[Resolved] Vector Internet Monitor

http://www.auditmypc.com/process/vsmon.asp


Apparently it has something to do with the Zone Alarm firewall.

Vector
But I don't have ZoneAlarm.

That's an odd message, if you are reporting it verbatim and you do not have Zone Alarm. The legitimate Zone Labs component is named "True Vector Internet Monitor, and its process is "vsmon.exe". Either something else is going on, or, since you say it began with the installation of Comcast cable broadband, its possible Comcast's included software incorporates a version of Zone Alarm - possibly a re-branded Zone Alarm free. I'm not aware of Zone Alarm or a derivitive used by Comcast, but that just means I'm not aware of it. Some broadband providers do embed 3rd-party security/privacy software within their installation packages, mebbe its there and you just don't know it. Have you confirmed there's nothing in your Programs file which might be from Zone Labs - or perhaps something from Comcast labled to indicate it would be a firewall? I suggest you consult with their tech support (though it pretty much sucks ) to see if in fact that is the case.

More precise info regarding the " ... message from Microsoft that an error had occurred ... blah blah blah ... " would be helpful; what Microsoft component failed, bringing up the error message, and what was the error number?

What were you doing when the errors/failures occured - what other programs or applications did you have running, and did you have multiple browsers and/or differently branded browsers open at the same time -for example, several active windows open regardless of browser/version, and/or both Firefox and Internet Explorer running at the same time? Did you have a media player active, or a graphics or text viewer/editor running? Were there any messaging or email clients open, were you downloading anything or transfering data or burning to removeable media at the time?

Please be as precise and accurate as possible when reporting error messages; they generally include useful info. If you are running a version of Windows which supports event logging (Win 9x/ME do not, without 3rd-party plugins), perhaps the message was captured by your event log, and can be retrieved from there.

Finally, what Operating System/Service Pack/Internet Explore version do you have installed, and what is the version and update status of your Firefox installation?

Vector Internet Monitor
Ok, Timber, that's a lot of information to provide, and I don't think I can give it all, but here's what I know, in order of your asking:

The error messages are exactly as I have reported.

I will contact Comcast about the Zone Alarm possibility.

I had no other programs running as far as I know definitely, but it is always possible that Thunderbird was open at any given time.

The event occurs mostly when I am trying to copy a New York Times article into Word. In fact, I think those may be the only times.

I don't know about logging - how can I access my event log - if there is one?

OS=XP Home with SP2 IE 6.0 & Firefox 1.07.

Thanks.

Vector Internet Monitor
I checked with Comcast and they said they have no connection to Zone Alarm.

Well, then that's real bad news. I suggest you update your resident antivirus, boot into safe mode, and run a full system scan-and-clean (noting and recording the full name and path of any file reported as uncleanable/undeleteable, if any), then reboot normally, and immediately go to Trend Housecall, and run the free online virus scan available there. Prior to running Trend Housecall, read this Trend Micro article: WORM_RBOT.BO, familiarize yourself with the procedure outlined there, and be prepared to follow the steps as listed once you've run the online Housecall antivirus scan and saved its log or noted and recorded the full name and path of any relevant files, as described in the article.

Additional info (if you care; interest-only sorta stuff, not critical to cleaning things up) is available at:

Computer Associates: Win32 Rbot Family

Sophos: W32/Rbot-BO

Sysinternals: Zone Alarm/Rbot


Oh - to access Win XP's Event Viewer, Start> Administrative Tools > Event Viewer - but right now your first priority is to clean your machine.

It is very possible you have other problems as well; Rbot is a "Back Door" worm which tends to invite freinds. Prolly be a good idea to post a HijJackThis log after running the Trend cleanup procedure - mebbe even a good idea to run through the Whole Drill

Vector Internet Monitor
Should I really do all this? My AV is automatically updated, and I run Spybot and AdAware weekly.

Also EZ Armor Firewall.

Up to you, TK; the symptoms you describe appear to call for the prescription I supplied - the update-and-safemode scan with your resident antivirus, followed by the Trend Housecall cleanup. The follow-up care, doing a full runthrough of the yuckware removal procedure, is just good practice.

It certainly appears something's wrong with your system regardless what you have or haven't done, or you wouldn't be here now looking for a solution to the problem you're having, the way I figure it.

Just goes to show that even when you think your'e good and protected, maybe ain't quite so!

I'll let you know how things go, and thanks.

Vector Internet Monitor
Timber - I've just pulled up the WORM RBOT.BO reference, and it says this is a worm that affects a network. Before I start major cleaning I'd like to ask if that means a computer not in a network could also be affected.

Thanks.

It certainly does - just 'cause there are no other machines on the same network for yours to infect doesn't mean yours isn't infected - and again, the symptoms you describe fit the disease perfectly.

Is this something that can be transmitted by email?

Certainly; the infection code could be incorporated into just about any file - an email, a game, a media file, an image, and it also occurs as a result of backdoor vulnerabilities effected by other worms and trojans, which is why I think a thorough system cleanup would be a good idea for any machine presenting the symptoms you've described.

Thanks. I was afraid of that.I've done the AV scan/clean (nothing showed up) & now I'm going to Trend Housecall.

Should I notify my regular correspondents of the possibility that their computeers have become infected?

Everything seems ok now. Additionally, I ran CWShredder because CoolWebSearch showed up. Now that's gone, too.

I copied a paragraph from the NYT just to see if I could and it worked just fine.

However, I think I'll do the HiJack log posting just for insurance.