windows.

-- Jeremiah 9:21
(undoubtedly a Biblical reference to a Microsoft product!)

YODA74@carolina.rr.com

[sea69]

I would go here (http://www.pcguide.com/ubb/Forum15/HTML/000765.html) and see the following along with the rest.

don't feel bad about asking questions about this, that's how we all learn (together)

http://www.PCGuide.com/ubb/wink.gif

GH-
"Generic Host Process for Win32 Services" are "in process" programs (programs that runs as DLLs) that run or "host" services. In Win2k and XP they're run by svchost.exe. The command "tasklist /svc" should show you what's being run by "SVChost". Just remember there may be many instances of SVChost listed running on your system and each one will be running different programs. (I use "tlist" a resource kit program to display this information. In XP you'll use "tasklist" which might display the information differently.)


------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[This message has been edited by sea69 (edited 02-26-2002).]

[kfh]

Hi ernie/sea,
great link lots to read.
Sea it's a bit above my head changing all those settings might stuff up.I'd like to be abel to do it.
thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[This message has been edited by kfh (edited 02-27-2002).]

[ErnieK]

kfh
I saved the page from my link and the cut and pasted it into word, printed it out and worked from there.
First turn on (if not already on) Sysyrestore. Take a snap shot and open up services. with the printed page in front of you just disable thing 3 at a time. Leave like that for a day or two. The make another snap shot nand disable another three. by making snapshots you have the facillity to go back if something stops working.

I havw save the link pages to read of line and will let you know how it goes. http://www.PCGuide.com/ubb/wink.gif

------------------
Ernie
Ps Work from the explanation section as opposed to the beginning of the page, this way it easier to see what you are doing.

[This message has been edited by ErnieK (edited 02-27-2002).]

[kfh]

Hi ErnieK,
I printed of the services page from the link yesterday, and started deleting as he sudjested. But made the mistake of doing it through msconfig, don't think I stuffed anything up. I've got down to shell hardware detection, But reading your post today I've stopped for now.
I'll go into msconfig and reinstall all. And go through control panel and do it right this time. Three things I've noticed no ZA flags since and no icon to tell me if I'm on line, and my printer has gone from control panel.
Thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[sea69]

I would do a sys restore to the point before you started changing things (if possible) and then follow the directions at the black Vipers site as well as unplug-n-play and winxpspy applications.

and WinXP-Spy (http://www.xp-antispy.de/index.html?/download.htm) is a must have!

(choose the english version unless you sprekken some german)

http://www.PCGuide.com/ubb/wink.gif

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[This message has been edited by sea69 (edited 02-28-2002).]

[ErnieK]

kfh
Like you I have lost the two wee winodws that show I am connected. But as I use a dialer, and this shows its own connection indicator, this does not bother me. If you re-enable all the services you will get them back. Just be sure to disable the things that MS sets as default - (what I call the phone home things)

Printer - Did you disable Print Spooler? I left that at auto and I still have Faxes \ Printer in the control panel

ZA - Do you have ZA set to run at boot-up? (I have) I have three ZA flags as follows 1- Vsmon.exe 2- ZoneAlarm.exe 3- Mini log

When connected to net and IE + OExp + Visual Zone + Ad_Aware (To check runnung servs at this moment - closing it down after checking running serv's) + 3 AV Software I have 18 running services.



------------------
Ernie

[kfh]

Hi Sea/ErninK,
I re-enabled everthing in msconfig.
Got the printer back and icon, and also the flags.
I had switched of print spooler.
When I did the three finger salute just after booting in Win ME, I had two items running Explorer and ZA. Performance was between 95/98%, I can't work out how to view these items in xp there is more menues.
Sea what is xpspy apps.
thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[sea69]

here are the XP-Spy FAQ's

FAQ
Q: Do I have to pay for this program?

A: Definately no! This program is and will be free of charge.



Q: Might XPAntiSpy3 render my system unstable?

A: As far as we know there have been no problems reported by users so far. If you happen to find a bug please report it.



Q: What do all these settings mean? Which ones should I choose?

A: All settings will be set to their recommended values upon start. Normally, you shouldn't have to change anything. See Settings Reference for a complete list of all items. Usually you might still want to choose if you want to remove MSN Messenger or not (see here).



Q: Do I have to run XPAntiSpy upon every boot?

A: No, running the program once is sufficient, though running it several times shouldn't have any harmful effects. If you had to repair/re-install your Windows XP® system we suggest you to run it again just to be sure.



Q: What happens if I apply a Service-Pack to my XP-installation?

A: Since there have been no SP's for Windows XP® so far, we can't tell you the possible effects or problems.



Q: Do I still have to use a firewall after running XPAntiSpy3?

A: We strongly encourage you to do so. There are several other commercial applications being known for their "phone-home" effects, there might also be some parts in Windows XP® this tool doesn't cover yet.



Q: Did you find out about all these settings in Windows XP® by yourself?

A: No, the "manual settings" have been posted in several boards. I just compiled all the tips into one program. A special thanks must go to the users of Cosmo Connor's Board.



Q: Who wrote this program and why?

