Continuous Incoming Phantom Data

Anonymous · Post by **Anonymous** » Fri Dec 19, 2003 10:33 am

Hello everyone ...

this is the first forum I've come across and thought that perhaps this would be a good place to start. I hope there's someone here that can help me.

Yesterday I noticed, via sygate, that there's a continuous download feed to my computer. When I checked the details, the file that was being downloaded to is called: "ndisuio". I then ran PC Pitstop and it identified the problem as being related to "realplayer". PC Pitstop provided a solution, which involved changing a particular file. Instead of doing this, I simply uninstalled the program. Now, ndisuio is no longer in sygate's list, but the phantom downloading continues and I'm not able to determine the source or destination of this downloading, which is on the order of just under 10k per sygate cycle.

Please, if anyone can help, I'd certainly appreciate it. Oh ... I ran Norton anti virus and PC Pitstop and no problem is detected.

thanks,

Dr.J

Archived topic from Iceteks, old topic ID:1796, old post ID:14979

Wren · Post by **Wren** » Fri Dec 19, 2003 12:29 pm

You might want to read through this topic and see if there is anything that might be useful.

http://www.iceteks.com/forums/index.php?sh...hl=ndisuio&st=0

Archived topic from Iceteks, old topic ID:1796, old post ID:14981

Anonymous · Post by **Anonymous** » Fri Dec 19, 2003 12:36 pm

Ah,

Sygate has identified the problem, once more, as:

c:windowssystem32drivers
disuio.sys

I read through the first page, until the person says he's resolved the problem, but without an explanation of how he did so. I guess I can run PC Pitstop again, to see what it comes up with this time. Gee, I don't like these ellusive problems.

I will read through it all ... thanks for the reference.

Any and all help appreciated.

Dr.J

Archived topic from Iceteks, old topic ID:1796, old post ID:14982

Red Squirrel · Post by **Red Squirrel** » Fri Dec 19, 2003 2:51 pm

That seems to be a big issue, type that in google and that thread comes first. The only solution would be to block in in your firewall, really. But it's not a dangeraus thing, it's mostly local data being duplicated via loopback.

Archived topic from Iceteks, old topic ID:1796, old post ID:14983

rovingcowboy · Post by **rovingcowboy** » Fri Dec 19, 2003 11:12 pm

if not the local data being looped back it might be ie or windows trying to find updates for the system. as i seem to remember something about ms changing the way the critical update notifcation programed works.

still i dont have this happen to my computer. might be just a needed access denied setting being made in your firewall. as to which one needs to be told no. i cant tell as you dont have the same programs i do and vise a versa.?

Archived topic from Iceteks, old topic ID:1796, old post ID:15005

Anonymous · Post by **Anonymous** » Wed Jun 02, 2004 12:46 pm

does anyone have a fix for the spf phantom download.

i had the same problem with ndisuio.sys. i have disabled the service and blocked it in spf.

i am still getting a phantom download in spf.

any ideas?

thanks in advance

Archived topic from Iceteks, old topic ID:1796, old post ID:20109

Red Squirrel · Post by **Red Squirrel** » Wed Jun 02, 2004 1:40 pm

Check out this thread, by the end kenshin mentioned you can disable it. It's for wireless networks and is not needed (unless you have a wireless network).

http://www.iceteks.com/forums/index.php?s=...iew=getlastpost

Archived topic from Iceteks, old topic ID:1796, old post ID:20110

Anonymous · Post by **Anonymous** » Thu Jun 03, 2004 7:27 am

thanks red squirrel. that thread was a very interesting read. i had already disabled the service but the link in the thread to patch svchost.exe was useful.

however, after patching up, the problem remained - so naturally i switched off in search of a release. to cut a long story short - when i restarted i noticed that sygate was continuously blocking certain incomming traffic.

typically the size is 62B coming in and 62B blocked. this is happening every second.

the remote IP address vary and the sygate severity level is 15. I think it is because I specifically blocked_all these IPs that they are having no joy.

do you know what they might be trying to do?

are there any tools i can get to send something to them to mash their machines up!?!?!

thanks

Archived topic from Iceteks, old topic ID:1796, old post ID:20125