A: Chris Connell, I just enjoy coding ;-)



Q: Does XPAntiSpy3 also run on WIN95/98/ME/NT/2000?

A: As the name suggests, it only runs under Windows XP®.




and in the "Read Me":

"Included Files:
XPAntiSpy3E.exe ---------> The Executable Program
XPAntiSpy.chm ----------> The Help-File

Changelog V3.3:
26.12.01
-Added functionality to disable the start of MS Messenger every time Outlook Express starts.
-Added functionality to disable the showup of the BalloonTips.
-Added functionality to clear out the pagefile every time windows is shutdown
-The MS Messenger autostart setting now can be reset to it's initial setting, if the MS Messenger is still installed.
-The MS Supportuser now is deleted automatically.
-The Services are now stopped automatically, though a restart of the system isn't neccessary anymore.
-To each entry, there is now a little help text displayed in the below window, if the mouse is moved onto the setting.

Bekannte Fehler:
-In some cases, the errorreport service can't be stopped, workarount is to restart the system manually.

Changelog V3.31:
30.12.01
-Fixed some misspellings
-The setting 'clear out the pagefile every time windows is shutdow' couldn't be reset in the previous version, this is now fixed."
__________________________________________


hubba bubba

http://www.PCGuide.com/ubb/wink.gif

http://www.PCGuide.com/ubb/biggrin.gif


------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[This message has been edited by sea69 (edited 02-28-2002).]

[ErnieK]

YIPPEE! http://www.PCGuide.com/ubb/biggrin.gif
Been on line 3 times tonight and only had 1 - yes one - warning from ZA, and that was from the link that Sea inserted concerning Anti-Spy.
Warning as follows -(IE could not accept a(n) UDP Port 1189 connection from 212.104.XXX.XXX because servers are blocked)
(I have Anti-Spy installed already but wanted to see what the link was)

The following are the changes I have made:

Disabled the DAP tool bar
Disabled Chryptographic services
Disabled "Generic Host Processor For Win32 Services" access to the internet (don't have home network but left that enabled)in ZA\Programs

By now I would usually have had a total in excess of 50-60+ warnings by now(3 on-line sessions at about 40 minutes each)

Will work backwards over the next couple of days to try and re-create the constant ZA warnings and keep you informed

------------------
Ernie

[This message has been edited by ErnieK (edited 02-28-2002).]

[kfh]

Hi ErnieK,
I've started enabling the settings that bv recomended, I've done 11 now got down to cryptographic services. But I've still got 28 processes running in the background.
thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[ErnieK]

kfh
Keep up the good work
As far as my whoopeeing went I whoopeed to soon. Now getting same but indicating IE instead of GHP got 180 (one hundred and 80) hits in 2 hrs Come back into 98 tonight as it was driving me loopy trying to sort it out. Will re-insert the changes I made prior to my last post and start start afresh over the weekend.
There must be a solution to this GHP accessing the server. If you read in the papers about a raving loony (for the less enlightened - a Loony is a complete gibbering madman) Scotsman running down hte street gibbering away to himself it will be me http://www.PCGuide.com/ubb/biggrin.gif

------------------
Ernie

[kfh]

Hi Erniek,
Just about fed up myself,I had an Oric atmos 48k back in the that ran better than xp. I'm finding that it's easier to use ME to get on line.
Everything in me seems faster to me. If you pop down to me we can walk down to the Channel tunnel, and go ranting and raving around the streets of europe, that would be mad. I'll chip away at it a bit more this weekend.
thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[sea69]

well, I'm networked in my winxp pro machine now so I have just come to the realization that many things will not be able to be turned off as in win9x/ME and they are needed for winp to run correctly.

Things that we did not know were running in win9x/me are seen and able to be adjusted in winp and a lot of them need to be there.

The fault seems to be with ZONE ALARM not winXP, and I don't care which version I have tried them ALL!

kfh- how much RAM do you have ??



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[kfh]

Hi sea,
I've got two sticks of crucial 256mb cl 2 sdram.
I've done a bit more adjusting to the services, thing are getting a bit better. Only 26 processing running now. One thing that ZA said when I renewed my liecence last month, That ZA 3 is out soon maybe that will be better.
Thanks,
kfh.


------------------

-------
Illegitimus non tatum carborundum.

[sea69]

yeah, but the key is to have the correct ones running.

and learning which ones they are!

heh


I like to XPeriment so often I find the wrong way, and that lets me know the right way.

http://www.PCGuide.com/ubb/wink.gif




------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[kfh]

That's true sea,
I have learnt one thing, if diable ms mesenger then connect I get on line quicker. And after enable it I get flagged generic host process win32.
kfh.


------------------
-------
Illegitimus non tatum carborundum.

[sea69]

ms mess- is the 1st thing I got rid of after UP&P.

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[ErnieK]

kfh
I have made a ghost of XP and I am going to disable everything except for RPC which I understand to be the core thing for XP to see what happens. The work FORWARDS. See what computer so do to normal sane folk - make them totally irrational. http://www.PCGuide.com/ubb/biggrin.gif

As far as going through the tunnel I would more than likely be picked up as an imigrant who had gotten mixed up was heading in the wrong direction. What with my babbling and gibbering they would thing I was speaking in a foreign language. http://www.PCGuide.com/ubb/rolleyes.gif

Sea
I have narrowed them down to about 7-8 runnung proccesses and XP in its self is stable enough. It is just this Internet thing that is driving me balmy. ZA is running OK and causes me no probs. If I unistall \ disable it I am then left with servers (UDP & TCP) being able to connect to the web. I am a stand alone machine. http://www.PCGuide.com/ubb/frown.gif

------------------
Ernie

[kfh]

Hi ErnieK/Sea,
I've completed BV tips and thing are running sweet, Web pages are opening quicker than a cheap whores legs. I've still got over 20 processes running on bootup,Can you help me to reduce these. I want to do a selective startup can you point me in the right direction on which items to disable. I read somewhere today that there is a great config tool on XP pro, you probally no of it any way run gpedit.msc. I'll let you play with that one I would'nt no where to start.
Thanks,
kfh.


------------------
-------
Illegitimus non tatum carborundum.

[This message has been edited by kfh (edited 03-04-2002).]

[ErnieK]

Hi there kfh
If you go to Start\Run and type msconfig this will take you into the area you want. Choose the "startup" where you can de-select desired progs.

------------------
Ernie

[kfh]

Hi Erniek,
I did that sunday but not sure what to disable.

IMJPMIG.
TINTSEPT. TWO Entries.
RUNDLL32.
TASKSWITCH.
FAST.
RMCTRL.
CTFMON.

The rest I know what they are, I had a list of the start up progs in me.
That where safe to disable, But can't find an XP list. I've done a google search.
Thanks,
kfh.


------------------
-------
Illegitimus non tatum carborundum.

[ErnieK]

kfh
I do not have any of the things you mention. In my startup I have selected references to my Anti-Virus - Firewall - Ad-Aware - Tweak XP and things like that. I have de-selected everything else. When you start up do the 3 finger salute and click on APPLICATIONS (first in the line) to see exactly what is running there.

The best \ safest thing to do is disable them ONE AT A TIME. Run for a few hrs and see if there are adverse affects. Usually anything in here has been put there by ourselves and is safe to deselect. If you have adverse re-action just re-select it.
What do you have showing down beside your clock? Anything there is usually safe to deselect. personally all I have there is my AV - ZA and windows volume control.

To be on the safe side wait until SEA or one of the others comes back at you before you touch them
Below is my thoughts on the progs

CTFMON = monitor of some sort?
FAST = could be fast-user switch in XP (Unless you have multiple users you will be switching this of in services)
TASKSWITCH = could be related to the TASK-MONITOR (which you will possibley be dis-abling in services anyway - I have)
RUNDLL32 = This is a system file and I do not think not should be in the startup unless you have a program that inserts it there.
The other two must be software related. Never heard of them

------------------
Ernie

[This message has been edited by ErnieK (edited 03-05-2002).]

[kfh]

Hi ErnieK,
There are no apps running at boot.
25 processes.
2 items by the clock ZA & NAV.
thanks,
kfh.


------------------
-------
Illegitimus non tatum carborundum.

[ErnieK]

Hi kfh
You will find reference to a couple of the things you were asking about here http://www.blkviper.com/WinXP/strangeservice.htm

Ps. Different page to my original link to this site (Great site this http://www.PCGuide.com/ubb/biggrin.gif )
------------------
Ernie

[This message has been edited by ErnieK (edited 03-05-2002).]

[Rick]

Sea

Have you installed and checked out the Program Control In ZA Pro 3 yet?

I did last Night.
It looks like a lot more control in our hands .
Even with the network running and ZA on the server / router

[sea69]

no Rick I want to get that today and install, I am networked now and ZA .362 cannot be set above medium without the other computer being made unable to connect to the net.

http://www.PCGuide.com/ubb/eek.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[Rick]

I ran into the same thing till I added it (Other Nodes) as trusted .
Also this new version has better support for ICS.
Giving each node and subnet address as trusted.

Also I should note that I did not do an uninstall or upgrade of ZA
I reinstalled everything (Clean Install) on my server to get rid of something installed by My kids.


The New version is well worth the effort.
I like the Built in Pop -up / under blocker http://www.PCGuide.com/ubb/smile.gif

[Mitch Hatfield]

It might be too late, but I was browsing and saw u talking about a similar question which I had until I was referred to the following guide which includes a very detailed description of what can and cannot be deleted under msconfig:
www.pacs-portal.co.uk/startup-content.htm (http://www.pacs-portal.co.uk/startup-content.htm)

Hope it helps u like it helped me. Cheers!!

Originally posted by kfh:
Hi Erniek,
I did that sunday but not sure what to disable.

IMJPMIG.
TINTSEPT. TWO Entries.
RUNDLL32.
TASKSWITCH.
FAST.
RMCTRL.
CTFMON.

The rest I know what they are, I had a list of the start up progs in me.
That where safe to disable, But can't find an XP list. I've done a google search.
Thanks,
kfh.




:) :) :) :) :) :) :) :)

------------------
Regards


Mitch Hatfield


[i,b]Looking out for some signs of Evolution[/i,b]